17:08:22 executing program 4: 17:08:22 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x3405000000000000) 17:08:22 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x0, 0x3405000000000000) 17:08:22 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:22 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:22 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") syz_emit_ethernet(0x3e, &(0x7f00000004c0)={@local, @dev, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "8b5a46", 0x8, 0x11, 0x0, @local, @local, {[], {0x0, 0x0, 0x8}}}}}}, 0x0) 17:08:22 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x0, 0x3405000000000000) 17:08:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 17:08:23 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x0, 0x3405000000000000) 17:08:23 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:23 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:23 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x0) 17:08:23 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:23 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r1) bpf$MAP_CREATE(0x0, &(0x7f0000001b00)={0xa}, 0x3c) 17:08:24 executing program 4: clone(0x2102003ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x413e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f0000000840)=ANY=[@ANYBLOB="b70200000b400000bfa300000000000007020000fffeffff7a03f0fff8ffffff79a4f0ff00000000b706000000000001ad640500000000007502faff070000000404000001007d60b7030000001000006a0a00fe000000008500000026000000b70000000000004295000000000000001da5ad3548ebb63d18db6a1c72821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215a010c2ceaea4c1dc908abb6e7325ec1956bd8700bf36628dff1a15750ab9a780001000000000000d4bf20c2bd152d814f0101000000078d6afab418e4682b2aec5e4a35629e8eb040c50287ef7a7f4182f32333b08c6e497687e10a4daea5cac0ceaf16ddb64963d85791814cd59c7e0b8f6f5e6ee7a39e180b5a18ed78452ace71534fbd5bf227ec6b783ab1321ea5e82ae5ba2c42a5e23ea6253d5df7b19a8b4d75f41a62df9b4c03e53466fac6b7212c8d944f22d8c19f958e8b34de35949a7a799ee53da177a81ea65e65021d71b7ee86a75bb32935f542127a8f8438feecbb1c757f7169f006f3f5c951770700b14b3625962905ef911785c87238001fcf72eba5057d78d1c30c8938cc0c4a118b136d8a6084d676d8ef8aa6ecc2d32e3f4ee367e0a769c0a606636c9f4a4413c098f4fcc9661c80c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7dbebe3be70c4364333af9a9d91c3e41ac37a63f85ad8f32b70a80cce69df30d3d67d84ccf3f9db0000000000000000153c989ef1008790e6b743106ad4448b1228dfcecf59cabd6075b2201803785a51af5d67632d0db913c15f5754f02f1a94196574d5bb3d99b9f7133ef63a98d15afcf50414c722fccf1a5a9c03bde2d6d458c03c000004fafcba7282b611b531fd02da3b0994db083b1957cfe24e478b68a7ea0ab3a43616a6b8003e3e052cbde31f49ca3ba763ebfec52b1fbf63f7330f0000004d1a879003b6589a146a1c84db5d7b8dc1d8774f7b6428ba27e428f034377578e2b70ff4e70757a89abb1fd71c619eeda6396b9cb5f8d65a50bb6424dd7fdf512d1c2f447d92aea5d0cd1281215b220d8d219fbcdfe174306d11af9d0c9a018e5e06d2c800b8558ad114fc5d03e12888177055d9cab76b9ea3edf22125dbbd10de2d2efcbbb2cf97d794f6e03029c5deba0fbaea1efae44c7d85bfe7f35c41fab51a698f8f7743e1b78e8f7379929743888ae605b01caa2c581ed485f4b9c6aa"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x171}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x1) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) r1 = getpid() setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000bc0)={'filter\x00', 0x7, 0x4, 0x418, 0x110, 0x220, 0x0, 0x330, 0x330, 0x330, 0x4, &(0x7f00000000c0), {[{{@arp={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, 0x0, 0xffffff00, 0x3, 0x9, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, {[0xff, 0x0, 0x0, 0xff, 0xff]}}, {@mac=@local, {[0x0, 0x0, 0x0, 0xff, 0xff]}}, 0x120, 0x8, 0x6, 0x0, 0x7ff, 0x98, 'veth0_to_team\x00', 'team_slave_1\x00', {0xff}, {}, 0x0, 0x50}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @loopback, @dev={0xac, 0x14, 0x14, 0x15}, 0x1, 0x1}}}, {{@arp={@dev={0xac, 0x14, 0x14, 0x36}, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xffffff00, 0x3, 0x6, {@empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0xff]}}, {@empty, {[0x0, 0x101, 0xff, 0xff, 0xff, 0xff]}}, 0x2, 0x1, 0x7fff, 0x0, 0x8, 0x7, 'veth1_vlan\x00', 'syzkaller1\x00', {}, {0xff}, 0x0, 0xc0}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @empty, @dev={0xac, 0x14, 0x14, 0x1a}, 0x1}}}, {{@arp={@local, @dev={0xac, 0x14, 0x14, 0x1b}, 0xffffff00, 0xffffff00, 0xf, 0x8, {@mac=@local, {[0xff, 0x0, 0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0x0, 0xff]}}, 0x7f, 0x3, 0xffe1, 0x9, 0x20, 0x400, 'team_slave_0\x00', 'macvlan0\x00', {}, {}, 0x0, 0x41}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @empty, @multicast2, 0x2}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x468) ioctl$KVM_GET_CLOCK(r0, 0x8030ae7c, &(0x7f0000000080)) rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f0000000000)={0x0, 0x1d}) 17:08:24 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:24 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) dup2(r0, r1) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 17:08:25 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x0) 17:08:25 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:25 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:25 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:26 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) dup2(r0, r1) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 17:08:26 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x0) 17:08:26 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:26 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:26 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:27 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r1, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000080)="24000000010307051dfffd946fa2830025200a8009000100031d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 766.401711][T18525] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:27 executing program 3: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) ptrace$setopts(0x4206, r1, 0x0, 0x0) ptrace(0x4207, r1) ptrace$setregset(0x11, r1, 0x0, 0x0) 17:08:27 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:27 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:27 executing program 4: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) fallocate(r0, 0x11, 0x0, 0x10001) [ 766.682409][T18530] ptrace attach of "/root/syz-executor.3"[9815] was attempted by "/root/syz-executor.3"[18530] 17:08:27 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 766.768781][T18534] ptrace attach of "/root/syz-executor.3"[9815] was attempted by "/root/syz-executor.3"[18534] 17:08:28 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) creat(&(0x7f0000000300)='./file0/file1\x00', 0x0) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x27a, 0x0) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$FUSE_ENTRY(r0, &(0x7f00000005c0)={0x90, 0x0, 0x2, {0xfffffffffffffffe, 0x0, 0x800, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x69e8, 0x0, 0x0, 0x0, 0x1e}}}, 0x90) 17:08:28 executing program 4: syz_emit_ethernet(0x83, &(0x7f00000004c0)={@local, @dev, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "8b5a46", 0x4d, 0x11, 0x0, @local, @local, {[], {0x0, 0x0, 0x4c, 0x0, [], "008db30c80027f8595c622423505ccfe4046d47709922371054b287060935fa3616406a2a93fce2f285c2858739f0e452d378027aa3516c78aa31709fc3b52bc569757d2db"}}}}}}, 0x0) 17:08:28 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) dup(r1) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:28 executing program 4: r0 = socket(0x2000000011, 0x4000000000080002, 0x0) sendmmsg(r0, &(0x7f0000000100)=[{{&(0x7f0000000040)=@l2, 0x80, 0x0}}, {{&(0x7f0000000040)=@nfc={0x27, 0x6}, 0xc, 0x0}}], 0x400000000000160, 0x0) 17:08:28 executing program 3: perf_event_open(&(0x7f0000000440)={0x2, 0x141, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = getpid() tkill(r0, 0x9) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f00000001c0)={0x53, 0x0, 0x0, 0x0, @scatter={0x1, 0x2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/34, 0x22}]}, &(0x7f0000000240), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0xc070d3f500000000}) timer_getoverrun(0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000012c0)=ANY=[@ANYBLOB="d00800002400ffffff7f00000000ffffa6fffff7", @ANYRES32=r4, @ANYBLOB="0000000bf1ffffff000000000800010063627100a408020004040600030000000500000000700300fdffffffffff00001f0000000500000000020000010000000000100083000000fdffffff07000000084900000100000002000000cf000000feffffff080000000180000003000000090000000200000000274a49ef6949a7bb000000050000000100000004000000ff7f000000000000000400000002000004000000ff0f0000f44f350001000000010400005eb768350100000008000000ffffffffc38d00001f000000040008830600000000000100f7ffffff030000000080ffff050000000600000006000000a900000000000000c0000000c0ffffff08000000018000000101000006000000b300000000000020050000000104000004000000070000000800000001010000c22e0000c0ffffff0500000004000000060000000900000008000000f7ffffff0800000003000000080000000400000001000080040000000400000000100000040000000700000009000000fcffffff01000000010000000900000000020000060e0000080000000200000002000000090000000800000007000000ab000000fb00000007000000ff0100000800000001040000070000000300000009000000ff07000008000000ffff0000a90100000900000005000000200000000500000001000000070000008eb7000000000080010000000000000007000000fffffffffcffffff01f0ffff000000003f00000003000000000100000080000000800000030000000500000005000000ffffffff0700000015ba000004000000070000000300000003000000ffffffff04000000554f00006ff800000700000003000000000200000600000008000000b300000006000000000000000007000001010000030000000080000000040000730a000001000080010000009e0c0000000800000100008000000000000000004000000000fefffff67d000004000000ff01000002000000000000004000000040000000ed000000010001000e0a05000000000000020000040000000600000002000000ff7f00000100000001000000060000007f000000020000000004000004000000090000009000000008000000b6000000040000000400000005000000f50a0000ffff0000060000008ff9ffff070000001eaaffff3f0000008000000000000000ff0c0000ff7f0000030000007f0000002d0000000800000000010000ff070000ffffffff2bab000002000000ace800000500000000000000e1bf934d070000001f000d000300000004000000070000000900000005000000030000000200000087d400000200000008000000000100007f0000000e000000080000000200000007000000ffffff7f06000000000000000500000001000000820000001f0000000004000001000000faffffff0500000006000000070000000300000010000500810306009fff04000800000004040600d90b0000ff00000005000000040000001ba2cc3b00000080010000003f000000ff0f0000bd52c97303000000be060000fffffffffffeffff7f000000ff0000008100000000db040009000000070000000300000000000000060000008f5e0000010000000002000006000000010100000200000007000000000000e0318900000104000000efff000600000004000000080000000400000002000000c00000000800000008000000f7ffffff05000000810000004d00000001000080eb0700001f000000090000000800000001000000000000000000000002000000ffff00000100000002000000000000e0a000000040000000ff000000f7ffffff0500000009000000070000000600000028080000030000000600000004000000be00000003000000070000000500000038080000faffffffffffffff47b5554d001000008100000007000000ffffffff040000000100000002000000566b00002000000004000000020000008b01000001000000ffff000004000000ff0f0000050000002000000003000000e40d000007000000f8ffffff200000003f000000387f00000700000007000000c10a000009000000040000000400000000000000008000000100008009000000370b000000000000ff07000006000000bb7900000400000002000000ffffff7f0300000000000000090000000700000005000000000000807f0000000900000008000000fad4ffffff01000001010000010000003f0000000400000020f2ffff01000100ffff0000010000000200000008000000fbfffffff9ffffff040000004d000000060000000200000002000000070000004e0d0000000200000800000035000000300e00000700000000040000020000000180000020000000f2ffffff070000000500000000010000fffffeff0900000000080000070000000800000009000000ff7f00000900000004000000040000000000000006000000050000000100000009000000080000007e0700000300000000800000bf16000002000006000000ffee00000001000000000000000010f7006305000000000000000000007f00000010080000000000000100008002000000080000000101000003000000ffffff7ffffffffff7ffffff0600000003000000a6060000ff0300000700000001800000090000000200000000000000040000000080ffff00020000070000000500000001000100000000800000af06060000002b0a000005000000010000000500000009000000040000000500000002000000ffffff7ff30000000800000002000000ffff0000ff070000810000004000000075fc000009000000fbffffff0500000000000000810000000100000080000000d05e0000020000001f00000000000000ff010000451e00002d00000000000000ff0000001000030008001000ff070000010000001800010039031c020101000001000000000000060500000010000200e002807104000000ff03000018000100080d1e02800000000700000024709a02ff7f000010000500010000000000000007000000100003001f000300070000000101000018000100e701040009000000040000000104000000000000f2275eef7138e6d8404ee35c1c03d0a7e3015b89e6e440ebafa27d5b8188804cd5beea2fda73c030f26439c9e4f2e27a824bfb4415f2af99b482560d1a447df28d8d838ad1a39caf40dc96c5f134529d47c0604f66f8714f8ee51165c4b029a7dc7e2f90de64a234d9098b06231c71bc79c43de912eb17614cf75d8c49152a801ac9a1326f0e334e0534faa8d8704d03c25495230a2ed4feb5298d99c124310dd8d4054c8be6bdb8bcede3d1552b08c169755c508c65ff8e1c50711a38d9a451eb650df96535fcc7669eb1f0f7fc5135a05b389610d33df49e9d1d3808c8fa0524b1caa582c913fedb22de15fbc7e7890faa48e6205a74bf817d48ea3dc9cddb6acc14b94522ccce95a27379b1ced543ad45de5016647e86154fd92670b9fc95ff90ea60fcf349981185b11322c4a48276eea082e4be45b9125653ba5f8ad8500d0d768b2de6b9e198568ecd526a1ba44c9180104fa91e55e31181b4acad815ef766bc8604c30c715da309a185645439aaabb542625905dc77193d45cde1978dc9c67cea6b01d2d4a28b13fc1e71d1f2a38537c44b629790b1305371c9e705771da5555c743b5b4adea2b95aa708f41e7a713277f5422f2bb669861730554e266f4ae61e0377f517b23ae4821e04e500cf998be043bab81fa38368a555f4a381eab2a692e06a4ca80bcb7570518078eb76bd313b23d0708cd26017f5a64a703da88679bbb758ac9b2b3ad70bbd679e7e24852925d96c941ac4cce3c9863a529c9f3f024c93fbd7e61e29fcbd6368d915afa0e54e02c6053d74bf16ea95c499"], 0x8d0}}, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000080)) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) syz_open_pts(0xffffffffffffffff, 0x1) getpgrp(0x0) open(0x0, 0x0, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x11) 17:08:28 executing program 4: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socket(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) close(r2) pipe(&(0x7f0000000040)) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write(0xffffffffffffffff, &(0x7f0000000000)="fc0000001c008161ab09250009000700078b08000c00000000007e93210001c000000000000000000000000000039915fa2c1ec28670e9889bb94b46fe0000000a0002", 0x43) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) socket(0x10, 0x3, 0x0) splice(r0, 0x0, r3, 0x0, 0x4ffe0, 0x0) 17:08:28 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:28 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:28 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:29 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") r1 = socket(0x10, 0x80002, 0x0) close(r1) dup2(r0, r1) [ 767.955784][T18566] netlink: 176 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:29 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) dup(r1) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:29 executing program 3: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) ptrace$setopts(0x4206, r1, 0x0, 0x0) ptrace(0x4207, r1) ptrace$setregset(0x4201, r1, 0x0, 0x0) [ 768.481752][T18580] ptrace attach of "/root/syz-executor.3"[9815] was attempted by "/root/syz-executor.3"[18580] [ 768.614266][T18580] ptrace attach of "/root/syz-executor.3"[9815] was attempted by "/root/syz-executor.3"[18580] 17:08:29 executing program 4: syz_emit_ethernet(0x7e, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0xb, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x14, 0x7, 0x3, 0x0, [{@remote}, {@multicast1}]}, @timestamp={0x7, 0x4}]}}}}}}, 0x0) 17:08:29 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:29 executing program 3: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) r3 = dup3(r2, r1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f00000001c0)) 17:08:29 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:29 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:30 executing program 4: syz_emit_ethernet(0x7e, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0xb, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x14, 0x7, 0x3, 0x0, [{@remote}, {@multicast1}]}, @timestamp={0x7, 0x4}]}}}}}}, 0x0) 17:08:30 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) dup(r1) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:30 executing program 4: syz_emit_ethernet(0x7e, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0xb, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x14, 0x7, 0x3, 0x0, [{@remote}, {@multicast1}]}, @timestamp={0x7, 0x4}]}}}}}}, 0x0) 17:08:30 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) creat(&(0x7f0000000300)='./file0/file1\x00', 0x0) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x27a, 0x0) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) r1 = socket(0xa, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000cab000)=0xc) write$FUSE_ENTRY(r0, &(0x7f00000005c0)={0x90, 0x0, 0x2, {0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x69e8, 0xee, r2}}}, 0x90) 17:08:30 executing program 4: syz_emit_ethernet(0x7e, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0xb, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x14, 0x7, 0x3, 0x0, [{@remote}, {@multicast1}]}, @timestamp={0x7, 0x4}]}}}}}}, 0x0) 17:08:31 executing program 4: syz_emit_ethernet(0x0, 0x0, 0x0) 17:08:31 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:31 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:31 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:31 executing program 4: syz_emit_ethernet(0x0, 0x0, 0x0) 17:08:31 executing program 3: r0 = socket(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1, &(0x7f00000001c0)=0x4, 0x4) r1 = socket(0x2, 0x1, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) getsockname(r2, 0x0, &(0x7f0000000040)) 17:08:31 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:31 executing program 4: syz_emit_ethernet(0x0, 0x0, 0x0) 17:08:31 executing program 4: syz_emit_ethernet(0x7a, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0xa, 0x4, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x14, 0x7, 0x3, 0x0, [{@remote}, {@multicast1}]}]}}}}}}, 0x0) 17:08:31 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsa\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000002780), 0xfffffd4c) 17:08:31 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:32 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}}, 0x0) 17:08:32 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) dup2(r0, r1) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 17:08:32 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:32 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:32 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}}, 0x0) 17:08:32 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:32 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}}, 0x0) 17:08:32 executing program 4: syz_emit_ethernet(0x7a, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0xa, 0x4, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@remote}, {@multicast1}]}]}}}}}}, 0x0) 17:08:33 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:33 executing program 4: syz_emit_ethernet(0x7a, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0xa, 0x4, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@remote}, {@multicast1}]}]}}}}}}, 0x0) 17:08:33 executing program 3: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000080)="24000000010407051dfffd946fa283000c200a8009000100031d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 17:08:33 executing program 4: syz_emit_ethernet(0x7a, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0xa, 0x4, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@remote}, {@multicast1}]}]}}}}}}, 0x0) 17:08:33 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:33 executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) sendmmsg$sock(r0, &(0x7f0000001140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@txtime={{0x18}}], 0xf}}, {{&(0x7f0000000000)=@pptp={0x18, 0x2, {0x0, @remote}}, 0x80, 0x0}}], 0x2, 0x0) 17:08:33 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:33 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:33 executing program 4: syz_emit_ethernet(0x72, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0xc, 0x7, 0x3, 0x0, [{@remote}]}]}}}}}}, 0x0) 17:08:34 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x80002, 0x2) close(r3) 17:08:34 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:34 executing program 4: syz_emit_ethernet(0x72, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0xc, 0x7, 0x3, 0x0, [{@remote}]}]}}}}}}, 0x0) 17:08:34 executing program 3: 17:08:34 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:34 executing program 3: 17:08:34 executing program 4: syz_emit_ethernet(0x72, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0xc, 0x7, 0x3, 0x0, [{@remote}]}]}}}}}}, 0x0) 17:08:34 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:34 executing program 3: 17:08:34 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:34 executing program 4: syz_emit_ethernet(0x72, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0xc, 0x7, 0x3, 0x0, [{@multicast1}]}]}}}}}}, 0x0) 17:08:35 executing program 4: syz_emit_ethernet(0x72, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0xc, 0x7, 0x3, 0x0, [{@multicast1}]}]}}}}}}, 0x0) 17:08:35 executing program 3: 17:08:35 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:35 executing program 3: 17:08:35 executing program 4: syz_emit_ethernet(0x72, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0xc, 0x7, 0x3, 0x0, [{@multicast1}]}]}}}}}}, 0x0) 17:08:35 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:35 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:35 executing program 3: 17:08:36 executing program 4: 17:08:36 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:36 executing program 4: 17:08:36 executing program 3: 17:08:36 executing program 4: 17:08:36 executing program 3: 17:08:36 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:36 executing program 4: 17:08:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="48000000100005070000000000fd1300ff000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYRES32=0x0, @ANYBLOB="00000077cd09c2fd6615df77b47c77c46da07b832f9bd1e7960f1b663900"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000000000a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x34, 0x2a, 0x707, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_LINKINFO={0x6f}]}, 0x34}}, 0x0) [ 775.981060][T18761] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. 17:08:37 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, 0x0, 0x0) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:37 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x38, r1, 0x1, 0x0, 0x0, {0x9}, [@TIPC_NLA_LINK={0x24}]}, 0x38}}, 0x0) [ 776.112187][T18765] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. 17:08:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x23b}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="24000000240007bf8121e9fdffffff0000000000", @ANYRES32, @ANYBLOB="0000000000d60e"], 0x3}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x28}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="440400002400070500"/20, @ANYRES32=r3, @ANYBLOB="00000e00ffffffff00000000080001006362710018040200040406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000500060000000000000005000000"], 0x444}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB='$\x00\x00\x00-\x00\a\x00'/20, @ANYRES32=r3, @ANYBLOB], 0x24}}, 0x0) r4 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 776.316732][T18775] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'. [ 776.428438][T18776] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:37 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) [ 776.533197][T18779] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.3'. 17:08:37 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xfea1}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x44}}, 0x0) [ 776.707295][T18781] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.3'. [ 776.870582][T18787] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 17:08:37 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000004380)={0x0, 0x0, &(0x7f0000004340)={&(0x7f0000000000)={0x5c, 0x0, 0x1, 0xff0b, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x24}, @CTA_TUPLE_REPLY={0x24}]}, 0x5c}}, 0x0) [ 777.066659][T18787] 8021q: adding VLAN 0 to HW filter on device bond1 17:08:38 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 777.111013][T18789] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 777.132486][T18789] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:38 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x0, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 777.213582][T18794] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.3'. [ 777.252545][T18787] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 777.355149][T18794] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.3'. 17:08:38 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c}]}, 0x3c}}, 0x0) 17:08:38 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:38 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, 0x0, 0x0) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x28}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="580000002400070500"/20, @ANYRES32=r3, @ANYBLOB="00000000ffffffff0000000008000100736662002c00020028000100000000000000000000000000000000000000007a5e6491bdad0000000000000000000000ee0d4801e3c1259986f5f64c5d84d54f8822"], 0x58}}, 0x0) 17:08:38 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000c00)=@newtaction={0x874, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x860}]}, 0x874}}, 0x0) 17:08:39 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:39 executing program 3: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_getnetconf={0x14, 0x52, 0xb54453076a37b6d9}, 0x14}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14}]}, 0x34}}, 0x0) read(r0, &(0x7f00000001c0)=""/129, 0xfffffeb0) 17:08:39 executing program 4: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x18}]}, 0x2c}}, 0x0) 17:08:39 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x0, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x14}]}, 0x28}}, 0x0) 17:08:39 executing program 3: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x89a1, &(0x7f0000000240)={@local}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x2, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x2, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = dup(r5) dup2(r6, r4) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0xbd92f81ff7c8cc82}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)={0x3c, r7, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x28}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4c410}, 0x400a1) r8 = dup(r3) dup2(r8, r2) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f00000001c0)={0x0, @in={0x2, 0x4e22, @local}, @can={0x1d, 0x0}, @nfc={0x27, 0x0, 0x1, 0x7}, 0xfffc, 0x0, 0x0, 0x0, 0x617, 0x0, 0x10000, 0x1ff, 0x8}) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, &(0x7f0000000280)={@mcast2, @mcast2, @mcast2, 0x7fff, 0x5, 0x552, 0x0, 0x7, 0x42520052, r9}) dup(r1) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0185648, &(0x7f0000000080)={0x9e0000, 0xe, 0x80000001, r1, 0x0, &(0x7f0000000040)={0x990904, 0x1, [], @p_u8=&(0x7f0000000000)=0x40}}) 17:08:39 executing program 4: getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000000)=0x8001, &(0x7f0000000040)=0x2) r0 = syz_open_dev$vcsu(&(0x7f00000000c0)='/dev/vcsu#\x00', 0x80, 0x84000) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000340)={&(0x7f0000000100), 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x144, r1, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x3c}, @TIPC_NLA_BEARER={0x78}, @TIPC_NLA_NET={0x28}, @TIPC_NLA_MON={0x14}, @TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xb7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3e95e59e}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fff}]}, @TIPC_NLA_SOCK={0x1c}]}, 0x144}, 0x1, 0x0, 0x0, 0x4480}, 0x1060) bpf$MAP_CREATE(0x3100000000000000, &(0x7f0000000080)={0x6, 0x4, 0x20000000007ffd, 0x50, 0x0, 0xffffffffffffffff, 0x0, [0x31, 0x0, 0x0, 0x400100]}, 0x3c) 17:08:39 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:39 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, 0x0, 0x0) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:39 executing program 3: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x89a1, &(0x7f0000000240)={@local}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x2, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x2, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = dup(r5) dup2(r6, r4) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0xbd92f81ff7c8cc82}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)={0x3c, r7, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x28}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4c410}, 0x400a1) r8 = dup(r3) dup2(r8, r2) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f00000001c0)={0x0, @in={0x2, 0x4e22, @local}, @can={0x1d, 0x0}, @nfc={0x27, 0x0, 0x1, 0x7}, 0xfffc, 0x0, 0x0, 0x0, 0x617, 0x0, 0x10000, 0x1ff, 0x8}) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, &(0x7f0000000280)={@mcast2, @mcast2, @mcast2, 0x7fff, 0x5, 0x552, 0x0, 0x7, 0x42520052, r9}) dup(r1) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0185648, &(0x7f0000000080)={0x9e0000, 0xe, 0x80000001, r1, 0x0, &(0x7f0000000040)={0x990904, 0x1, [], @p_u8=&(0x7f0000000000)=0x40}}) 17:08:39 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:40 executing program 4: r0 = socket(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000140)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x1a94f, &(0x7f0000000400)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x14}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x48}}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@local, 0x73, r4}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={&(0x7f0000000b40), 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_LINKINFO={0x24}]}, 0x44}}, 0x0) socket$unix(0x1, 0x1, 0x0) [ 779.135206][T18849] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 779.220366][T18852] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 17:08:40 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x0, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:40 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x50, 0x2, 0x1, 0x716ec64ecd96c11f, 0x0, 0x0, {0xa}, [@CTA_TUPLE_REPLY={0x3c}]}, 0x50}}, 0x0) 17:08:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)={0x70, 0x0, 0x9, 0x4aea74d98d0225b1, 0x0, 0x0, {}, [@NFCTH_POLICY={0xc}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_TUPLE={0x3c, 0x2, [@CTA_TUPLE_IP={0x2c}, @CTA_TUPLE_PROTO={0xc}]}]}, 0x70}}, 0x0) 17:08:40 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x58, 0x1, 0x2, 0x1, 0x0, 0x0, {}, [@CTA_EXPECT_MASTER={0x44}]}, 0x58}}, 0x0) 17:08:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)={0x70, 0x0, 0x9, 0x4aea74d98d0225b1, 0x0, 0x0, {}, [@NFCTH_POLICY={0xc}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_TUPLE={0x3c, 0x2, [@CTA_TUPLE_IP={0x2c}, @CTA_TUPLE_PROTO={0xc}]}]}, 0x70}}, 0x0) 17:08:40 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000), 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:40 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:40 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000140)={0x38, 0x1, 0x2, 0x52b3fde4d6afe9a1, 0x0, 0x0, {}, [@CTA_EXPECT_MASTER={0x24}]}, 0x38}}, 0x0) 17:08:41 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)=@sco, 0x80, 0x0, 0x0, 0x0, 0xfffffffffffffd9c}, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:41 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:41 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x38, 0x0, 0x9, 0x49de4d1c41542053, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_TUPLE={0x18, 0x2, [@CTA_TUPLE_IP={0x14}]}]}, 0x38}}, 0x0) 17:08:41 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:41 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000013c0)=@newlink={0x40, 0x10, 0xa0d, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_VFINFO_LIST={0x18}]}, 0x40}}, 0x0) 17:08:41 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)=@sco, 0x80, 0x0, 0x0, 0x0, 0xfffffffffffffd9c}, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:41 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000), 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:41 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:42 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:42 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) [ 781.287794][T18900] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 17:08:42 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)=@sco, 0x80, 0x0, 0x0, 0x0, 0xfffffffffffffd9c}, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) [ 781.427295][T18900] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 781.527077][T18900] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 17:08:42 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)=@sco, 0x80, 0x0, 0x0, 0x0, 0xfffffffffffffd9c}, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:43 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24}]}, 0x44}}, 0x0) 17:08:43 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:43 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000), 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:43 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) [ 782.172247][T18913] __nla_validate_parse: 14 callbacks suppressed [ 782.172258][T18913] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:43 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:43 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:43 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_LINKINFO={0x14}]}, 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r5], 0x28}}, 0x0) 17:08:43 executing program 3: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) [ 782.616290][T18930] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:43 executing program 3: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:43 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000140)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x1a94f, &(0x7f0000000400)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x14}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x48}}, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket(0x0, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) [ 783.067034][T18937] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 17:08:44 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) [ 783.117012][T18937] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:44 executing program 3: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:44 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r2 = dup(r1) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000000)=0x7) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r3, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r2, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r4, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) r8 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r8, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r10 = dup(r9) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r4, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r4, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) [ 783.332133][T18941] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 783.362672][T18941] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:44 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r8) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:08:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:44 executing program 4: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video35\x00', 0x2, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x5, 0x250a00) r2 = socket$netlink(0x10, 0x3, 0x200000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100)="480000001400f90c09004beafd0d8c56028447000bffe0064e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) setsockopt$packet_tx_ring(r3, 0x107, 0x5, &(0x7f0000000000)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x3e}, 0xacf0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0x14) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000280)={{{@in=@loopback, @in=@dev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000000380)=0xe4) getsockname$packet(r0, &(0x7f00000038c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000003900)=0x14) r4 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IP_VS_SO_SET_ZERO(r4, 0x0, 0x48f, &(0x7f0000000000)={0x0, @empty, 0x4e22, 0x0, 'lblc\x00'}, 0x2c) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c}]}, 0x3c}}, 0x0) 17:08:44 executing program 3: r0 = socket$kcm(0x11, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:44 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r8) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:08:44 executing program 3: r0 = socket$kcm(0x11, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) [ 783.897463][T18963] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20002 [ 783.937772][T18963] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:45 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r8) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) [ 784.122276][T18970] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20002 17:08:45 executing program 3: r0 = socket$kcm(0x11, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:45 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:45 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r2 = dup(r1) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000000)=0x7) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r3, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r2, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r4, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) r8 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r8, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r10 = dup(r9) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r4, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r4, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:08:45 executing program 4: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video35\x00', 0x2, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x5, 0x250a00) r2 = socket$netlink(0x10, 0x3, 0x200000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100)="480000001400f90c09004beafd0d8c56028447000bffe0064e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) setsockopt$packet_tx_ring(r3, 0x107, 0x5, &(0x7f0000000000)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x3e}, 0xacf0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0x14) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000280)={{{@in=@loopback, @in=@dev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000000380)=0xe4) getsockname$packet(r0, &(0x7f00000038c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000003900)=0x14) r4 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IP_VS_SO_SET_ZERO(r4, 0x0, 0x48f, &(0x7f0000000000)={0x0, @empty, 0x4e22, 0x0, 'lblc\x00'}, 0x2c) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f00000053c0)={'team0\x00'}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="4400000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012000c00010067726574617000000c00020008000100", @ANYRES32, @ANYBLOB="0a002c5f8f83af3f45760d77f789d3e79d048d453086a6003f54785076438181de92c9d32b", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000000)={0x0, @empty, 0x4e22, 0x0, 'lblc\x00'}, 0x2c) 17:08:45 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:45 executing program 3: socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:45 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 784.527280][T18979] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20002 [ 784.565788][T18979] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 784.644243][T18979] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 784.713796][T18988] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:45 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:45 executing program 3: socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) [ 784.857293][T18988] batman_adv: Cannot find parent device [ 785.011168][T18998] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20002 17:08:46 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 785.063363][T18991] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 785.076794][T18991] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:46 executing program 3: socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:46 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r2 = dup(r1) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000000)=0x7) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r3, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r2, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r4, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) r8 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r8, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r10 = dup(r9) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r4, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r4, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:08:46 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:46 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000280)=@newlink={0xa8, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_XDP={0x80}]}, 0xa8}}, 0x0) 17:08:46 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:46 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, 0x0, 0x0) [ 785.600545][T19014] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 785.649674][T19014] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 17:08:46 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, 0x0, 0x0) [ 785.806958][T19014] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 17:08:47 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, 0x0, 0x0) 17:08:47 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:47 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000140)={0x44, 0x1, 0x2, 0x52b3fde4d6afe9a1, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x30}]}, 0x44}}, 0x0) 17:08:47 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, 0x0, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:47 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:47 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:47 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'veth0_to_bond\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000012c0)=@newlink={0x38, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_VFINFO_LIST={0x18}]}, 0x38}}, 0x0) 17:08:47 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:47 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x54, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40}]}, 0x54}}, 0x0) 17:08:48 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:48 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, 0x0, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:48 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000001000050800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000014000300626f6e643000000000000000000000001c0012000c0001c8d06f6e64000000000c00020008000c0000000000"], 0x50}}, 0x0) syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x1, 0x8240) r1 = socket(0x10, 0x80002, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x30, r2, 0x803, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0x10}, @TIPC_NLA_MEDIA={0xc}]}, 0x30}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x3d2}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r7}]}, 0x28}}, 0x0) 17:08:48 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:48 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) [ 787.361227][T19064] __nla_validate_parse: 73 callbacks suppressed [ 787.361239][T19064] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:48 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) 17:08:48 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) [ 787.489856][T19069] device bridge_slave_0 left promiscuous mode [ 787.619109][T19069] bridge0: port 1(bridge_slave_0) entered disabled state 17:08:48 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x0, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:48 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce0000001", 0x14}], 0x1}, 0x0) [ 787.949983][T19064] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:49 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, 0x0, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:49 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, 0x0}, 0x0) 17:08:49 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:49 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000001000050800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000014000300626f6e643000000000000000000000001c0012000c0001c8d06f6e64000000000c00020008000c0000000000"], 0x50}}, 0x0) syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x1, 0x8240) r1 = socket(0x10, 0x80002, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x30, r2, 0x803, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0x10}, @TIPC_NLA_MEDIA={0xc}]}, 0x30}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x3d2}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r7}]}, 0x28}}, 0x0) 17:08:49 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, 0x0}, 0x0) [ 788.523109][T19091] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:49 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, 0x0, 0x0) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:49 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, 0x0}, 0x0) 17:08:49 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x0, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:49 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newtaction={0x60, 0x30, 0x1, 0x0, 0x0, {}, [{0x4c}]}, 0x60}}, 0x0) 17:08:49 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80}, 0x0) 17:08:50 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18}]}, 0x38}}, 0x0) 17:08:50 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:50 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:50 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80}, 0x0) [ 789.260997][T19114] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:50 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x50, 0x1, 0x1, 0x1, 0x0, 0x0, {}, [@CTA_TUPLE_REPLY={0x3c}]}, 0x50}}, 0x0) [ 789.574123][T19124] netlink: 56 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:50 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x0, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:50 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80}, 0x0) 17:08:50 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, 0x0, 0x0) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:50 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000c00)=@newtaction={0x74, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x60}]}, 0x74}}, 0x0) 17:08:51 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) 17:08:51 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000007580)=@newlink={0x4c, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20}, @IFLA_ADDRESS={0xa, 0xa, @dev}]}, 0x4c}}, 0x0) 17:08:51 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:51 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) [ 790.162511][T19139] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 790.194707][T19139] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. [ 790.233753][T19142] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:51 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) [ 790.285792][T19142] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 17:08:51 executing program 4: 17:08:51 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) 17:08:51 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, 0x0, 0x0) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:51 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x0, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:51 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1}, 0x0) 17:08:51 executing program 4: 17:08:52 executing program 4: 17:08:52 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1}, 0x0) 17:08:52 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:52 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:52 executing program 4: 17:08:52 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1}, 0x0) 17:08:52 executing program 4: 17:08:52 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:52 executing program 4: 17:08:53 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x0, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:53 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f", 0xa}], 0x1}, 0x0) 17:08:53 executing program 4: 17:08:53 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x0, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:53 executing program 4: 17:08:53 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f", 0xa}], 0x1}, 0x0) 17:08:53 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:53 executing program 4: 17:08:53 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:53 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f", 0xa}], 0x1}, 0x0) 17:08:54 executing program 4: 17:08:54 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x0, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:54 executing program 4: 17:08:54 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac1414", 0xf}], 0x1}, 0x0) 17:08:54 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x0, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:54 executing program 4: 17:08:54 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:54 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac1414", 0xf}], 0x1}, 0x0) 17:08:54 executing program 4: 17:08:54 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac1414", 0xf}], 0x1}, 0x0) 17:08:55 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:55 executing program 4: 17:08:55 executing program 4: 17:08:55 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:55 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce000", 0x12}], 0x1}, 0x0) 17:08:55 executing program 4: 17:08:55 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x0, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:55 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce000", 0x12}], 0x1}, 0x0) 17:08:55 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:55 executing program 4: 17:08:55 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce000", 0x12}], 0x1}, 0x0) 17:08:55 executing program 4: 17:08:56 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, 0x0, 0x0, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:56 executing program 4: 17:08:56 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce00000", 0x13}], 0x1}, 0x0) 17:08:56 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:56 executing program 4: 17:08:56 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce00000", 0x13}], 0x1}, 0x0) 17:08:56 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:56 executing program 4: 17:08:56 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:57 executing program 3: r0 = socket$kcm(0x11, 0x100000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="9e43010000800000002f1fe4ac14140ce00000", 0x13}], 0x1}, 0x0) 17:08:57 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, 0x0, 0x0, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:57 executing program 4: 17:08:57 executing program 3: 17:08:57 executing program 4: 17:08:57 executing program 3: 17:08:57 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:57 executing program 4: 17:08:58 executing program 3: 17:08:58 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:58 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:58 executing program 4: 17:08:58 executing program 3: 17:08:58 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, 0x0, 0x0, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:58 executing program 4: 17:08:58 executing program 3: 17:08:58 executing program 4: 17:08:58 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:08:58 executing program 3: 17:08:59 executing program 4: 17:08:59 executing program 3: 17:08:59 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:08:59 executing program 4: 17:08:59 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:08:59 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000001c0)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x11011, r0, 0x0) 17:08:59 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x0, 0x0) readv(r0, &(0x7f0000001900)=[{0x0}, {0x0}, {&(0x7f0000000600)=""/240, 0xf0}], 0x3) 17:08:59 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:00 executing program 4: syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1000000000, 0x6, 0x0, 0x400000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001740)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf200000000000001500000008ffffffbd0301000000000095000000000000006916000000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f610000000000006507000002000000070700004c0000001f75000000000000bf540000000000000704000004004109ad4301000000000095000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c27dfcecf264e0f84f9f17d3c30e3c72fe9755ba08508460b603daf5a7d1dbdd2d17f2f1754558f2278af6d71d79a5e12814ccdd8a5d4601d2966d702006484877b4f5c45a6a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bd994a6538b89dc6c60bf70d742a81b7"], &(0x7f0000000100)='GPL\x00'}, 0x48) r0 = getpid() tkill(r0, 0x9) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xffffffffffffffd9) socket$alg(0x26, 0x5, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_SPORT={0x6}]}}}]}, 0x38}}, 0x0) socket$inet6(0xa, 0x3, 0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000001580)={'team0\x00'}) 17:09:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000180)=@ipx, 0xfffffffffffffe64, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_targets\x00') readv(r0, &(0x7f0000000580), 0x3c1) 17:09:00 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:00 executing program 3: ftruncate(0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000c00)=@newtaction={0x13, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x1c}]}, 0x30}}, 0x0) 17:09:00 executing program 4: r0 = socket(0x10, 0x80002, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0}, 0x20) 17:09:00 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:01 executing program 3: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, &(0x7f00000001c0)='!\x00') 17:09:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4008ae6a, &(0x7f00000003c0)={0x2, 0x0, @ioapic}) 17:09:01 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:01 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r6 = socket$inet6(0xa, 0x200000000003, 0x87) r7 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r7, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r9 = dup(r8) ioctl$DMA_BUF_IOCTL_SYNC(r9, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) setsockopt$inet6_mtu(r6, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r10 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r10, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r11) connect$inet6(r6, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(0xffffffffffffffff, 0x0, r5, 0x0, 0x10005, 0x3405000000000000) 17:09:01 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r6 = socket$inet6(0xa, 0x200000000003, 0x87) r7 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r7, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r9 = dup(r8) ioctl$DMA_BUF_IOCTL_SYNC(r9, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) setsockopt$inet6_mtu(r6, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r10 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r10, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r11) connect$inet6(r6, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(0xffffffffffffffff, 0x0, r5, 0x0, 0x10005, 0x3405000000000000) 17:09:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = getpid() tkill(r0, 0x9) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000100)) 17:09:01 executing program 4: mknod(&(0x7f0000000440)='./file0\x00', 0x0, 0x0) r0 = open(&(0x7f00009e1000)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x0, 0x0) fcntl$setlease(r1, 0x400, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x0, 0x0) 17:09:01 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:01 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:01 executing program 3: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1000000000, 0x6, 0x0, 0x400000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001740)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf200000000000001500000008ffffffbd0301000000000095000000000000006916000000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f610000000000006507000002000000070700004c0000001f75000000000000bf540000000000000704000004004109ad4301000000000095000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c27dfcecf264e0f84f9f17d3c30e3c72fe9755ba08508460b603daf5a7d1dbdd2d17f2f1754558f2278af6d71d79a5e12814ccdd8a5d4601d2966d702006484877b4f5c45a6a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bd994a6538b89dc6c60bf70d742a81b7"], &(0x7f0000000100)='GPL\x00'}, 0x48) getpid() tkill(0x0, 0x9) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xffffffffffffffd9) socket$alg(0x26, 0x5, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0xfd) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_SPORT={0x6}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @local}]}}}]}, 0x40}}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x0) getsockopt$inet6_int(r1, 0x29, 0x50, 0x0, &(0x7f0000000080)=0x182) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000001580)={'team0\x00'}) 17:09:01 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r6 = socket$inet6(0xa, 0x200000000003, 0x87) r7 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r7, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r9 = dup(r8) ioctl$DMA_BUF_IOCTL_SYNC(r9, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) setsockopt$inet6_mtu(r6, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r10 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r10, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r11) connect$inet6(r6, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(0xffffffffffffffff, 0x0, r5, 0x0, 0x10005, 0x3405000000000000) 17:09:02 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0x0) 17:09:02 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}], 0x1, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:02 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:02 executing program 3: r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) getsockopt$packet_int(r0, 0x107, 0xa, 0x0, &(0x7f00000000c0)) 17:09:02 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:02 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:02 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8010aebc, &(0x7f00000003c0)={0x0, 0x0, @ioapic}) 17:09:02 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:03 executing program 3: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(0x0, r1) listxattr(&(0x7f0000000540)='./file0\x00', 0x0, 0x0) 17:09:03 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:03 executing program 4: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x27a, 0x0) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f00000005c0)={0x90, 0x0, 0x2, {0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x69e8, 0x0, 0x0, 0x0, 0x1e}}}, 0x90) 17:09:03 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}], 0x1, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:03 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) r8 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r8, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r10 = dup(r9) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:09:03 executing program 3: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) lseek(r0, 0x0, 0x4) 17:09:03 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:03 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}}, 0x200008d0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:04 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}], 0x1, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:04 executing program 4: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) llistxattr(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 17:09:04 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) r8 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r8, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r10 = dup(r9) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:09:04 executing program 4: syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1000000000, 0x6, 0x0, 0x400000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xffffffffffffffd9) socket$alg(0x26, 0x5, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0xfd) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_SPORT={0x6}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @local}]}}}]}, 0x40}}, 0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x50, 0x0, &(0x7f0000000080)=0x182) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001580)={'team0\x00'}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) 17:09:04 executing program 3: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x20) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x4) fsetxattr$security_ima(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) write$P9_RATTACH(r3, &(0x7f0000000500)={0x76591ff02f01386a, 0x69, 0x1}, 0xfffffffffffffe81) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f00000002c0)="6ad10d870fe593c83895666985", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write$P9_RREMOVE(r4, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) writev(r3, &(0x7f0000000400)=[{0x0}], 0x1) r5 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fdatasync(r4) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000200)={0x0, r4, 0x9, 0xffffffe4, 0x0, 0x4}) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000000), 0x4) socket(0x10, 0x803, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendto(r6, &(0x7f00000002c0), 0x0, 0xc0001, 0x0, 0x13) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000380)) getuid() mount$fuseblk(0x0, &(0x7f00000005c0)='./bus/file0\x00', &(0x7f0000000600)='fuseblk\x00', 0x4000, &(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB=',rootmode=0000000000000,us\x00'/36, @ANYBLOB="e48d9eef801620b05a836698", @ANYRESDEC=0x0, @ANYBLOB="a065cfa2f34d11d535c83f59d7d2ab57e3f8c9e626f3f37f28db88e528945ba1ba0fe2fd92b0dc1d2cd9caa5ba7f702996beb4201f12e59802317c1c84eb1c82160b08e152db7125569dc394eb62f6ed6778dbee8c2e5e26f9b988eab92c3c8c8106c8b8415d7bdf143bc3eb2c410bf770bb8fbb7f51c447eae7d02ae357bf99c803dd328890093643718f630fd3fcc75958ca03533fe7ed78fe558df4f69945133389ffe08b7199f97bf25c0e745ca25c6c700de1212325698c0c6b8ae140e67429524457a29779827c16c48bce179bf2a7b8292bcde49c2c99fb63bfb6f332004badcdac47724739f4877486525a324d390c10b26b7098a5beaa5c655c36027bd4e3d308995f9c286917076fe95f09b77593bae15ed2caafbb54ba1d5a435a45fadd0bd65aecfe03dfa353fbbaea2ea578ebd3aa1825ba417f179725c0b683fc1f52f04ba1b2b25dc6f8838f4cd0d221ae9b6e65f0569a65d09f1f88eb73081d14d71bd85c86d14ec7dec2f6373922ceec4430d6924e2ed98aa18176e5a9da05de709f07686f311810a1bb0a3d7eae75d0fb4715bc8b9f2f91d3ebf3c66f9d60612fdb14e25ab5d5fc65174ab94b25fb6960b9a02b2aaa4f0d53"]) 17:09:05 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:05 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:05 executing program 4: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x20) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x200c00, 0x0) fsetxattr$security_ima(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) write$P9_RATTACH(r3, &(0x7f0000000500)={0x76591ff02f01386a, 0x69, 0x1}, 0xfffffffffffffe81) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) write$P9_RREMOVE(r4, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) writev(r3, &(0x7f0000000400), 0x0) r5 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fdatasync(r4) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000200)={0x0, r4, 0x9, 0xffffffe4}) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, 0x0, 0x0) socket(0x0, 0x803, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000c00)=@newtaction={0x14}, 0x14}}, 0x0) sendto(r6, &(0x7f00000002c0), 0x0, 0xc0001, 0x0, 0x13) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000380)) getuid() 17:09:05 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}], 0x1, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:05 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) r8 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r8, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r10 = dup(r9) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:09:05 executing program 3: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x20) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x4) fsetxattr$security_ima(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) write$P9_RATTACH(r3, &(0x7f0000000500)={0x76591ff02f01386a, 0x69, 0x1}, 0xfffffffffffffe81) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f00000002c0)="6ad10d870fe593c83895666985", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write$P9_RREMOVE(r4, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) r5 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fdatasync(r4) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, 0x0) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000000), 0x4) socket(0x10, 0x803, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendto(r6, &(0x7f00000002c0), 0x0, 0xc0001, 0x0, 0x13) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000380)) getuid() mount$fuseblk(0x0, &(0x7f00000005c0)='./bus/file0\x00', &(0x7f0000000600)='fuseblk\x00', 0x4000, &(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB=',rootmode=0000000000000,us\x00'/36, @ANYBLOB="e48d9eef801620b05a836698", @ANYRESDEC=0x0, @ANYRESDEC, @ANYBLOB="a065cfa2f34d11d535c83f59d7d2ab57e3f8c9e626f3f37f28db88e528945ba1ba0fe2fd92b0dc1d2cd9caa5ba7f702996beb4201f12e59802317c1c84eb1c82160b08e152db7125569dc394eb62f6ed6778dbee8c2e5e26f9b988eab92c3c8c8106c8b8415d7bdf143bc3eb2c410bf770bb8fbb7f51c447eae7d02ae357bf99c803dd328890093643718f630fd3fcc75958ca03533fe7ed78fe558df4f69945133389ffe08b7199f97bf25c0e745ca25c6c700de1212325698c0c6b8ae140e67429524457a29779827c16c48bce179bf2a7b8292bcde49c2c99fb63bfb6f332004badcdac47724739f4877486525a324d390c10b26b7098a5beaa5c655c36027bd4e3d308995f9c286917076fe95f09b77593bae15ed2caafbb54ba1d5a435a45fadd0bd65aecfe03dfa353fbbaea2ea578ebd3aa1825ba417f179725c0b683fc1f52f04ba1b2b25dc6f8838f4cd0d221ae9b6e65f0569a65d09f1f88eb73081d14d71bd85c86d14ec7dec2f6373922ceec4430d6924e2ed98aa18176e5a9da05de709f07686f311810a1bb0a3d7eae75d0fb4715bc8b9f2f91d3ebf3c66f9d60612fdb14e25ab5d5fc65174ab94b25fb6960b9a02b2aaa4f0d53"]) 17:09:05 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) dup(r1) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:05 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:06 executing program 4: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1000000000, 0x0, 0x0, 0x400000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001740)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf200000000000001500000008ffffffbd0301000000000095000000000000006916000000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f610000000000006507000002000000070700004c0000001f75000000000000bf540000000000000704000004004109ad4301000000000095000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c27dfcecf264e0f84f9f17d3c30e3c72fe9755ba08508460b603daf5a7d1dbdd2d17f2f1754558f2278af6d71d79a5e12814ccdd8a5d4601d2966d702006484877b4f5c45a6a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bd994a6538b89dc6c60bf70d742a81b7"], &(0x7f0000000100)='GPL\x00'}, 0x48) r0 = getpid() tkill(r0, 0x9) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xffffffffffffffd9) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = socket(0x10, 0x803, 0xfd) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_SPORT={0x6}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @local}]}}}]}, 0x40}}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x0) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f0000000080)=0x182) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000001580)={'team0\x00'}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) 17:09:06 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}], 0x1, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:06 executing program 3: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x20) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x4) fsetxattr$security_ima(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) write$P9_RATTACH(r3, &(0x7f0000000500)={0x76591ff02f01386a, 0x69, 0x1}, 0xfffffffffffffe81) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f00000002c0)="6ad10d870f", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) writev(r3, &(0x7f0000000400)=[{0x0}], 0x1) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) fdatasync(0xffffffffffffffff) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000200)={0x0, 0xffffffffffffffff, 0x9, 0xffffffe4, 0x0, 0x4}) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000000), 0x4) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000380)) getuid() mount$fuseblk(0x0, &(0x7f00000005c0)='./bus/file0\x00', &(0x7f0000000600)='fuseblk\x00', 0x4000, &(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB=',rootmode=0000000000000,us\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="e48d9eef801620b05a836698", @ANYRESDEC=0x0, @ANYRESDEC, @ANYBLOB]) 17:09:06 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) r2 = dup3(r1, r0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0xfdf6) sendto$inet(r1, &(0x7f0000000300)="e695d7fd4428d67b8690c2809788d0d23de6ca8507f6dbda1a026d4cf74251dd5957592035f1d9310d12561f8368b816326835c4f4fc291e27a69cf4118ff3fdcc8d00d402c20870dec639ef07b451581c84f08d35ac0bcd7b6e851c68b0be42e8035c03309c445bb36d15d5a9f11623563de0516003163aa2ab2c8106218b30d5a82afc81a83162a2356102205743ccdaee72e43c723f4aa07f66e45b4e834eb97fd8bcdb10edaa2dbb4e51f6b5ce32f8f1ef51476ffddc43b26cb723f9c62c45fea8e99b554a7c97edeedf1a0ef50079d6e6f18536931b9182b0b6248bc24b2491701015e71ec414e2ddc0bc226344e06cc0d386e9706661fc22574b4f295f07337bd2af8df4450c7325298de6bbbb660f6847d12a4070a5fc472a499bf82da42302bfcbc33ad4be47d21e1bd0ee7758f0cb859ba3c16c138fbe3d978bcc253ec3a0e14d45378c12d260cfdb955d6d7122ec4b03ea53c9bd5aed7ed32cbcea8063706aa391daf5e7a5a1e095309b9e65c8418f4ebfbda48d137baf185c75579457ca2bec93725813c88135d9d35708ed4aeea4d563fd2eb910b2b35a91182ff9a807a83642471822593e14eb1b36b1b3402d3d7f94749270155431e9fe7481aea2013b6816ae1ad4b95c7a7eea6e57c68d9ca3e83c5c5f1e8e2f79135f1c61479cefb3b968a8614606a8e3dfecc29a977b152139aeb2804486f6c6273e467e7b824bfac50fc38025ce36713821f9231963ee5ffcf077b8dbe200cfc3bf9c23a4cdb51644f315c1be4f961ccff54e9bfc7804fee9c6cc042380bfd4959394cc1cce0590705c23d9e40fa1b3c7d67672a852da477ea8de486b77d505105ec9430349203174d965da5a7fda8407a4fff9d14be977607e6cf5f854f19923e70df4f6bfe8768028f0cbb6e333ff17d173a7bfc91bbf2715b199feb0bc92c4ccd12496ee1ef066ded3dbf5f3ffb968ace935b4ea363d544210c286a776a7c4aa5d1fb410435ddac4ef28ff86ebfe230022cbbf8ff3613f7f5050c5013b629c091b4400f18a1e4c1a9eff95809150d0572bf64fb9802c25f9b249e0aceb0431623a7b197037f1322758df3c93d7ed7cf5703e706bd4936ac3eb06329286596bfe4d3e21c24c8ab4466c0ea6cac11addb8bf16f98abf3b4dd70fa7446e06bba89240732c6d881ae5078be1e600407cf7f9d77438dda28c7ae1c385d50667ec03f1357da5232489d572eeebbc91a063ebcb1930536c90f15bb5490bd6a2aa241f00d1a41dd40ab53b9b532b3ccb720c69115e66e5c144841a4295035b7421ca8ae4f6b16b60ab68045fa1c46c5e809828213a4347823921dbbaa79136e272d3e624966a992454d9cf2f38f76728880cd86049c3e7f59f921c98687c3b7b35045b9957b6228abae0f5b1d7641947361436f412098eee955f814949580f4733ebe1e987259f5762b76e6d11d5a31fc1d61f6814eebb47adb785a7bac9f591c4c1ebf1771fe171a63ca918ddbfbf8f0d0444d95614ccbd6535c611a58b9cd543d57af91907b2e93d78a3f63855aeec52e5a76a2cd8ee428ec2c89887cf67dcc767ba3d7853f683d8679b3d61e8540b78a00dfc144ee19383217a4c2bc9cebc61642387eebdfe0882d4e57176075b6dbe7a1a6e9bcd1c21d2f37b079f77abfc9f08a0fddd7b35eb52b5e13e1b7913fc28e8a000569f0345a72a11e3a70d3b426390f7f1643d8c67b4aefb4094021111667977e51e68b6829cb5583c25314c58c1acf3e6553f82d06c20ba0d631f606e7a4dd5ce4116803e49e1f5a64bd514d6dafae00718a8f7acdffb3d54253e4c0f009b97cb1f3b10d695b7f97e2f987c1ac686817d87c8feffa5887b75d0b950e18fe8c10ebc36aed4d3e6bcfa68a3c0fbf2a90e5f1d560656dbb24f65103a0b2d26142ca6f069c132156372563f190299f08448e1e646482533c1ea2177c4623fc9445d2b7ce8becb17422b8743947bdb65e39e5b3b35102e1e3867e75ad29390d63e1ce29ee848bd43d0abf419ba766128670c5ae1c83aa53bb7fa06e98577eb78970177711659d777cd96a4c4f17f7be82bd9d57efcc228cf7c9d00cf639fdca54f5b1022b7a91c591063454c6ba4bb35867a48893b3cc038d750ac6762fcbe652bbe524c3b01c75487625011be9382380531cc7fac762ca74e40976bb834956e021c1b4a5f2b31cebab6e5e55b20bee2e6c02e36b86064af64e7327697c105269fe6ca406fbe9e91c121e4f20b3585e5eb8118c5dec168b5c897935e82eaf60f289e2169ab459bb65dfb98be20813f1808fdb3cb90c124ea83d0832be338c37010ed5dd0a18df6dcb969a5eb6c552700b535d44a5d5a6507c05b0846032388e0a9bcf47008f37663e5490d72f6a8d765503836ea50d18636e7c7e34ac7a7c946cfd13833d00ac968044f82d650613f5332d479cb689a", 0x6c1, 0x0, 0x0, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) 17:09:06 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, 0x0, 0x0) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:06 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) dup(r1) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:06 executing program 4: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20010001, &(0x7f0000000280)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) r2 = dup2(r1, r1) sendto$packet(r2, 0x0, 0xffffffffffffff08, 0x0, 0x0, 0xfffffffffffffdb4) close(r2) tkill(r0, 0x1000000000016) 17:09:06 executing program 3: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x20) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x4) fsetxattr$security_ima(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) write$P9_RATTACH(r3, &(0x7f0000000500)={0x76591ff02f01386a, 0x69, 0x1}, 0xfffffffffffffe81) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f00000002c0)="6ad10d870f", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) writev(r3, &(0x7f0000000400)=[{0x0}], 0x1) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) fdatasync(0xffffffffffffffff) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000200)={0x0, 0xffffffffffffffff, 0x9, 0xffffffe4, 0x0, 0x4}) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000000), 0x4) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000380)) getuid() mount$fuseblk(0x0, &(0x7f00000005c0)='./bus/file0\x00', &(0x7f0000000600)='fuseblk\x00', 0x4000, &(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB=',rootmode=0000000000000,us\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="e48d9eef801620b05a836698", @ANYRESDEC=0x0, @ANYRESDEC, @ANYBLOB]) 17:09:07 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:07 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}], 0x1, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:07 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x60342) pwrite64(r0, 0x0, 0x0, 0x0) 17:09:07 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) dup3(r1, r0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0xfdf6) sendto$inet(r1, &(0x7f0000000300)="e695d7fd4428d67b8690c2809788d0d23de6ca8507f6dbda1a026d4cf74251dd5957592035f1d9310d12561f8368b816326835c4f4fc291e27a69cf4118ff3fdcc8d00d402c20870dec639ef07b451581c84f08d35ac0bcd7b6e851c68b0be42e8035c03309c445bb36d15d5a9f11623563de0516003163aa2ab2c8106218b30d5a82afc81a83162a2356102205743ccdaee72e43c723f4aa07f66e45b4e834eb97fd8bcdb10edaa2dbb4e51f6b5ce32f8f1ef51476ffddc43b26cb723f9c62c45fea8e99b554a7c97edeedf1a0ef50079d6e6f18536931b9182b0b6248bc24b2491701015e71ec414e2ddc0bc226344e06cc0d386e9706661fc22574b4f295f07337bd2af8df4450c7325298de6bbbb660f6847d12a4070a5fc472a499bf82da42302bfcbc33ad4be47d21e1bd0ee7758f0cb859ba3c16c138fbe3d978bcc253ec3a0e14d45378c12d260cfdb955d6d7122ec4b03ea53c9bd5aed7ed32cbcea8063706aa391daf5e7a5a1e095309b9e65c8418f4ebfbda48d137baf185c75579457ca2bec93725813c88135d9d35708ed4aeea4d563fd2eb910b2b35a91182ff9a807a83642471822593e14eb1b36b1b3402d3d7f94749270155431e9fe7481aea2013b6816ae1ad4b95c7a7eea6e57c68d9ca3e83c5c5f1e8e2f79135f1c61479cefb3b968a8614606a8e3dfecc29a977b152139aeb2804486f6c6273e467e7b824bfac50fc38025ce36713821f9231963ee5ffcf077b8dbe200cfc3bf9c23a4cdb51644f315c1be4f961ccff54e9bfc7804fee9c6cc042380bfd4959394cc1cce0590705c23d9e40fa1b3c7d67672a852da477ea8de486b77d505105ec9430349203174d965da5a7fda8407a4fff9d14be977607e6cf5f854f19923e70df4f6bfe8768028f0cbb6e333ff17d173a7bfc91bbf2715b199feb0bc92c4ccd12496ee1ef066ded3dbf5f3ffb968ace935b4ea363d544210c286a776a7c4aa5d1fb410435ddac4ef28ff86ebfe230022cbbf8ff3613f7f5050c5013b629c091b4400f18a1e4c1a9eff95809150d0572bf64fb9802c25f9b249e0aceb0431623a7b197037f1322758df3c93d7ed7cf5703e706bd4936ac3eb06329286596bfe4d3e21c24c8ab4466c0ea6cac11addb8bf16f98abf3b4dd70fa7446e06bba89240732c6d881ae5078be1e600407cf7f9d77438dda28c7ae1c385d50667ec03f1357da5232489d572eeebbc91a063ebcb1930536c90f15bb5490bd6a2aa241f00d1a41dd40ab53b9b532b3ccb720c69115e66e5c144841a4295035b7421ca8ae4f6b16b60ab68045fa1c46c5e809828213a4347823921dbbaa79136e272d3e624966a992454d9cf2f38f76728880cd86049c3e7f59f921c98687c3b7b35045b9957b6228abae0f5b1d7641947361436f412098eee955f814949580f4733ebe1e987259f5762b76e6d11d5a31fc1d61f6814eebb47adb785a7bac9f591c4c1ebf1771fe171a63ca918ddbfbf8f0d0444d95614ccbd6535c611a58b9cd543d57af91907b2e93d78a3f63855aeec52e5a76a2cd8ee428ec2c89887cf67dcc767ba3d7853f683d8679b3d61e8540b78a00dfc144ee19383217a4c2bc9cebc61642387eebdfe0882d4e57176075b6dbe7a1a6e9bcd1c21d2f37b079f77abfc9f08a0fddd7b35eb52b5e13e1b7913fc28e8a000569f0345a72a11e3a70d3b426390f7f1643d8c67b4aefb4094021111667977e51e68b6829cb5583c25314c58c1acf3e6553f82d06c20ba0d631f606e7a4dd5ce4116803e49e1f5a64bd514d6dafae00718a8f7acdffb3d54253e4c0f009b97cb1f3b10d695b7f97e2f987c1ac686817d87c8feffa5887b75d0b950e18fe8c10ebc36aed4d3e6bcfa68a3c0fbf2a90e5f1d560656dbb24f65103a0b2d26142ca6f069c132156372563f190299f08448e1e646482533c1ea2177c4623fc9445d2b7ce8becb17422b8743947bdb65e39e5b3b35102e1e3867e75ad29390d63e1ce29ee848bd43d0abf419ba766128670c5ae1c83aa53bb7fa06e98577eb78970177711659d777cd96a4c4f17f7be82bd9d57efcc228cf7c9d00cf639fdca54f5b1022b7a91c591063454c6ba4bb35867a48893b3cc038d750ac6762fcbe652bbe524c3b01c75487625011be9382380531cc7fac762ca74e40976bb834956e021c1b4a5f2b31cebab6e5e55b20bee2e6c02e36b86064af64e7327697c105269fe6ca406fbe9e91c121e4f20b3585e5eb8118c5dec168b5c897935e82eaf60f289e2169ab459bb65dfb98be20813f1808fdb3cb90c124ea83d0832be338c37010ed5dd0a18df6dcb969a5eb6c552700b535d44a5d5a6507c05b0846032388e0a9bcf47008f37663e5490d72f6a8d765503836ea50d18636e7c7e34ac7a7c946cfd13833d00ac968044f82d650613f5332d479cb689a", 0x6c1, 0x0, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) sendmsg$NL80211_CMD_GET_INTERFACE(r3, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000b80)={0x14}, 0x14}}, 0x0) 17:09:07 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, 0x0, 0x0) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:07 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) dup(r1) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:07 executing program 4: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) close(r0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000140)={0x0, @rand_addr, @initdev}, &(0x7f0000000580)=0xc) bind$packet(r1, &(0x7f0000000000)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @local}, 0x14) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) 17:09:07 executing program 3: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r0 = syz_open_dev$vcsa(0x0, 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) 17:09:08 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:08 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x0) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:08 executing program 4: 17:09:08 executing program 3: 17:09:08 executing program 4: 17:09:08 executing program 3: 17:09:08 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, 0x0, 0x0) epoll_wait(r5, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:08 executing program 4: 17:09:08 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:08 executing program 3: 17:09:08 executing program 4: 17:09:09 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:09 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x0) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:09 executing program 3: 17:09:09 executing program 4: 17:09:09 executing program 3: 17:09:09 executing program 4: 17:09:09 executing program 3: 17:09:09 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:09 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:09 executing program 4: 17:09:09 executing program 3: 17:09:10 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:10 executing program 4: 17:09:10 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x0) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:10 executing program 3: 17:09:10 executing program 4: 17:09:10 executing program 3: 17:09:10 executing program 4: 17:09:10 executing program 3: 17:09:11 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:11 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:11 executing program 4: 17:09:11 executing program 3: 17:09:11 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:11 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x0, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:11 executing program 4: 17:09:11 executing program 3: 17:09:11 executing program 4: 17:09:11 executing program 3: 17:09:11 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x0, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:12 executing program 4: 17:09:12 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:12 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:12 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:12 executing program 3: 17:09:12 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x0, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:12 executing program 4: 17:09:12 executing program 3: 17:09:12 executing program 4: 17:09:12 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:12 executing program 3: 17:09:12 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:12 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:13 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:13 executing program 4: 17:09:13 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:13 executing program 3: 17:09:13 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:13 executing program 4: 17:09:13 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:13 executing program 3: 17:09:13 executing program 4: connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x3f}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="7e9100001400ebff84be00f35ebd99b910"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x4) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 17:09:13 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:13 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:13 executing program 3: r0 = socket$inet6(0x10, 0x2, 0x6) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x68, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x52, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x68}}, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000000b06000000a7562a8e63b24f6f5a26010000fc000000004033"], 0x1}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)="1b0100001a001f0f500e00dd4e38c88c759ddc4f00c7796c1cecaee7fdd3", 0x169, 0x884, 0x0, 0x2f9) 17:09:13 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x0) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:13 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:13 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) recvfrom$inet6(r0, 0x0, 0x6000, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x14, 0x0, 0x2, 0x201}, 0x14}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={&(0x7f0000000280), 0xc, &(0x7f00000002c0)={&(0x7f0000000a80)=ANY=[@ANYBLOB="cc0500001200019eff000000000000000a20000000120a01030000000008000000000000010900010073797a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c04054000000000000000059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d3000000000000000000000001400000000000000000873690001007663616e300000000000000000000000140001006c6f000000000000000000bda20000000900010073797a3100000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d3000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f7365300000000000000000000000080002407fffffff08000240000000042c0003801400010073797a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d6163766c616e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000000000000000000800024000000002540003801400010006006e643000000000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000014000100000000040000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a0500000000000000000007000005080002400000000240000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000010c00024000000000000000030c000240000000000000000338000000000a01010000000000000000000000010900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c0006400000000000000005600000000e0a000000000000000000000000000608000440000000010900010073797a31000000000900020073797a320000000008000440000000030900020073797a30000000000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de0000010900010073797a3000000000340100000b0a0102a997aa55a9d91c583ad7f17b20a0ca000000000000000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f936000d40160b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a59419187b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c37431555c6b65d8d922a3ad3813035e16e61e349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000000b4000000000000000050900010073797a310000000008000440000000aa140000001100010000000000000000000000000aace12f01930534b0dda8263feeb3d454ff93f1ef2732e1d5fdea76c7474fcb6dbf161d0527ad88643bcc939dffe14f1d19261c9c1d8822e2dfbf7437a78c069951f4cce02ea365b4444d110718f0ffd34081c4d689441a4e48f19ac7922f23bab304d5f9d4851c3526b6c7ef14486a1b6d778c81b0641b8b54e587cec72dcf8238002b1ea004ea775923e25a484f9c8400000000000000000000000000d3c792984e4fd5ae049ca80bf0d76a8819f3da8ebc1b0c1a3882e6f66cd15b318ca886556846837a1f49e52f0f1054a0f06bfed2cd64442150a2e35023de2a11e395cc54c9b99ce915877938a5a55756049066201233d3e75b61a760af2c74cb71bf9ea2c5e9dee709cd8b35a115b50ca2d8aa3b09b731b6d11246cfcb6a3ef7fc7fa9f6dbdf57361d94827b142e45ea8c53182b57bc92f370a00913b18622e4e7c30f84cc58c5dc232b288b1bd365a81b4edcb6a86260977d000000000000000024b9463bee1a8ca7fa6b5b4b1ce9ba06ee731e1883fa815064f687d0c7c19ec8e8906a"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) 17:09:13 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:14 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)={0x68, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x2}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x68}}, 0x0) [ 813.068777][T19746] netlink: 1452 bytes leftover after parsing attributes in process `syz-executor.4'. 17:09:14 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:14 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000000b06010200000000000000000000000020000780060004400000000006000500000000000c00018008000140000000000900020073797a300000000005000100070000007f4bb977b6311d76298b34c215ea6189ae9bd938fc3eb831357ccdb1f4ae755bd269b9d1d20d05b2bfaa75b78e2850735ee66301dbeeaa00fcba93ef5d469dcd6acb5ad158291eaddedca897c06c7d5a846dbc087cffb328043adc"], 0x48}}, 0x0) 17:09:14 executing program 3: r0 = socket$inet6(0xa, 0x100000003, 0x2c) sendto$inet6(r0, &(0x7f0000000100)="ff0057af214d56d0bf", 0x9, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast1}, 0x1c) 17:09:14 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:14 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, @NFT_OBJECT_QUOTA=@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x801, 0x0, 0x0, {}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x80}}, 0x84c0) 17:09:14 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x0, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:14 executing program 3: r0 = socket$inet(0x15, 0x5, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x3c, &(0x7f0000000000), 0x4) 17:09:15 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x0) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:15 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:15 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)={0x58, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x6, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x58}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, 0x13, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x50}, 0x20000004) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000003300010000000000000000000000000a50000000090ac9df000000000000000000000000080005400000002a"], 0x1}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001900ff030000000263300a410a009900000000061a0000591f00098018"], 0x1}}, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 17:09:15 executing program 3: r0 = socket$inet(0x15, 0x5, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x3c, &(0x7f0000000000), 0x4) [ 814.252831][T19779] netlink: 9 bytes leftover after parsing attributes in process `syz-executor.4'. [ 814.326851][T19783] netlink: 9 bytes leftover after parsing attributes in process `syz-executor.4'. 17:09:15 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000000b06010200000000000000000000000020000780060004400000000006000500000000000c00018008000140000000000900020073797a300000000005000100070000007f4bb977b6311d76298b34c215ea6189ae9bd938fc3eb831357ccdb1f4ae755bd269b9d1d20d05b2bfaa75b78e2850735ee66301dbeeaa00fcba93ef5d469dcd6acb5ad158291eaddedca897c06c7d5a846dbc087cffc5e5f918dc"], 0x48}}, 0x0) 17:09:15 executing program 4: sendmsg$NFNL_MSG_COMPAT_GET(0xffffffffffffffff, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000000000)={0x14, 0x3, 0x8, 0x0, 0x0, 0x0, {0x0, 0x0, 0xfffe}}, 0x14}}, 0x0) r0 = socket$nl_netfilter(0xa, 0x2, 0x88) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000080)={&(0x7f0000000000)={0xa, 0x8}, 0xc8c7, &(0x7f0000000040)={0x0}, 0x7e}, 0xe803) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 17:09:15 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:15 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) r1 = socket$inet6(0x11, 0x3, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000), 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="780000000b0601020000000000000000000000040900020073797a31000000001400078006000540ce22000008000840000000443c00078008002e3b000000020e0000000900130073797a3100000000050207002e0000000c001940000000000000003f050001000700"/120], 0x78}, 0x1, 0x0, 0x0, 0x40}, 0x20000801) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000500)={0x800002, {{0xa, 0x4e23, 0xffff, @loopback, 0x291061a2}}, {{0xa, 0x4e24, 0x7, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, 0x108) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0xa, &(0x7f0000000000)=0x2c, 0x4) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r4, &(0x7f0000000140)='\f', 0xfef9, 0xc000, 0x0, 0x0) setsockopt$inet_opts(r4, 0x0, 0x0, &(0x7f0000000440)="60365c4b4d62ea9e76b0b2d55dbb3940b44ae961e2843d82383eaeb84d4533660ad55b64ce264451b9e7b52ad515404fc11b70f03f31ccd7a11ea90a2d02ad99519ddc1fae0fa860727fe89df2b24a0f5e22fbe16f20f7027d66e00eecb0634bd1ffc1819aac61a46c7b659c43ea4aac7e6b10e71cc18396d85628d2ce9a662af3cd5f346b3ce8fc77ea00382e105f3b500d730864e1d09a7e4fb19212d5a11b83c7ebddacaaf3cf647d41078fc195aa1b5f4832a6f136b75626c4252c58ae3d", 0xc0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000040)={@remote, 0x800, 0x0, 0x3}, 0x20) sendto$inet6(r0, &(0x7f0000000200)="9800ee422fd1ccd1d337b6e6d49d039058836f872ca7d17d6eb22a9856a7bb4ce4005b36547f74e7d05998ae7c98775d049bbd46700a6788bcd587a81959aa331bdf6bde20a0272abdcea7a3e544a871ecd23ffaabbc0f4eaaed7b21715fec7baa3278c5d9dd15c4cd15153261e4d9cff62a2d42a4708bd1b259950429023199aa8e65e90cb64b3c3d6a37ec95a506f1e742409df924163d8d28b49082d95f6588d040ccdc8ae00e93edaae117c65f58994eaf70fb719a7336bec34ef99a87295ce0207c38fcb6f39213237bed5a165b9cfebe77f52feae61379282d17a1e21d52f1b1d5ecbc4dd54ed838fcca6c3594c14b03cbacb1fbc8", 0xf8, 0x88d0, 0x0, 0x0) shutdown(r0, 0x2) 17:09:15 executing program 4: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3d0000001d00016b238483d12683554001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) [ 815.116763][T19799] netlink: 49 bytes leftover after parsing attributes in process `syz-executor.4'. 17:09:16 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:16 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x0, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 815.223073][T19801] netlink: 49 bytes leftover after parsing attributes in process `syz-executor.4'. 17:09:16 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x0) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:16 executing program 4: setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000140)=[@window, @timestamp, @timestamp, @mss, @sack_perm], 0x5) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @rand_addr, 0x0, 0x2, [@loopback, @multicast2]}, 0x18) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x40, &(0x7f0000000140)={@initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xc) 17:09:16 executing program 3: setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x33, 0x7ff}, @mss, @window={0x3, 0x9}], 0x3) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x8b0, 0x0, 0x4b6ae4f95a5de35b) 17:09:16 executing program 4: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x44}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, 0x1c) 17:09:16 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:17 executing program 3: r0 = socket$inet6(0xa, 0x802, 0x88) sendto$inet6(r0, 0x0, 0x0, 0x8000008840, &(0x7f0000000000)={0xa, 0x200000000004e23, 0x0, @dev={0xfe, 0x80, [], 0xa}}, 0x1c) sendto$inet6(r0, &(0x7f0000000d40)="dd", 0xff76, 0x0, 0x0, 0x0) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 17:09:17 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000040)={@loopback}, 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x2c4) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x1, 0xc8) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='htcp\x00', 0x31) sendto$inet6(r1, &(0x7f0000000000)='E', 0x11001, 0x0, 0x0, 0x0) recvfrom$inet6(r1, &(0x7f0000000040)=""/89, 0x11001, 0x2, 0x0, 0x0) 17:09:17 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:17 executing program 3: r0 = socket$inet6(0xa, 0x8000000000080001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f00000006c0)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000094440000000000000000000000050000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000005000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000edffffffffffffff00000003000000000000000000000000000000000000000000000000000000eeffffff00000000e2ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000c4d300000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff020000000000000000000000000001000000000800000000000000000000000000000000000000000000edffff3fac0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000001c00000000000000000000490000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000404110061ca7c55a5e42d81d1e234c789375b23d36d0b7bd15e04e813cd723f47ce56dffa04c1f203e51942829b769c021a132a47ccf4ac88c150bfed88c8aa4db6efaf6839814663b22c44fc5c577657253c50de4d1797c8a8195d482f8537d4f9aeaf495c01d5a31348917325b55b4136f49a20b50d881350d03870439d9759097585033743069099a0c14b7ca9b9fdbba4b31e8658d38d801fc074013102247ae529fe94b9529742c76d1825a441f8205c765deabf008b3e6ac5064c0c2ca8030c3ab1bf4400000000f6a2a5de91470a21ed3a29fbe853bf2625e00600d9e32fdac5c79c83d19c110c2cccfc32f7f99ea69994f81d903641120915cdcf49efeed42a2054e0544b5f53f43e4f7ab5b6037071e14229606aa0c3d7b7313232a904dbaedc6bd9fe7a1e54afc699624941b6c58fe24ca2338d97bbae7b60c350e72039f84328e39fdf444997aa080a882a81da917d4739bcbb223be6d19106fa4a239fa48a231a9786875523675a7058bc9135228354b3c161cd1c0d0e38d3e1514182f02f3a3a5273fa134e2756aee14acf52e878855b3c2d10bcc65caa785eb923078eebe9a92a0010fd0d9d4175cac3fa4c2ffa948ef6ace5b105904f91733855793c9e18e122e47a5cbf17b194016d3f938504c682a6e79af70f6028f13657100e36d3158651111409188155a90889521a35f3997b6aa2e120fc6f1d8d38960e3659620e0c6192950e94000000000000000000000000000000003eb09ed9381be96996002d301735aa505e22a9336b362a1a28c3a0f70cc499152a43db91fa9e1569083a5d522702cd13ccba06629a50b3c11482cf9a948bcadbdae6da92f4d1a9b6bbea4b5faa8a9661ee1ccc6ef24efeafa4e233e36dfba0d7cba9be865b767c409cc5d90dfdd6ff9fe276fbf345b8af202eb993eb2548bdd841a4bb28e65b4125da980f6419f80eef639d7b90243b8fb9717755408f551411af115da7cf3e52d99a30bdc09d58cdbb55d997d51a57fb71a77b05ea854cb2675ab5c79359298cc584ddae759b1d48037beda92ca737f1b0c3c30928b31c173d25a7f771c38e64a69a074bd9bc5b0f33a5d27d0be4f7f778c7aabc53a4ef488f802ca4825ed2895a819973504f6bd670d338d3e78ae6c3517dffff78d68ba98ceb030fb5ca90ce1247596a"], 0x310) r1 = socket$inet6(0xa, 0x8000000000080001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) 17:09:17 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x0, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:17 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x0, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:17 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000000)={0x50, 0x9, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @rand_addr="6274c915ba39c80e9cf65d4f091e209f"}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x50}}, 0x0) 17:09:17 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x5a) r1 = socket$inet6(0xa, 0x2, 0x73) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x5a) 17:09:18 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000100)={@remote, r2}, 0x14) 17:09:18 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x0, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:18 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:18 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = socket$inet6(0x10, 0x3, 0x4) sendto$inet6(r1, &(0x7f0000000040)="4c00000012001f15b9409b849ac00a00a5787fff000000000000030038c88cc055c5ac27a6c5b068d0bf46d323456536005ad94a461cdbfee9bdb9b64a9b358451d1ec0cffc8792cd8000000", 0x4c, 0x0, 0x0, 0x0) 17:09:18 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:18 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:18 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:18 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:18 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:18 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x0, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:18 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x13, 0xa, 0x101}, 0x14}}, 0x0) 17:09:18 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:18 executing program 3: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={&(0x7f0000000280), 0xc, &(0x7f00000002c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="cc050000110001fffffffffffff000000700000a1b000000120a01030000000081001a000800020001e80e0073797a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d30000000000000000000000014002b000b0001800000000000000006300000000000000000000000140001006c6f000000000000000000000000000000d00103800800024000000003400003d41083aea3cd251e6cbf9ad76a0cf8d380140001006c6f00000000d80000000000000000001400010662617461647630000000000000000000140001006d6163766c616e31000000000000000008005d1aa381ba8dbc18f9429ead014046488fb9813749bb140001007369743000000000000000000000000014000100766c616e3000000000000000000000001400e52d00000000000031000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176705f31000020000000000000007468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c0003801400010073797a5d74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdce64751a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014800100766972745f776966693000001400000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a0500000000000000000007030000000000000000000240000000030a010300000000000000000200000608000540ffff06fd0400024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954b1f003c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de0000010900010073797a3000000000340100000b0ae22ea8ab9923432100000a00000814000980080001400000000608000140000000020c0010400000000000000001080004400001fa00800000000091fe9f3a1d33c77a36000d407d2dad95d472cd07eba931a59419c5213a5765ba9d36a59ff7fd5a856fde218d44047b3b13bf21162821b46cd9055d5d606a2637efd044ef050000950d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd7349e77c575b6079a6a60af03ad107b1c70a7200130bc99378f983e584f3e0e6205651ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000591a8d4f7bc4df573f13c87ad7ff350efa329ccd9a7e4879ac6d8873e4b8f8a176a100007678061791c1b185ac1a105d887f709b82cef423cf7973ce1c7fb0ad0cab96e4eeb5914b3d1bfdbb75208fdd704eb154bd20f1255c6703a0ecb77b8c8e26c8d1e6b161f063cd8736d630c8f6be57bb1d968457de86fffca6cb6629cfb9962adb19ec5be57cd5c7d9ca36da06717dd8f69d367c88c78cd6fdd5cfd34459cbac48486827e5078208026b14c8aaca20f75b1c08ddf6f541143434ecaa29d01db473ec0b4c4098389278a21b4166e0a719b1c6989059ac5e166be359b32eced162d24e94ddb34f7b3b56e702507ca075aaaf1ffb59a816a5ce52f2f2884500000000000068bdb45d0997eed17375fc350feeff4801e0c8004c719a7ec3307e1e58cf14cb57b2c2835859ce78b19991644e428fb6c6b05462166f0cd23db36889cff536ba5b5ab1b2607944ce2c16c00e14d18b7223e98b5c47438d9928ed8f6a133ed152eee8504fe1e845f551bd67e5a737cfc0e255e606fc0e74bd2edb53dfc5cc6519221bd936857315b129d094e39d0c81e108d526fc9d2b39c383851bbec76a8288484070a137478b2356473865e96614a6d6de321f09fdb37231ac6e1ca436adb1fdf9be9c29089fda89bd625a382efe8baade2ab8be1aa105a411949198f7f2d12cdb9d8caa5fcef3e2349162f37363d21af4ef901832dcc10404aedef5b2f1ae70d00f31897de8fa8e3021e02930657204dfc533b922"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) 17:09:18 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:19 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:19 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:19 executing program 3: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000000040)={{0xa, 0x0, 0x0, @rand_addr="000000000e00"}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x890b, &(0x7f0000000000)={'batadv_slave_0\x00'}) 17:09:19 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:19 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:19 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:19 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:19 executing program 3: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="1400000003efa8c68d000000000000000000000a2000000003070105000000f787060000000000000900010073627a3000000000840000000008"], 0x1}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={{0x14, 0x606}, [@NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_TABLE_HANDLE={0xc}]}, @NFT_MSG_DELRULE={0x14}, @NFT_MSG_NEWRULE={0x3f8, 0x6, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8}]}, @NFTA_RULE_EXPRESSIONS={0x178, 0x4, 0x0, 0x1, [{0x48, 0x1, 0x0, 0x1, [@connlimit={{0xe, 0x1, 'connlimit\x00'}, @val={0x25, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_COUNT={0x8}]}}]}, {0xc4, 0x1, 0x0, 0x1, [@fwd={{0x8, 0x1, 'fwd\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FWD_NFPROTO={0x8}, @NFTA_FWD_SREG_DEV={0x8}, @NFTA_FWD_SREG_ADDR={0x8}]}}, @queue={{0xa, 0x1, 'queue\x00'}, @void}, @payload={{0xc, 0x1, 'payload\x00'}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_SREG={0x8}, @NFTA_PAYLOAD_CSUM_OFFSET={0x8}, @NFTA_PAYLOAD_OFFSET={0x8}, @NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_DREG={0x8}, @NFTA_PAYLOAD_SREG={0x8}, @NFTA_PAYLOAD_CSUM_FLAGS={0x8}, @NFTA_PAYLOAD_BASE={0x8}]}}, @dynset={{0xb, 0x1, 'dynset\x00'}, @val={0x4}}, @redir={{0xa, 0x1, 'redir\x00'}, @void}, @byteorder={{0xe, 0x1, 'byteorder\x00'}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_LEN={0x8}, @NFTA_BYTEORDER_DREG={0x8}]}}]}, {0x68, 0x1, 0x0, 0x1, [@exthdr={{0xb, 0x1, 'exthdr\x00'}, @void}, @exthdr={{0xb, 0x1, 'exthdr\x00'}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8}, @NFTA_EXTHDR_FLAGS={0x8}, @NFTA_EXTHDR_FLAGS={0x8}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_DREG={0x8}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_OP={0x8}]}}]}]}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8}, @NFTA_RULE_COMPAT_FLAGS={0x8}]}, @NFTA_RULE_EXPRESSIONS={0x238, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, [@meta={{0x9, 0x1, 'meta\x00'}, @void}, @notrack={{0xc, 0x1, 'notrack\x00'}, @void}, @range={{0xa, 0x1, 'range\x00'}, @void}, @cmp={{0x8, 0x1, 'cmp\x00'}, @void}, @payload={{0xc, 0x1, 'payload\x00'}, @void}]}, {0x1b4, 0x1, 0x0, 0x1, [@reject={{0xb, 0x1, 'reject\x00'}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_REJECT_ICMP_CODE={0x5}, @NFTA_REJECT_TYPE={0x8}, @NFTA_REJECT_TYPE={0x8}, @NFTA_REJECT_ICMP_CODE={0x5}, @NFTA_REJECT_TYPE={0x8}, @NFTA_REJECT_TYPE={0x8}, @NFTA_REJECT_TYPE={0x8}, @NFTA_REJECT_TYPE={0x8}, @NFTA_REJECT_ICMP_CODE={0x5}, @NFTA_REJECT_TYPE={0x8}]}}, @range={{0xa, 0x1, 'range\x00'}, @void}, @match={{0xa, 0x1, 'match\x00'}, @void}]}, {0x44, 0x1, 0x0, 0x1, [@meta={{0xffffffffffffff6d, 0x1, 'meta\x00'}, @void}, @notrack={{0xc, 0x1, 'notrack\x00'}, @void}, @dup={{0x8, 0x1, 'dup\x00'}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8}, @NFTA_DUP_SREG_DEV={0x8}]}}, @dynset={{0xb, 0x1, 'dynset\x00'}, @void}]}]}, @NFTA_RULE_ID={0x8}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELCHAIN={0xd8, 0x5, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_CHAIN_COUNTERS={0x40, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_PACKETS={0xc}]}, @NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_HOOK={0x7c, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_to_bond\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'ip6erspan0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth0_to_hsr\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'vxcan1\x00'}]}]}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x0, 0x0, 0x0, {}, @NFT_OBJECT_CT_HELPER=@NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}}], {0x14}}, 0x54c}}, 0x0) 17:09:19 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:19 executing program 4: sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:19 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) shutdown(r0, 0x0) 17:09:19 executing program 4: sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:19 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x0) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:20 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:20 executing program 4: sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:20 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:20 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000040)=0x400, 0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000200)=0x2840, 0x4) r1 = socket$inet6(0xa, 0x2, 0x73) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x5a) 17:09:20 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:20 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:20 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:20 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:20 executing program 3: setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x30, 0x7ff}, @window, @sack_perm], 0x3) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x88c, 0x0, 0x4b6ae4f95a5de35b) recvfrom$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 17:09:20 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:20 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000906030000000000000000000000000005000100070000003c00078006000440000000001800018014000240ff0200002000000000000000000000011800148014000240ff0200000000000000000000000000010900020073797a3200000000"], 0x64}}, 0x0) 17:09:21 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:21 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:21 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:21 executing program 3: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="280000003e00010f00008004000000000a00000a1480f3f3000a0000000000000000000000110000c17a6bd6293fbd6cba61ba48c6a281db04a7bb71782ce37d15222f01001a00bfee32b658ba148ffa79505f55873c0af8c92687f41d746e0e501dadff0ca17b8edf908440cd7bfb46841990c53d6d29c98a655fb0f6b66d363925c9f9742df3cfd1e65c30e2757268b5944829273f2a3ed5141c0c1a9f1c2396652186a839e839b88684cb1a7e304ec3d6955a01af493bcc653ba673cba93b31a04f0d4bd90ce1e06c65066b017556f7bbeb0be9cab0fd5f4befe426ad4d83ea7ca69885d4dbd32f01604cfc6d519836ed508c7f843fcd68aa07d9b433ede24860590b0becb68b848bebc1f8881f6a5954f5321e901068040ce50366206b663d02f9fe474483dee63f3bd5093528f82b9ec571dfdda2f9066a4909d0c733d5bf0aa739ffcff98ce3ddc7ad35c8bc09ded338286ee9d7c7297a55677aa934a12e4f851d2252633a9660f1df8929813b89248a4fc097c1176cb8fcae8d58e64b5fd7113b29bab61d103dc0f571a247dc5277b6c5a57569eadfcd42a2b8e2f0d83ed1bee47d9fc93dd4dcc74278d9feb73f49eed7db6722c5c4f957ef3e23e78caf98af8620d1104375302b58f90000000000000000"], 0x28}}, 0x0) 17:09:21 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:22 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:09:22 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, 0x0, 0x0) 17:09:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_DELOBJ={0x34, 0x14, 0xa, 0x201, 0x0, 0x0, {}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x4c084) 17:09:22 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:22 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, 0x0, 0x0) 17:09:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000940)=ANY=[@ANYBLOB="4c0000000906010800000000000000000000000005000100070000002400078008000640000000000c00018008400140e00004010a001100aaaaaaaaaabb00000900020073797a3200000000d8dc58293da09a86dca53ea7f000018b782cf1bcce1108ffeca723f81249d2c3da55b08869d066f6325ae6d18fb4a1b319aaed66ae89d204bd13726039c68dcb0800000000000000884bf110840aec6f6a4382c103a67531955aebc7c4d5221fa1de17fcd66f7c8e3e8edc08946cbb1ce4745af5d2e54680a3b1"], 0x4c}}, 0x0) 17:09:22 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:09:22 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:22 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, 0x0, 0x0) 17:09:22 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:22 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={&(0x7f0000000280)={0x10, 0x7}, 0xc, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a35000000200a01030000000081000400000000000900eefc9cf27a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d300000000000000000000000140021006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c000380140001007379a73773acd479367a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a05000000000000000000070300000000000000000002c0000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de000001090001007379000000f200000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f970933e855b91fe9f3a1d33c77a36000d40140b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a5941918a7d87d0016e450d39aa001718102d0c5213a5765ba44047b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c3743155349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a10000000000000000000000000000000000004304fbbd81b55b1440a882a8965bcb67fc0ed96851fa04c9359d1944bcbc0ff75dd0194fd83009aa589904e7e657f92c47f4808086baf48a3120a52dc67df9e55413c517c1e9a0ab20318cc44b7adda5aa"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:22 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:22 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r7 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x10005, 0x3405000000000000) 17:09:22 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) 17:09:22 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) [ 821.690092][T20040] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 821.727816][T20040] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:22 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) [ 821.762944][T20040] netlink: 'syz-executor.3': attribute type 4 has an invalid length. 17:09:22 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 821.829836][T20040] netlink: 'syz-executor.3': attribute type 33 has an invalid length. [ 821.860891][T20040] netlink: 1220 bytes leftover after parsing attributes in process `syz-executor.3'. [ 821.920208][T20040] net_ratelimit: 875 callbacks suppressed [ 821.920220][T20040] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. 17:09:23 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:23 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) 17:09:23 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 822.155637][T20049] netlink: 'syz-executor.3': attribute type 4 has an invalid length. [ 822.238388][T20049] netlink: 'syz-executor.3': attribute type 33 has an invalid length. [ 822.310131][T20049] netlink: 1220 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:23 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) 17:09:23 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 822.377157][T20049] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 822.516651][T20040] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 822.546504][T20040] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:23 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={&(0x7f0000000280)={0x10, 0x7}, 0xc, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a35000000200a01030000000081000400000000000900eefc9cf27a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d300000000000000000000000140021006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c000380140001007379a73773acd479367a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a05000000000000000000070300000000000000000002c0000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de000001090001007379000000f200000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f970933e855b91fe9f3a1d33c77a36000d40140b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a5941918a7d87d0016e450d39aa001718102d0c5213a5765ba44047b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c3743155349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a10000000000000000000000000000000000004304fbbd81b55b1440a882a8965bcb67fc0ed96851fa04c9359d1944bcbc0ff75dd0194fd83009aa589904e7e657f92c47f4808086baf48a3120a52dc67df9e55413c517c1e9a0ab20318cc44b7adda5aa"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:23 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:23 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:23 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r10 = dup(r9) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:23 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) 17:09:23 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) [ 822.797459][T20086] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 822.852953][T20086] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:23 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:23 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:24 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={&(0x7f0000000280)={0x10, 0x7}, 0xc, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a35000000200a01030000000081000400000000000900eefc9cf27a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d300000000000000000000000140021006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c000380140001007379a73773acd479367a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a05000000000000000000070300000000000000000002c0000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de000001090001007379000000f200000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f970933e855b91fe9f3a1d33c77a36000d40140b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a5941918a7d87d0016e450d39aa001718102d0c5213a5765ba44047b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c3743155349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a10000000000000000000000000000000000004304fbbd81b55b1440a882a8965bcb67fc0ed96851fa04c9359d1944bcbc0ff75dd0194fd83009aa589904e7e657f92c47f4808086baf48a3120a52dc67df9e55413c517c1e9a0ab20318cc44b7adda5aa"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:24 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:24 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x0, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) 17:09:24 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:24 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x0, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) [ 823.264643][T20103] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 823.302501][T20103] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:24 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r10 = dup(r9) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) [ 823.379002][T20103] netlink: 'syz-executor.3': attribute type 4 has an invalid length. [ 823.441429][T20103] netlink: 'syz-executor.3': attribute type 33 has an invalid length. [ 823.499173][T20103] netlink: 1220 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:24 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x0, 0x2, 0x0, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x58}}, 0x0) [ 823.558410][T20103] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. 17:09:24 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x54, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}]}, 0x54}}, 0x0) 17:09:24 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:24 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x54, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}]}, 0x54}}, 0x0) 17:09:25 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:25 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={&(0x7f0000000280)={0x10, 0x7}, 0xc, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a35000000200a01030000000081000400000000000900eefc9cf27a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d300000000000000000000000140021006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c000380140001007379a73773acd479367a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a05000000000000000000070300000000000000000002c0000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de000001090001007379000000f200000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f970933e855b91fe9f3a1d33c77a36000d40140b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a5941918a7d87d0016e450d39aa001718102d0c5213a5765ba44047b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c3743155349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a10000000000000000000000000000000000004304fbbd81b55b1440a882a8965bcb67fc0ed96851fa04c9359d1944bcbc0ff75dd0194fd83009aa589904e7e657f92c47f4808086baf48a3120a52dc67df9e55413c517c1e9a0ab20318cc44b7adda5aa"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:25 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r10 = dup(r9) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:25 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:25 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x54, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}]}, 0x54}}, 0x0) [ 824.241017][T20131] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. [ 824.294503][T20131] netlink: 1220 bytes leftover after parsing attributes in process `syz-executor.3'. [ 824.336074][T20131] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. 17:09:25 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x54, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASTER={0x4}]}, 0x54}}, 0x0) 17:09:25 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={&(0x7f0000000280)={0x10, 0x7}, 0xc, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a35000000200a01030000000081000400000000000900eefc9cf27a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d300000000000000000000000140021006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c000380140001007379a73773acd479367a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a05000000000000000000070300000000000000000002c0000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de000001090001007379000000f200000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f970933e855b91fe9f3a1d33c77a36000d40140b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a5941918a7d87d0016e450d39aa001718102d0c5213a5765ba44047b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c3743155349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a10000000000000000000000000000000000004304fbbd81b55b1440a882a8965bcb67fc0ed96851fa04c9359d1944bcbc0ff75dd0194fd83009aa589904e7e657f92c47f4808086baf48a3120a52dc67df9e55413c517c1e9a0ab20318cc44b7adda5aa"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:25 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x54, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASTER={0x4}]}, 0x54}}, 0x0) 17:09:25 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) [ 824.762504][T20146] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:25 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:25 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) r10 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) [ 824.848566][T20146] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. 17:09:26 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={&(0x7f0000000280)={0x10, 0x7}, 0xc, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a35000000200a01030000000081000400000000000900eefc9cf27a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d300000000000000000000000140021006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c000380140001007379a73773acd479367a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a05000000000000000000070300000000000000000002c0000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de000001090001007379000000f200000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f970933e855b91fe9f3a1d33c77a36000d40140b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a5941918a7d87d0016e450d39aa001718102d0c5213a5765ba44047b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c3743155349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a10000000000000000000000000000000000004304fbbd81b55b1440a882a8965bcb67fc0ed96851fa04c9359d1944bcbc0ff75dd0194fd83009aa589904e7e657f92c47f4808086baf48a3120a52dc67df9e55413c517c1e9a0ab20318cc44b7adda5aa"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:26 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x54, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASTER={0x4}]}, 0x54}}, 0x0) 17:09:26 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:26 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x1c, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x1c}}, 0x0) [ 825.312357][T20163] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. 17:09:26 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={&(0x7f0000000280)={0x10, 0x7}, 0xc, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a35000000200a01030000000081000400000000000900eefc9cf27a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d300000000000000000000000140021006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c000380140001007379a73773acd479367a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a05000000000000000000070300000000000000000002c0000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de000001090001007379000000f200000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f970933e855b91fe9f3a1d33c77a36000d40140b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a5941918a7d87d0016e450d39aa001718102d0c5213a5765ba44047b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c3743155349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a10000000000000000000000000000000000004304fbbd81b55b1440a882a8965bcb67fc0ed96851fa04c9359d1944bcbc0ff75dd0194fd83009aa589904e7e657f92c47f4808086baf48a3120a52dc67df9e55413c517c1e9a0ab20318cc44b7adda5aa"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:26 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x1c, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x1c}}, 0x0) 17:09:26 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:26 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:26 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) r10 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) [ 825.701233][T20175] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. 17:09:26 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x1c, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x1c}}, 0x0) 17:09:26 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, 0x0, 0x0) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:26 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r9) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:26 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={&(0x7f0000000280)={0x10, 0x7}, 0xc, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a35000000200a01030000000081000400000000000900eefc9cf27a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d300000000000000000000000140021006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c000380140001007379a73773acd479367a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a05000000000000000000070300000000000000000002c0000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de000001090001007379000000f200000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f970933e855b91fe9f3a1d33c77a36000d40140b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a5941918a7d87d0016e450d39aa001718102d0c5213a5765ba44047b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c3743155349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a10000000000000000000000000000000000004304fbbd81b55b1440a882a8965bcb67fc0ed96851fa04c9359d1944bcbc0ff75dd0194fd83009aa589904e7e657f92c47f4808086baf48a3120a52dc67df9e55413c517c1e9a0ab20318cc44b7adda5aa"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:27 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x4c, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x4c}}, 0x0) [ 826.018827][T20192] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. 17:09:27 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:27 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={&(0x7f0000000280)={0x10, 0x7}, 0xc, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a35000000200a01030000000081000400000000000900eefc9cf27a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d300000000000000000000000140021006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000000000000000000000001400010062617461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000380140001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c000380140001007379a73773acd479367a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014000100766972745f776966693000000000000014000100766c616e30000000000000000000000008000740000000010900010073797a31000000000c00054000000000000000041c000000020a05000000000000000000070300000000000000000002c0000000030a010300000000000000000200000608000540fffffffd0c00024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000000120a05000000000000000000de000001090001007379000000f200000a00000814000980080001400000000608000140000000020c001040000000000000000108000440000000f970933e855b91fe9f3a1d33c77a36000d40140b9df8e256f3b9ceb8d2a67d2dad95d472cd07eba931a5941918a7d87d0016e450d39aa001718102d0c5213a5765ba44047b3b13bf21162821b46cd9055d5d606a2637efd044ef05000095000d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd752da118a0cfed6c3743155349e77c575b6079a6a60af03ad107b1c7088200130bc99288f983e584f3e0e6222d81ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a10000000000000000000000000000000000004304fbbd81b55b1440a882a8965bcb67fc0ed96851fa04c9359d1944bcbc0ff75dd0194fd83009aa589904e7e657f92c47f4808086baf48a3120a52dc67df9e55413c517c1e9a0ab20318cc44b7adda5aa"], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:27 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x4c, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x4c}}, 0x0) [ 826.404295][T20203] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. 17:09:27 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:27 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) r10 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:27 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:27 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) socket$inet6(0x10, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:27 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x4c, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="c21c062a396c4533d15423b10aa8c370"}, {0x14, 0x4, @local}}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x4c}}, 0x0) [ 826.703159][T20217] validate_nla: 18 callbacks suppressed [ 826.703170][T20217] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 826.766782][T20217] __nla_validate_parse: 9 callbacks suppressed [ 826.766792][T20217] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:27 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, 0x0, 0x0) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:27 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:28 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x2c, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x10, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x2c}}, 0x0) 17:09:28 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:28 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 827.231441][T20232] netlink: 'syz-executor.3': attribute type 3 has an invalid length. 17:09:28 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x2c, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x10, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x2c}}, 0x0) [ 827.290404][T20232] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:28 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:28 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:28 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:28 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x2c, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x10, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x2c}}, 0x0) [ 827.570766][T20246] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 827.629407][T20246] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:28 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000000)='E', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:28 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:29 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, 0x0, 0x0) epoll_wait(r6, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:29 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) [ 827.991966][T20258] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 828.031587][T20258] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'. 17:09:29 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x10005, 0x3405000000000000) 17:09:29 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:29 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) socket$inet6(0x10, 0x3, 0x10) socket$inet6(0x10, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:29 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:29 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:29 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d0001430000001def000c0001"], 0x1}}, 0x0) socket$inet6(0x10, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:29 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x3405000000000000) 17:09:29 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:29 executing program 3: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x28}}, 0x0) socket$inet6(0x10, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:29 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x3405000000000000) 17:09:30 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:30 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:30 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:30 executing program 3: socket$inet6(0x10, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:30 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x3405000000000000) 17:09:30 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:30 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:30 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:30 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, r4, 0x0, 0x0, 0x3405000000000000) 17:09:30 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:30 executing program 3: socket$inet6(0x10, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:30 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, r4, 0x0, 0x0, 0x3405000000000000) 17:09:31 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:31 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:31 executing program 3: socket$inet6(0x10, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:31 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:31 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, r4, 0x0, 0x0, 0x3405000000000000) 17:09:31 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:31 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:31 executing program 3: socket$inet6(0x10, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:31 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:31 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, 0x0, 0x0) 17:09:31 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:31 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, r4, 0x0, 0x10005, 0x0) 17:09:32 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(0xffffffffffffffff, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:32 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:32 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, 0x0, 0x0) 17:09:32 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0xc8}}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:32 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, 0x0, 0x0) 17:09:32 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:32 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9}) r10 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:32 executing program 4: r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:32 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, r4, 0x0, 0x10005, 0x0) 17:09:32 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) 17:09:32 executing program 4: r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:32 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:33 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, 0x0, 0x0, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:33 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) 17:09:33 executing program 4: r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:33 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:33 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) 17:09:33 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x400, 0x70bd29}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x800}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r2, &(0x7f0000000240)=[{}, {}, {}], 0x3, 0x57d) r5 = socket$inet6(0xa, 0x200000000003, 0x87) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r8, 0x1275, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r9 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, 0x0) dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) splice(r2, 0x0, r4, 0x0, 0x10005, 0x0) 17:09:33 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9}) r10 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:33 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:33 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:33 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}}, 0x0) 17:09:33 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:33 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:34 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, 0x0, 0x0, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:34 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}}, 0x0) 17:09:34 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:34 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}}, 0x0) 17:09:34 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x5, 0x0, 0x0, {}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14}}, 0x54}}, 0x0) 17:09:34 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:34 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:34 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:34 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9}) r10 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r10, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r11 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r11, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r12) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:34 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000010000100000000b1710000000000000a64000000060a0104000000eaff000000000000000900010073797a30000000000900020073797a31000000001300048028000180080001006c6f67001c0002802400024076626f786e6574313e0700000043f75bf5e25feeb42525290067fc0640000000003e000180080001006e617400140000001100010000000000000000000000000a"], 0x8c}}, 0x0) 17:09:34 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:34 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:34 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, 0x0, 0x0, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:34 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000001c0)={0x1, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@multicast2, @remote, 0x0, 0x3, [@loopback, @multicast2, @multicast2]}, 0x1c) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f00000001c0)={0x1, {{0x2, 0x0, @multicast2}}}, 0x88) 17:09:34 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:34 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:35 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x4, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:35 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={&(0x7f0000000280), 0xc, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000008100000a1b000000120a01030000000081001a000900020001e8010073797a31000000001c030000160a01020000000000000000050000060c00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d30000000000000000000000014002b000b0001807f7150dcc0420000000000000006300000000000000000000000140001006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f00000000d80000000000000000001400010662617461647630000000000000000000140001006d6163766c616e31000000000000000008005d1aa381ba8dbc18f9429ead014046488fb9813749bb140001007369743000000000000000000000000014000100766c616e3000000000000000000000001400e52d00000000000031000000000000000000140001007866726d30000000000000000000000014000100626f6e645f736c6176705f31000020000000000000007468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c0003801400010073797a5d74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3000009fe91ab9e61aece8f5ed125a000000008ea44dda57e2aeec8bdce64751a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f62726964676500140001007665746830000000000000000000000015000100000000000000000000000000000000005c000380080002408000000108000140000000000800014000000000400003801400010076657468315f746f5f992d4f7465616d00000014800100766972745f776966693000001400000014000100766c616e30000000000000000000000008000740000000010900010073797a310000ff7f0000054000000000000000041c000000020a0500000000000000000007030000000000000000000240000000030a010300000000000000000200000608000540ffff06fd0400024000000000000000013300024000400000000000030c000240000000000000000338000000000a01010000000000000000000000010eb416aca401670900010073797a30000000000900010073797a30000000000900010073797a310000000020000000120a010200000000000000000600000a0c00064000000000000005600000000e0a000000000000000000000000c042d9fa0440000000010900010073797a31000000000900020073797a32b9feb5c45b954bedd43c0e49d24a0000000008000440000000030900020073797a30000096b72eb96f00000900020073797a300000000004000380080004400000000320000a05000000000000000000de0000010900010073797a3000000000340100000b0ae22e80080001400000000608000140000000020c00104000000000000000010800044000010000800000000091fe9f3a1d33c77a36000d407d2dad95d472cd07eba931a5941918a7d87d0016c5213a5765ba633110dbf92d013d5b1d9d36a59ff7fd5a856fde218d44047b3b13bf21162821b46cd9055d5d606a2637efd044ef050000950d406bc37af39acb7ff830f80fd67e1dd1e98be63d176a6ae7038de9622343a3410d42b6762ac4aacdb5a22101d20f3d29279e5e7f0efc0bb63385e4599e2cd7349e77c575b6079a6a60af03ad107b1c70a7200130bc99378f983e584f3e0e6205651ca3a79ff6fc9ebb3ee5bb71e8d72821a6bd9275f29f1d000000ffb53394000000220c000b4000000000000000050900010073797a310000000008000440000000aa1400000011000100000000000000000000590efa329ccd9a7e4879ac6d8873e4b8f8a176a1000076780617912387ecc7bd42c1b185ac1a105d887f709b82cef423cf7973ce1c7fb0ad0cab96e4eeb5914b3d1bfdbb75208fdd704eb154bd20f1255c6703a0ecb77b8c8e26c8d1e6b161f063cd8736d630c8f6be57bb1d968457de86fffca6cb6629cfb9962adb19ec5be57cd5c7d9ca36da06717dd8f69d367c88c78cd6fdd5cfd34459cbac48486827e5078208026b14c8aaca20f75b1c08ddf6f541143434ecaa29d01db473ec0b4c4098389278a21b4166e0a719b1c6989059ac5e166be359b32eced162d24e949db34f7b3b56e702507ca075aaaf00"/1765], 0x5cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) 17:09:35 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:35 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) [ 834.278725][T20483] netlink: 1280 bytes leftover after parsing attributes in process `syz-executor.5'. [ 834.346970][T20483] netlink: 5 bytes leftover after parsing attributes in process `syz-executor.5'. 17:09:35 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:35 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:35 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, 0x4, 0x6, 0x801}, 0x14}}, 0x0) 17:09:35 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, 0x4, 0x6, 0x801}, 0x14}}, 0x0) 17:09:35 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:35 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:35 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:35 executing program 3: socket$inet6(0x10, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, 0x4, 0x6, 0x801}, 0x14}}, 0x0) [ 835.006716][T20483] bridge0: port 1(bridge_slave_0) entered disabled state 17:09:36 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x48, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, {0x8}}, @NFCTH_STATUS={0x8}]}, 0x48}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) [ 835.078412][T20483] netlink: 5 bytes leftover after parsing attributes in process `syz-executor.5'. [ 835.146577][T20483] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 835.175545][T20483] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 17:09:36 executing program 5: 17:09:36 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:36 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x5a) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="7fea0840161f9e66f3a21e3ddb83ff96cab00088d5fcf47858b89b74ff", 0x1d, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x73) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x5a) 17:09:36 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:36 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x48, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, {0x8}}, @NFCTH_STATUS={0x8}]}, 0x48}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:36 executing program 3: 17:09:36 executing program 5: 17:09:36 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:36 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:36 executing program 3: 17:09:36 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x48, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, {0x8}}, @NFCTH_STATUS={0x8}]}, 0x48}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:36 executing program 5: 17:09:37 executing program 3: 17:09:37 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc0, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, {0x8}}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x78, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}]}]}, 0xc0}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:37 executing program 5: 17:09:37 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:37 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:37 executing program 5: 17:09:37 executing program 3: 17:09:37 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:37 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc0, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, {0x8}}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x78, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}]}]}, 0xc0}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:37 executing program 5: 17:09:37 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:37 executing program 3: 17:09:38 executing program 3: 17:09:38 executing program 5: 17:09:38 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc0, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, {0x8}}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x78, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}]}]}, 0xc0}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:38 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, 0x0) ioctl$BLKTRACESTOP(r11, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:38 executing program 3: 17:09:38 executing program 5: 17:09:38 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:38 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:38 executing program 5: 17:09:38 executing program 3: 17:09:38 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:38 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:38 executing program 5: 17:09:38 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x8, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 17:09:39 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0xc8, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_ZONE={0x6}]}]}, 0xc8}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:39 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) 17:09:39 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000380)) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000000)={0x0, 0x2, 0x0, 0x4, 0x4, 0x3, 0xff, 0x80, 0x4, 0x8, 0x9, 0x83, 0x7f}, 0xe) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r3 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={0x0, 0x839}, 0x8) ftruncate(r3, 0x200004) sendfile(r0, r3, 0x0, 0x80001d00c0d0) [ 838.135551][T20600] ================================================================== [ 838.144189][T20600] BUG: KASAN: slab-out-of-bounds in bitmap_ipmac_list+0x635/0x1080 [ 838.152108][T20600] Read of size 8 at addr ffff8880a10672c0 by task syz-executor.3/20600 [ 838.160354][T20600] [ 838.162926][T20600] CPU: 0 PID: 20600 Comm: syz-executor.3 Not tainted 5.5.0-rc7-syzkaller #0 [ 838.171660][T20600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 838.181925][T20600] Call Trace: [ 838.185279][T20600] dump_stack+0x197/0x210 [ 838.189649][T20600] ? bitmap_ipmac_list+0x635/0x1080 [ 838.194928][T20600] print_address_description.constprop.0.cold+0xd4/0x30b [ 838.202663][T20600] ? bitmap_ipmac_list+0x635/0x1080 [ 838.208056][T20600] ? bitmap_ipmac_list+0x635/0x1080 [ 838.213280][T20600] __kasan_report.cold+0x1b/0x41 [ 838.218248][T20600] ? bitmap_ipmac_list+0x635/0x1080 [ 838.223482][T20600] kasan_report+0x12/0x20 [ 838.227952][T20600] check_memory_region+0x134/0x1a0 [ 838.233518][T20600] __kasan_check_read+0x11/0x20 [ 838.238687][T20600] bitmap_ipmac_list+0x635/0x1080 [ 838.243767][T20600] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 838.248962][T20600] ? nla_put+0x110/0x150 [ 838.253264][T20600] ip_set_dump_start+0x96c/0x1ca0 [ 838.258435][T20600] ? ip_set_rename+0x720/0x720 [ 838.263304][T20600] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 838.268998][T20600] ? perf_trace_lock_acquire+0x4a0/0x530 [ 838.274674][T20600] ? __kasan_check_write+0x14/0x20 [ 838.279862][T20600] netlink_dump+0x558/0xfb0 [ 838.284410][T20600] ? __netlink_sendskb+0xc0/0xc0 [ 838.289396][T20600] __netlink_dump_start+0x66a/0x930 [ 838.294639][T20600] ip_set_dump+0x15a/0x1d0 [ 838.299088][T20600] ? call_ad+0x5a0/0x5a0 [ 838.303364][T20600] ? ip_set_rename+0x720/0x720 [ 838.308165][T20600] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 838.314024][T20600] ? call_ad+0x5a0/0x5a0 [ 838.318320][T20600] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 838.323302][T20600] ? nfnetlink_bind+0x2c0/0x2c0 [ 838.328271][T20600] ? find_held_lock+0x35/0x130 17:09:39 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x9c, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, {0x8}}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0x9c}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) [ 838.336144][T20600] ? __local_bh_enable_ip+0x15a/0x270 [ 838.341666][T20600] ? __dev_queue_xmit+0x175c/0x35c0 [ 838.346988][T20600] ? __local_bh_enable_ip+0x15a/0x270 [ 838.352423][T20600] ? lockdep_hardirqs_on+0x421/0x5e0 [ 838.357908][T20600] ? __dev_queue_xmit+0x172e/0x35c0 [ 838.363673][T20600] ? trace_hardirqs_on+0x67/0x240 [ 838.368835][T20600] ? __dev_queue_xmit+0x172e/0x35c0 [ 838.374154][T20600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 838.380444][T20600] ? apparmor_capable+0x497/0x900 [ 838.385503][T20600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 838.391782][T20600] ? __kasan_check_read+0x11/0x20 [ 838.396827][T20600] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 838.402309][T20600] netlink_rcv_skb+0x177/0x450 [ 838.407101][T20600] ? nfnetlink_bind+0x2c0/0x2c0 [ 838.411972][T20600] ? netlink_ack+0xb50/0xb50 [ 838.416579][T20600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 838.422838][T20600] ? ns_capable_common+0x93/0x100 [ 838.428067][T20600] ? ns_capable+0x20/0x30 [ 838.432420][T20600] ? __netlink_ns_capable+0x104/0x140 [ 838.437826][T20600] nfnetlink_rcv+0x1ba/0x460 [ 838.442442][T20600] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 838.448102][T20600] ? netlink_deliver_tap+0x24a/0xbe0 [ 838.453558][T20600] netlink_unicast+0x58c/0x7d0 [ 838.458365][T20600] ? netlink_attachskb+0x870/0x870 [ 838.463502][T20600] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 838.469271][T20600] ? __check_object_size+0x3d/0x437 [ 838.474493][T20600] netlink_sendmsg+0x91c/0xea0 [ 838.479462][T20600] ? netlink_unicast+0x7d0/0x7d0 [ 838.484428][T20600] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 838.490010][T20600] ? apparmor_socket_sendmsg+0x2a/0x30 [ 838.495500][T20600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 838.501787][T20600] ? security_socket_sendmsg+0x8d/0xc0 [ 838.507287][T20600] ? netlink_unicast+0x7d0/0x7d0 [ 838.512240][T20600] sock_sendmsg+0xd7/0x130 [ 838.516687][T20600] ____sys_sendmsg+0x753/0x880 [ 838.521484][T20600] ? kernel_sendmsg+0x50/0x50 [ 838.526187][T20600] ? find_held_lock+0x35/0x130 [ 838.530993][T20600] ___sys_sendmsg+0x100/0x170 [ 838.535721][T20600] ? sendmsg_copy_msghdr+0x70/0x70 [ 838.540868][T20600] ? __kasan_check_read+0x11/0x20 [ 838.545937][T20600] ? __fget+0x37f/0x550 [ 838.550134][T20600] ? ksys_dup3+0x3e0/0x3e0 [ 838.554584][T20600] ? __fget_light+0x1a9/0x230 [ 838.559302][T20600] ? __fdget+0x1b/0x20 [ 838.563391][T20600] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 838.569658][T20600] __sys_sendmsg+0x105/0x1d0 [ 838.574289][T20600] ? __sys_sendmsg_sock+0xc0/0xc0 [ 838.579584][T20600] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 838.585087][T20600] ? do_fast_syscall_32+0xd1/0xe16 [ 838.590245][T20600] ? entry_SYSENTER_compat+0x70/0x7f [ 838.595660][T20600] ? do_fast_syscall_32+0xd1/0xe16 [ 838.600824][T20600] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 838.606316][T20600] do_fast_syscall_32+0x27b/0xe16 [ 838.611369][T20600] entry_SYSENTER_compat+0x70/0x7f [ 838.616555][T20600] RIP: 0023:0xf7f219a9 [ 838.620645][T20600] Code: 00 00 00 89 d3 5b 5e 5f 5d c3 b8 80 96 98 00 eb c4 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 838.640273][T20600] RSP: 002b:00000000f5d1d0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 [ 838.648725][T20600] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000100 [ 838.656718][T20600] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 838.664709][T20600] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 838.672701][T20600] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 838.680695][T20600] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 838.688698][T20600] [ 838.691171][T20600] Allocated by task 19751: [ 838.695607][T20600] save_stack+0x23/0x90 [ 838.699782][T20600] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 838.705538][T20600] kasan_kmalloc+0x9/0x10 [ 838.709889][T20600] __kmalloc+0x163/0x770 [ 838.714167][T20600] ip_set_alloc+0x38/0x5e [ 838.718513][T20600] bitmap_ipmac_create+0x4e8/0xa00 [ 838.723650][T20600] ip_set_create+0x6f1/0x1500 [ 838.728353][T20600] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 838.733303][T20600] netlink_rcv_skb+0x177/0x450 [ 838.738089][T20600] nfnetlink_rcv+0x1ba/0x460 [ 838.742789][T20600] netlink_unicast+0x58c/0x7d0 [ 838.747566][T20600] netlink_sendmsg+0x91c/0xea0 [ 838.752352][T20600] sock_sendmsg+0xd7/0x130 [ 838.756804][T20600] ____sys_sendmsg+0x753/0x880 [ 838.761585][T20600] ___sys_sendmsg+0x100/0x170 [ 838.766577][T20600] __sys_sendmsg+0x105/0x1d0 [ 838.771218][T20600] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 838.776721][T20600] do_fast_syscall_32+0x27b/0xe16 [ 838.781763][T20600] entry_SYSENTER_compat+0x70/0x7f [ 838.786888][T20600] [ 838.789230][T20600] Freed by task 4236: [ 838.793284][T20600] save_stack+0x23/0x90 [ 838.797890][T20600] __kasan_slab_free+0x102/0x150 [ 838.802864][T20600] kasan_slab_free+0xe/0x10 [ 838.807394][T20600] kfree+0x10a/0x2c0 [ 838.811357][T20600] tomoyo_check_open_permission+0x19e/0x3e0 [ 838.817280][T20600] tomoyo_file_open+0xa9/0xd0 [ 838.821972][T20600] security_file_open+0x71/0x300 [ 838.826927][T20600] do_dentry_open+0x37a/0x1380 [ 838.831723][T20600] vfs_open+0xa0/0xd0 [ 838.835720][T20600] path_openat+0x118b/0x3180 [ 838.840337][T20600] do_filp_open+0x1a1/0x280 [ 838.844851][T20600] do_sys_open+0x3fe/0x5d0 [ 838.849720][T20600] __x64_sys_open+0x7e/0xc0 [ 838.854236][T20600] do_syscall_64+0xfa/0x790 [ 838.858849][T20600] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 838.864755][T20600] [ 838.867451][T20600] The buggy address belongs to the object at ffff8880a10672c0 [ 838.867451][T20600] which belongs to the cache kmalloc-32 of size 32 [ 838.881436][T20600] The buggy address is located 0 bytes inside of [ 838.881436][T20600] 32-byte region [ffff8880a10672c0, ffff8880a10672e0) [ 838.894539][T20600] The buggy address belongs to the page: [ 838.900313][T20600] page:ffffea00028419c0 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a1067fc1 [ 838.911361][T20600] raw: 00fffe0000000200 ffffea00029a85c8 ffffea0002699648 ffff8880aa4001c0 [ 838.920060][T20600] raw: ffff8880a1067fc1 ffff8880a1067000 000000010000003f 0000000000000000 [ 838.928845][T20600] page dumped because: kasan: bad access detected [ 838.935275][T20600] [ 838.937751][T20600] Memory state around the buggy address: [ 838.944015][T20600] ffff8880a1067180: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 838.952105][T20600] ffff8880a1067200: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 838.961503][T20600] >ffff8880a1067280: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc [ 838.970453][T20600] ^ 17:09:39 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x9c, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, {0x8}}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0x9c}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) [ 838.976627][T20600] ffff8880a1067300: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 838.990092][T20600] ffff8880a1067380: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 838.998173][T20600] ================================================================== [ 839.006252][T20600] Disabling lock debugging due to kernel taint 17:09:40 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="000428bd7000fddbdf6506000014002000fe8000040000000000000000000000bb08"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}], 0x1, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) dup(0xffffffffffffffff) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:40 executing program 5: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfbffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) creat(0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa10000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3b}], 0x3, 0x0, 0x0, 0x3b2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x0}, 0x20) ioctl$KVM_GET_CPUID2(r1, 0xc008ae91, &(0x7f00000004c0)=ANY=[@ANYBLOB="03000000000000000000000000000000000000caff49330fd37100000000000000000000000000000000000900"]) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) 17:09:40 executing program 4: sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x9c, 0x1, 0x9, 0x0, 0x0, 0x0, {}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, {0x8}}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}]}]}, 0x9c}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)='g', 0x324, 0x4004000, 0x0, 0x185) 17:09:40 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xa925, 0x0, 0x0, 0xffffffffffffffff}) r2 = dup(r1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r6, &(0x7f0000000240)=[{}, {}], 0x2, 0x57d) r9 = socket$inet6(0xa, 0x200000000003, 0x87) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r10) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r6, 0x0, r8, 0x0, 0x10005, 0x3405000000000000) 17:09:40 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000000)=0x7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000000)=0x7) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40010}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8000) sendmsg$L2TP_CMD_SESSION_GET(r3, 0x0, 0x2004c800) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x800, 0x20e8, 0xfffffffa}, 0x4c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) epoll_wait(r5, 0x0, 0x0, 0x57d) r8 = socket$inet6(0xa, 0x200000000003, 0x87) r9 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r9, 0xc0184900, &(0x7f0000000040)={0x0, 0x9, 0x0, 0xffffffffffffffff}) r11 = dup(r10) ioctl$DMA_BUF_IOCTL_SYNC(r11, 0x40086200, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmsg$NFNL_MSG_COMPAT_GET(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0xb, 0x301, 0x0, 0x0, {0xe, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x200008d0) r12 = openat$ion(0xffffffffffffff9c, &(0x7f0000001500)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r12, 0xc0184900, &(0x7f0000000040)={0xa925, 0x9, 0x0, 0xffffffffffffffff}) dup(r13) connect$inet6(r8, &(0x7f00000002c0)={0xa, 0x0, 0x4000000, @mcast2, 0x7}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, &(0x7f00000000c0)={0x20, 0x1, 0x8, 0x6, 0xb77}) splice(r5, 0x0, r7, 0x0, 0x10005, 0x3405000000000000) [ 839.091245][T20600] Kernel panic - not syncing: panic_on_warn set ... [ 839.097907][T20600] CPU: 0 PID: 20600 Comm: syz-executor.3 Tainted: G B 5.5.0-rc7-syzkaller #0 [ 839.107972][T20600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 839.118032][T20600] Call Trace: [ 839.122294][T20600] dump_stack+0x197/0x210 [ 839.126645][T20600] panic+0x2e3/0x75c [ 839.130569][T20600] ? add_taint.cold+0x16/0x16 [ 839.135268][T20600] ? bitmap_ipmac_list+0x635/0x1080 [ 839.140486][T20600] ? preempt_schedule+0x4b/0x60 [ 839.145613][T20600] ? ___preempt_schedule+0x16/0x18 [ 839.150725][T20600] ? trace_hardirqs_on+0x5e/0x240 [ 839.155751][T20600] ? bitmap_ipmac_list+0x635/0x1080 [ 839.160960][T20600] end_report+0x47/0x4f [ 839.165115][T20600] ? bitmap_ipmac_list+0x635/0x1080 [ 839.170307][T20600] __kasan_report.cold+0xe/0x41 [ 839.175146][T20600] ? bitmap_ipmac_list+0x635/0x1080 [ 839.180336][T20600] kasan_report+0x12/0x20 [ 839.184659][T20600] check_memory_region+0x134/0x1a0 [ 839.189752][T20600] __kasan_check_read+0x11/0x20 [ 839.194590][T20600] bitmap_ipmac_list+0x635/0x1080 [ 839.199600][T20600] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 839.204698][T20600] ? nla_put+0x110/0x150 [ 839.210832][T20600] ip_set_dump_start+0x96c/0x1ca0 [ 839.215850][T20600] ? ip_set_rename+0x720/0x720 [ 839.220598][T20600] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 839.226143][T20600] ? perf_trace_lock_acquire+0x4a0/0x530 [ 839.231780][T20600] ? __kasan_check_write+0x14/0x20 [ 839.236961][T20600] netlink_dump+0x558/0xfb0 [ 839.241449][T20600] ? __netlink_sendskb+0xc0/0xc0 [ 839.246386][T20600] __netlink_dump_start+0x66a/0x930 [ 839.251573][T20600] ip_set_dump+0x15a/0x1d0 [ 839.255972][T20600] ? call_ad+0x5a0/0x5a0 [ 839.260202][T20600] ? ip_set_rename+0x720/0x720 [ 839.264947][T20600] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 839.270738][T20600] ? call_ad+0x5a0/0x5a0 [ 839.274976][T20600] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 839.279900][T20600] ? nfnetlink_bind+0x2c0/0x2c0 [ 839.284743][T20600] ? find_held_lock+0x35/0x130 [ 839.289509][T20600] ? __local_bh_enable_ip+0x15a/0x270 [ 839.294899][T20600] ? __dev_queue_xmit+0x175c/0x35c0 [ 839.300369][T20600] ? __local_bh_enable_ip+0x15a/0x270 [ 839.305823][T20600] ? lockdep_hardirqs_on+0x421/0x5e0 [ 839.311123][T20600] ? __dev_queue_xmit+0x172e/0x35c0 [ 839.316316][T20600] ? trace_hardirqs_on+0x67/0x240 [ 839.321378][T20600] ? __dev_queue_xmit+0x172e/0x35c0 [ 839.326754][T20600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 839.332998][T20600] ? apparmor_capable+0x497/0x900 [ 839.338166][T20600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 839.344415][T20600] ? __kasan_check_read+0x11/0x20 [ 839.349438][T20600] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 839.354934][T20600] netlink_rcv_skb+0x177/0x450 [ 839.359705][T20600] ? nfnetlink_bind+0x2c0/0x2c0 [ 839.364551][T20600] ? netlink_ack+0xb50/0xb50 [ 839.369145][T20600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 839.375399][T20600] ? ns_capable_common+0x93/0x100 [ 839.380526][T20600] ? ns_capable+0x20/0x30 [ 839.384857][T20600] ? __netlink_ns_capable+0x104/0x140 [ 839.390227][T20600] nfnetlink_rcv+0x1ba/0x460 [ 839.394809][T20600] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 839.400410][T20600] ? netlink_deliver_tap+0x24a/0xbe0 [ 839.405751][T20600] netlink_unicast+0x58c/0x7d0 [ 839.410534][T20600] ? netlink_attachskb+0x870/0x870 [ 839.415771][T20600] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 839.421500][T20600] ? __check_object_size+0x3d/0x437 [ 839.427946][T20600] netlink_sendmsg+0x91c/0xea0 [ 839.432743][T20600] ? netlink_unicast+0x7d0/0x7d0 [ 839.437688][T20600] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 839.443247][T20600] ? apparmor_socket_sendmsg+0x2a/0x30 [ 839.448761][T20600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 839.455010][T20600] ? security_socket_sendmsg+0x8d/0xc0 [ 839.460482][T20600] ? netlink_unicast+0x7d0/0x7d0 [ 839.465416][T20600] sock_sendmsg+0xd7/0x130 [ 839.469846][T20600] ____sys_sendmsg+0x753/0x880 [ 839.474631][T20600] ? kernel_sendmsg+0x50/0x50 [ 839.479304][T20600] ? find_held_lock+0x35/0x130 [ 839.484085][T20600] ___sys_sendmsg+0x100/0x170 [ 839.488772][T20600] ? sendmsg_copy_msghdr+0x70/0x70 [ 839.493889][T20600] ? __kasan_check_read+0x11/0x20 [ 839.499041][T20600] ? __fget+0x37f/0x550 [ 839.503193][T20600] ? ksys_dup3+0x3e0/0x3e0 [ 839.508149][T20600] ? __fget_light+0x1a9/0x230 [ 839.512961][T20600] ? __fdget+0x1b/0x20 [ 839.517021][T20600] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 839.523293][T20600] __sys_sendmsg+0x105/0x1d0 [ 839.527992][T20600] ? __sys_sendmsg_sock+0xc0/0xc0 [ 839.533046][T20600] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 839.538591][T20600] ? do_fast_syscall_32+0xd1/0xe16 [ 839.544318][T20600] ? entry_SYSENTER_compat+0x70/0x7f [ 839.549689][T20600] ? do_fast_syscall_32+0xd1/0xe16 [ 839.554932][T20600] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 839.560406][T20600] do_fast_syscall_32+0x27b/0xe16 [ 839.565429][T20600] entry_SYSENTER_compat+0x70/0x7f [ 839.570958][T20600] RIP: 0023:0xf7f219a9 [ 839.575037][T20600] Code: 00 00 00 89 d3 5b 5e 5f 5d c3 b8 80 96 98 00 eb c4 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 839.594723][T20600] RSP: 002b:00000000f5d1d0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 [ 839.603141][T20600] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000100 [ 839.611118][T20600] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 839.619096][T20600] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 839.627201][T20600] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 839.635192][T20600] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 839.645146][T20600] Kernel Offset: disabled [ 839.649617][T20600] Rebooting in 86400 seconds..