6e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:13 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(0x0, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:13 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r2, 0x0, 0x0, 0x4) fallocate(r1, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000040)={0xd000000, r2}) [ 933.523767][ T8403] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:13 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:13 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r13 = gettid() r14 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r14, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r13, 0x0, 0x0) r15 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r13, r15, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:13 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:14 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(0x0, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:14 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r2, 0x0, 0x0, 0x4) fallocate(r1, 0x0, 0x0, 0x110001) [ 934.001195][ T8523] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:14 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r13 = gettid() r14 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r14, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r13, 0x0, 0x0) r15 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r13, r15, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:14 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:14 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:15 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r4}) 06:00:15 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r2, 0x0, 0x0, 0x4) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:15 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:15 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:15 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r13 = gettid() r14 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r14, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r13, 0x0, 0x0) r15 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r13, r15, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:15 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:16 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r2, 0x0, 0x0, 0x4) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:16 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:16 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r1, 0x0, 0x0, 0x4) 06:00:16 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, 0x0) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:16 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:16 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r4}) 06:00:16 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:16 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r1, 0x0, 0x0, 0x4) 06:00:16 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, 0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:16 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, 0x0) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 936.653259][ T9578] xt_check_target: 3 callbacks suppressed [ 936.653277][ T9578] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:16 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:17 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:17 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:17 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r1, 0x0, 0x0, 0x4) [ 937.042042][ T9927] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:17 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r4}) 06:00:17 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, 0x0) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 937.104981][ T9932] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:17 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 937.353723][T10105] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:17 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:17 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:17 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:17 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, 0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) [ 937.752921][T10320] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:18 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:18 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(0x0, 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:18 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r1, 0x0, 0x0, 0x110001) [ 938.088590][T10488] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:18 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:18 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x40) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:19 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r4}) 06:00:19 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:19 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(0x0, 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:19 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x1c0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x145082, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:19 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:19 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, 0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) [ 939.428149][T10861] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:19 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x1c0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:19 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 939.673766][T10983] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:19 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:19 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:19 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(0x0, 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:20 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x1c0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:20 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r4}) [ 939.998826][T11311] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:20 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x1c0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:20 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:20 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:20 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x0, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:20 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 940.466647][T11647] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:20 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) 06:00:20 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:20 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:21 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x0, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:21 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:21 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, 0x0, 0x0, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:21 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x110001) 06:00:21 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:21 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:21 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x0, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:21 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:21 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x4) 06:00:21 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x110001) 06:00:22 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, 0x0, 0x0, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 941.907831][T12342] xt_check_target: 3 callbacks suppressed [ 941.907849][T12342] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:22 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:22 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x110001) 06:00:22 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 942.391568][T12564] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:22 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:22 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:22 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, 0x0, 0x0, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:22 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r0, 0x0, 0x0, 0x110001) 06:00:22 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:23 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r0, 0x0, 0x0, 0x110001) [ 943.198461][T12789] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:24 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) creat(&(0x7f0000000140)='./file0\x00', 0x0) 06:00:24 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90), 0x0, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:24 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:24 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r0, 0x0, 0x0, 0x110001) 06:00:24 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:24 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 944.562245][T13028] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:24 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:24 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:24 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:24 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) creat(&(0x7f0000000140)='./file0\x00', 0x0) 06:00:25 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90), 0x0, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 944.828133][T13220] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:25 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:25 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:25 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 945.192093][T13543] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:25 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) creat(&(0x7f0000000140)='./file0\x00', 0x0) 06:00:25 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:25 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:25 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90), 0x0, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 945.505827][T13685] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:25 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:25 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:25 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) 06:00:25 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:26 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:26 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{0x0}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 946.011477][T14100] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:26 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:26 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:26 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getdents64(r3, &(0x7f00000000c0)=""/43, 0x400001ab) 06:00:26 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) [ 946.345743][T14406] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:26 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:26 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{0x0}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:27 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:27 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{0x0}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 947.212061][T14723] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:27 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:27 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bind$bt_hci(r0, &(0x7f0000000040), 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r2+10000000}) 06:00:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) [ 947.815664][T14960] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:28 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) 06:00:28 executing program 3: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:28 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:28 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 948.443506][T15179] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:28 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bind$bt_hci(r0, &(0x7f0000000040), 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r2+10000000}) 06:00:28 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:28 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:28 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 948.996991][T15477] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:29 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:29 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:29 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) 06:00:29 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:29 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:29 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bind$bt_hci(r0, &(0x7f0000000040), 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r2+10000000}) 06:00:29 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:29 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 949.830973][T15838] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:30 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:30 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r15 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r15, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:30 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r0, 0x0, 0x0, 0x110001) 06:00:30 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x0) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 950.362063][T16065] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:30 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r0, 0x0, 0x0, 0x110001) 06:00:30 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) 06:00:30 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r15 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r15, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:30 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:31 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r0, 0x0, 0x0, 0x110001) 06:00:31 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x0) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 950.863416][T16188] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:31 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r15 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r15, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:31 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) 06:00:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:31 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, 0x0, &(0x7f0000000100)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) [ 951.222660][T16314] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:31 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, 0x0) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:31 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, 0x0, &(0x7f0000000100)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:31 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x0) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 951.530589][T16525] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:31 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:31 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) 06:00:31 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, 0x0, &(0x7f0000000100)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:32 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x3) 06:00:32 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:32 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) [ 952.134862][T16661] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:32 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x102000004) 06:00:32 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:32 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, 0x0) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:32 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:32 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x3) [ 952.555164][T16879] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:32 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:32 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, 0xffffffffffffffff) sendfile(r15, r16, 0x0, 0x102000004) 06:00:32 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:33 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, &(0x7f0000000200), 0x4) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x3) 06:00:33 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, 0x0) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:33 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) [ 953.108596][T17005] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:33 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, 0xffffffffffffffff) sendfile(r15, r16, 0x0, 0x102000004) 06:00:33 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) setsockopt$CAN_RAW_JOIN_FILTERS(r0, 0x65, 0x6, &(0x7f0000000200), 0x4) 06:00:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:33 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0xffffffffffffffff, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 953.598300][T17229] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:33 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, 0xffffffffffffffff) sendfile(r15, r16, 0x0, 0x102000004) 06:00:33 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xfff, 0x400000) 06:00:33 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00'}) bind$bt_hci(r0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r2+10000000}) 06:00:33 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:34 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(0xffffffffffffffff, r16, 0x0, 0x102000004) [ 954.073178][T17456] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:34 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0xffffffffffffffff, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:34 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 06:00:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 954.317335][T17573] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:34 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(0xffffffffffffffff, r16, 0x0, 0x102000004) 06:00:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:34 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x110001) [ 954.778951][T17793] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:35 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00'}) bind$bt_hci(r0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r2+10000000}) 06:00:35 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0xffffffffffffffff, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:35 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) perf_event_open(&(0x7f000001d000)={0x400000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:35 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(0xffffffffffffffff, r16, 0x0, 0x102000004) 06:00:35 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) 06:00:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:35 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) [ 955.180172][T17946] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:35 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:35 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, 0xffffffffffffffff, 0x0, 0x102000004) 06:00:35 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:35 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 955.579460][T18144] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:36 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00'}) bind$bt_hci(r0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r2+10000000}) 06:00:36 executing program 5: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:36 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, 0xffffffffffffffff, 0x0, 0x102000004) 06:00:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:36 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) 06:00:36 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 955.953768][T18359] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:36 executing program 5: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:36 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, 0xffffffffffffffff, 0x0, 0x102000004) 06:00:36 executing program 5: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="2c000000210071010000000000000000020000000000000000000000040001000c0014000865ae22c4cf6865e30649fd964818496f1538640a09b22fb17f564e08515e9b6d9d6c3384ca557eb21efb863c1747e0a82746b1094dda553c9532445011f8908f47e8a841036c01c0eac67731c965eaca9145bc07bb1227767de23199b334c7b6a6850664658e00000003000000000000a93b550c847b2eed20c86c2868e0ce5d02dda57aaf457c833ff158b2c0088afe60bb61574c979d6d8ef05116a800c36aefa473cf92767d6b9aa353c4a0ba419f054c0594ad89bf6b74fa7ceea41bbbcca9fccfb973ccd0792ec5a645a2294e2f9b3d1f1f50999bc69c5ea9a92ce26e008e7f89346e5835afbf945ef847a6629b832af9617812583b477c66c705a29e9ca146ce7d14898ee96e2767bcc3a403e99c", @ANYRES32, @ANYRES32=0x0], 0x2c}}, 0x0) [ 956.315611][T18582] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:36 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:36 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00'}) bind$bt_hci(r0, &(0x7f0000000040), 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r2+10000000}) 06:00:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:36 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:36 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c", 0x7f}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {0x0}], 0x4}}], 0x1, 0x40080) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x65, 0x0, 0x0, 0x0) 06:00:36 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x0) 06:00:36 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(0x0, 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:37 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:37 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:37 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:37 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x0) 06:00:37 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(0x0, 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:38 executing program 4: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, r17) sendfile(r15, r16, 0x0, 0x0) 06:00:38 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(0x0, 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:38 executing program 5: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:38 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00'}) bind$bt_hci(r0, &(0x7f0000000040), 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r2+10000000}) 06:00:38 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:38 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:38 executing program 5: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) [ 957.978951][T19163] xt_check_target: 2 callbacks suppressed [ 957.978968][T19163] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING [ 958.149524][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 958.155971][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 958.162501][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 958.169808][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 958.177195][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 958.183492][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 958.190897][ C0] protocol 88fb is buggy, dev hsr_slave_0 06:00:38 executing program 5: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) [ 958.197077][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 958.233853][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 958.241108][ C1] protocol 88fb is buggy, dev hsr_slave_1 06:00:38 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:38 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:38 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:38 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:38 executing program 4: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0xfffffdaf) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x800000, 0x5}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) chdir(0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000ac0)={0x77359400}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) shutdown(r3, 0x0) dup2(r3, 0xffffffffffffffff) mkdirat(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$loop(&(0x7f0000000640)='/dev/loop#\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000380)='./file0\x00', 0x0, 0x2, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r4) r5 = accept4(0xffffffffffffffff, &(0x7f0000000140)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x0, 0x0) setsockopt$RDS_RECVERR(r5, 0x114, 0x5, &(0x7f00000002c0)=0x1, 0x4) mkdir(&(0x7f0000000240)='./control\x00', 0x0) rmdir(&(0x7f0000000080)='./control\x00') [ 958.481205][T19388] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:39 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00'}) bind$bt_hci(r0, &(0x7f0000000040), 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r2+10000000}) 06:00:39 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r0, 0x0, 0xfffffffffffffdad, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = fcntl$dupfd(r3, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x12022) 06:00:39 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:39 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:39 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 959.019067][T19618] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:39 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:39 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:39 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xd9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000400)=""/245, 0xf5) [ 959.323677][T19734] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:39 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:39 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:40 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, 0x0) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)) 06:00:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:40 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:00:40 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:40 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) [ 960.024990][T19962] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:40 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 06:00:40 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, 0x0) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)) 06:00:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 960.355639][T20085] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:40 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 06:00:40 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, 0x0) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)) [ 960.524746][T20193] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:40 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:40 executing program 5: syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x32, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, &(0x7f0000000040)={0x0, 0x2, [0x0, 0xfffffffb]}) 06:00:40 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:43 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:00:43 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:43 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:43 executing program 5: r0 = open(&(0x7f0000000040)='./file0\x00', 0x10204, 0x0) poll(&(0x7f0000000000)=[{}], 0x1, 0x4a) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x51e, 0x0, 0x0, 0x800e00517) accept$unix(r0, 0x0, 0x0) recvfrom$inet(r1, 0x0, 0x7639fe17, 0x0, 0x0, 0x800e0050e) shutdown(r1, 0x0) 06:00:43 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:43 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) [ 963.073276][T20325] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:43 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:43 executing program 5: r0 = open(&(0x7f0000000040)='./file0\x00', 0x10204, 0x2) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x4a) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x51e, 0x0, 0x0, 0x800e00517) accept$unix(r0, 0x0, 0x0) recvfrom$inet(r1, 0x0, 0x7639fe17, 0x0, 0x0, 0x800e0050e) shutdown(r1, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) shutdown(r3, 0x0) readv(0xffffffffffffffff, &(0x7f0000000580)=[{&(0x7f0000000040)=""/102, 0x66}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6) dup(0xffffffffffffffff) readv(0xffffffffffffffff, &(0x7f0000000580)=[{&(0x7f0000000040)=""/102, 0x66}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6) dup(0xffffffffffffffff) getsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x2, &(0x7f0000000180)={0x0, 0x8, 0xfff, 0x80000000, 0x8, 0xff81}, &(0x7f00000001c0)=0x14) 06:00:43 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:43 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:43 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:43 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, 0x0, 0x0, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) [ 963.394132][T20548] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:46 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:00:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) shutdown(0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000040)=""/138, 0x8a}], 0x1}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xccf3, 0x0, 0x0, 0x800e0053d) shutdown(r1, 0x0) ppoll(&(0x7f0000000000)=[{}, {r0}], 0x2, &(0x7f00000002c0)={0x1000}, &(0x7f0000000300), 0x8) shutdown(r2, 0x0) 06:00:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, 0x0, 0x0, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:46 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:46 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) [ 966.197015][T20779] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, 0x0, 0x0, 0x10000, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:46 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:46 executing program 5: dup2(0xffffffffffffffff, 0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000340)="a48b12f728db4b2b5d2f2fba4fad273b1ea3e46f905080af4cf9f43b1136655aae84d1d2ce90ccb15322e200000000000000960f53691a655eb6989d32772cf2eebb1f6c785d6382fa7776ea267d32109a5633657b52873b9925f15a5b587ec8eaab2abd683c8ff864", 0x69}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:00:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:46 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x0, &(0x7f0000002940)={0x0, r3+10000000}) [ 966.550193][ C1] net_ratelimit: 14 callbacks suppressed [ 966.550202][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 966.562722][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 966.638621][T21004] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:49 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:00:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0x80dc5521, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "a144a2e4a39fd4367ecb814637f036a3"}) 06:00:49 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:49 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:49 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x0, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:49 executing program 5: [ 969.343458][T21133] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING [ 969.349397][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 969.359893][ C1] protocol 88fb is buggy, dev hsr_slave_1 06:00:49 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:49 executing program 5: 06:00:49 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:49 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:49 executing program 5: [ 969.667428][T21252] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:52 executing program 5: 06:00:52 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x0, 0x0) 06:00:52 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:52 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:00:52 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:52 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x0, &(0x7f0000002940)={0x0, r3+10000000}) 06:00:52 executing program 5: [ 972.417927][T21372] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:52 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:52 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:52 executing program 5: [ 972.709233][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 972.715107][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 972.721101][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 972.726897][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 972.731209][T21492] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING [ 972.732785][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 972.750023][ C0] protocol 88fb is buggy, dev hsr_slave_1 06:00:52 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) [ 972.756837][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 972.762853][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 972.789248][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 972.795259][ C1] protocol 88fb is buggy, dev hsr_slave_1 06:00:53 executing program 5: 06:00:53 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 973.005183][T21707] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:55 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x0, 0x0) 06:00:55 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:55 executing program 5: 06:00:55 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)) recvmmsg(r0, &(0x7f00000027c0), 0x0, 0x10000, 0x0) 06:00:55 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:55 executing program 5: [ 975.546189][T21825] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)) recvmmsg(r0, &(0x7f00000027c0), 0x0, 0x10000, 0x0) 06:00:55 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$packet(0x11, 0x2, 0x300) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:55 executing program 5: 06:00:55 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:00:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)) recvmmsg(r0, &(0x7f00000027c0), 0x0, 0x10000, 0x0) 06:00:58 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x0, 0x0) 06:00:58 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:58 executing program 5: 06:00:58 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:00:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, 0x0}) 06:00:58 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 978.626280][T21970] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:58 executing program 5: 06:00:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, 0x0}) 06:00:58 executing program 5: 06:00:59 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:00:59 executing program 5: [ 978.988813][T22090] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:00:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001d80)={'tunl0\x00', 0x0}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, r2}, 0x58) clock_gettime(0x0, &(0x7f0000002900)) recvmmsg(r0, &(0x7f00000027c0), 0x8d, 0x10000, &(0x7f0000002940)={0x0, 0x0}) 06:01:01 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:01:01 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:01 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:01 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:01:01 executing program 5: 06:01:01 executing program 2: [ 981.644646][T22209] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:01 executing program 2: 06:01:01 executing program 5: 06:01:01 executing program 5: 06:01:02 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:02 executing program 2: [ 981.913678][T22331] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:02 executing program 5: 06:01:04 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:01:04 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:01:04 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:04 executing program 2: 06:01:04 executing program 5: 06:01:04 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:04 executing program 2: 06:01:04 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x400445a0, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x0, "f501bb308d87ada10c801f03a2a7eb8071e36dc635a09d97a2b18ff420262e8e"}) [ 984.797008][T22450] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:05 executing program 2: r0 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 06:01:05 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:05 executing program 2: inotify_init1(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) [ 985.083318][T22569] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:05 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 985.338867][T22680] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:07 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:01:07 executing program 5: inotify_init1(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000140)) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) 06:01:07 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:07 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:07 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:01:07 executing program 2: inotify_init1(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) [ 987.862570][T22804] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:08 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:08 executing program 5: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:01:08 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:08 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 988.262044][T23022] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:08 executing program 5: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:01:08 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 988.600209][T23377] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING [ 988.654298][T23377] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:11 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:01:11 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:11 executing program 5: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r16, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:01:11 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:11 executing program 2: inotify_init1(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 06:01:11 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 990.930969][T23459] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:11 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:11 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:11 executing program 5: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, 0xffffffffffffffff) sendfile(r15, r16, 0x0, 0x102000004) 06:01:11 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:01:11 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) [ 991.316893][T23683] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:11 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:14 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:01:14 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:14 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:01:14 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:14 executing program 5: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, 0xffffffffffffffff) sendfile(r15, r16, 0x0, 0x102000004) 06:01:14 executing program 2: inotify_init1(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) [ 994.029231][T23911] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:14 executing program 3: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:14 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 994.286875][T24099] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:14 executing program 3: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:14 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:14 executing program 3: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) [ 994.493566][T24252] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:14 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:01:17 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199159dff5112fbcce9a6981a14a3e260c650b5edacdec6fdb69d5a415918beba0c51a72f0100d9441e2173a65a48530607c748dc7fc4f4b52b07155fcb2aa544534d14dc0acc24d6c010628ab7073496678d306bed51636cabc3de2e36ff47694d24ec89f61c738002fcf0cf3ace8350410df57c2938a70b0c56bb5bf8b6eff51a32ed5abe14bfd774aefac8668051a8dfaca5d2412b6827f4bbea342ffdb88978ebef12a1bd1d979d6ea7c3ecb0ed0ec4ce10816dcd91d6f51245eae70605ec5641f4aca2a2528b05cca3b47d0b38347eb6a14ff6d78558932e", 0xea}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffa0, 0x0, 0x0, 0x0, 0x36}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 06:01:17 executing program 5: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x26d) getpgrp(0x0) getpgid(0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC], 0x6, 0x0) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r7, 0x0, 0x0) gettid() sendmsg$key(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYPTR64], 0x8}}, 0x20004850) r8 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r9 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r10 = dup2(r9, r8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r11 = gettid() r12 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$SG_GET_REQUEST_TABLE(r12, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r11, 0x0, 0x0) r13 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r11, r13, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r5, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r4, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r15, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r15, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r15, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r16 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r17 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r17, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r16, 0x4c00, 0xffffffffffffffff) sendfile(r15, r16, 0x0, 0x102000004) 06:01:17 executing program 3: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:17 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) 06:01:17 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) 06:01:17 executing program 2: inotify_init1(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) [ 997.151503][T24378] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:17 executing program 3: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:17 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) 06:01:17 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x4, 0x590, [0x200001c0, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000a00000000156e727000000000000000000000000000626f6e643000000000000000000000007465616d5f736c6176655f310000000062637366300000000000000000000000ffffffffffffffff007fffff0180c2000000ffffffffffff0000e0000000500100008801000073747000000000000000000000000000000000000000000000000000000000004800000000000000020000000200006e8700ffffffffffffffffffbc00000000000000003b0a000002000900efb5b7059b3fffffffff00004e234e21040071ac0600ff7f382803000500070000080100736e6174000000000000000000000000000000000000000000000000000000001000000000000000d1f9c15dee9e0000ffffffff000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa0f0000feffffff00000000736e6174000000000000000000000001000000000000000000000000000000001000000000000000aaaaaaaaaa1a0000feffffff0000000003000000400000000011746e616d3000000000000000000000006772657461703000000000000000000076657468315f746f5f626f6e64000000626f6e6430000000000000000000000052a1927247eaffff470000006a72dd4b319d0000ff3400000000e8000000500100008801000069703600000000000000000000000000000000000000000000000000000000005000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa000000ff00000000ffffffff00000000ffffffffff000000ffffffff00000000093b14044e204e234e214e24000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c20000010000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000a30000000000000000000000d20000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000001c00000000000000000002000000ffffffff02000000090000004a00000000020000000000000000000000000000000073797a5f74756e000000000000000000626f6e6430000000000000000000000069705f767469300000000000000000009f7f83bddffa0000ffffffffffffffffffffff0000ffffff0000c0000000c00000000801000068656c70657200000000000000000000000000000000000000000000000000002800000000000000010000006674702d32303030300000000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000c3331f141f48b36a6e8a93c4f2796fab65c75e2fdab6f98342ae6b68a6b900000500000002000000e90d69705f76746930000000000000000000627269646765300000000000000000006966623000000000000000000000000076657468345f746f5f626f6e64000000aaaaaaaaaa11ff0200ffffffffffffffffffffff00ffffff0000b0000000b0000000e800000071756f746100000000000000000000000000000000000000000000000000000018000000000000000000000000000000010000000000000007000000000000006165706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000feffffff0000adcc000000"]}, 0x608) [ 997.586095][T24765] x_tables: eb_tables: snat target: used from hooks PREROUTING, but only usable from POSTROUTING 06:01:17 executing program 3: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9f5e713d1719558b50250f365128d55e8bb4121b7d8c5cc75b43f7dfe1b000d6c1fdbbb8e2bcf59689bf02e751b6dd39bd52c4972eeee1710b54c8089c1d341fa962cce5422890cc535ee0ca29bb62a94fb9069b776eba1ea5024a5d277802ffde80658c9646306234201c99d07ad93213127aa8354fe9ef052c7605b2794c6823ef3a28ec05a5", 0x87}, {&(0x7f00000002c0)="a65f47407633823257326013395eb5c0adfb0c5e35a85fd396179d09561dcd268b4158e435fc035b94da70f52c5c0f6d6b705f2b5fb552fc80fb41065f90ea9857883d2a7c89890a2372e7fe48b2369cec091b3121142442a38b28e731f86d894b76ace31410e8ca0650c3f7caf6c801e1647a1eb6c4732e5647073b8e00f4b67d0421ae9c9549e9c15b4d56f24d4d2c8edc896885738dc5fffe2c0a", 0x9c}, {&(0x7f00000004c0)="316779ec9ea92a0a26f650175910efb12df115dd37bc83f004ee3a279a808240440aabe63a182c154a60a7deb315c23f396f2a8e12656589d8df5fbec6b994a7c2e8e4a6457c90d18abf6afddef7bf19320f06b0639b60e8c3e0bc29e09fe06cf948ccf2f65bcb6b154c3d43c9870da7fcff459a26ceb3f00877d98195e5033ae106920f2920cde5c82c04532c6c76319ba50c86948d56ebadea45b953cb16b9446b0c9722649199bb7290c69cf4e2db3c58e63ad2d7a24bcd2984", 0xbb}, {&(0x7f0000000200)="560c46ed778f855ec967133d8f8d60ccb98f706a2ad22f2b642c7c71b697ad919294ea7ed9f71a586613bf6a13e5debbb840b3396e0974c14071ebc5f3bd3084997a31a161d10168218697d1b53faadf06555a20c6be460f8d3a5c12bc2a9fe9d5cd799e636d575336d2777886c738", 0x6f}, {&(0x7f0000000640)="40456ebffec2b88b878877c1333e65e84e70c1536370f0199bf35dec1a8d14d89fa2ca95a61c3d8e8d43a127f375817e1c1a60bc8e9d58b2ac5a0faa0b51aa343402e4e92716052e38fb8e65d496db6b88c62801fdcf1e6df6a4ee483cb38a05843f2d0a1228ff4d4b54c34a848fa0974d3575865fc7a06866562095a242d0422f4a1d85e48a8880d4e35e96", 0x8c}], 0x5}}], 0x1, 0x40080) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:01:17 executing program 5: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r6, 0x0, 0x7, &(0x7f0000000300)='bdev.\'\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r18}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r17, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r19, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r19, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r19, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r20 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r21 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r21, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r20, 0x4c00, r21) sendfile(r19, r20, 0x0, 0x102000004) [ 997.765769][T24459] ------------[ cut here ]------------ [ 997.771286][T24459] kernel BUG at fs/pipe.c:582! 06:01:18 executing program 1: pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() r2 = socket$packet(0x11, 0x0, 0x300) r3 = dup(r2) setsockopt$packet_int(r3, 0x107, 0x10000000000f, &(0x7f0000006ffc)=0x400000000008, 0x26d) getpgrp(0x0) getpgid(0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/null\x00', 0x702451920c718532, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0xfef0) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000001b2512130", @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ceead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306152e474b", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRESDEC=r7], 0x6, 0x0) r8 = socket(0xa, 0x0, 0x8) r9 = syz_open_dev$amidi(0x0, 0x0, 0x70000) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r10 = gettid() waitid(0x83b895581628fca4, r10, &(0x7f0000000040), 0x2, &(0x7f0000000480)) r11 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r12 = syz_open_dev$sndseq(0x0, 0x0, 0x9a0efa2b65aacb27) r13 = dup2(r12, r11) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) r14 = gettid() r15 = syz_open_dev$sg(&(0x7f0000000380)='\a\x00', 0x1, 0x40) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r15, 0x227d, &(0x7f0000000780)) ptrace$setopts(0x4206, r14, 0x0, 0x0) r16 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r14, r16, 0x0, 0xc, &(0x7f0000000180)='/dev/amidi#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000780)='cgroup.subtree_control\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r5, 0x0, 0x4, &(0x7f0000000180)='em1\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r4, 0x0, 0x5, &(0x7f00000000c0)='syz1\x00', r17}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r3, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r1, r0, 0x0, 0x14, &(0x7f0000000180)='&$vboxnet1security!\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000100)='\x00'}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340), 0xc) open(0x0, 0xe279a88a3b20cda9, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xa1}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x807}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r18 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r18, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r18, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r18, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r19 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x2, 0x105084) syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000240)={0x20, 0x0, 0xffffffffffffffff, {0x6a7, 0x0, 0x0, 0xfff}}, 0xffffffffffffffb2) r20 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x1) getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000002c0), 0x0) pwritev(r20, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a3", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r19, 0x4c00, r20) sendfile(r18, r19, 0x0, 0x102000004) [ 997.869361][T24459] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 997.875571][T24459] CPU: 0 PID: 24459 Comm: syz-executor.2 Not tainted 5.4.0-next-20191206-syzkaller #0 [ 997.885113][T24459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 997.895208][T24459] RIP: 0010:pipe_poll+0x37f/0x400 [ 997.900245][T24459] Code: ff 85 db 75 09 e8 71 b2 b5 ff 41 83 ce 08 e8 68 b2 b5 ff 44 89 f0 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 51 b2 b5 ff <0f> 0b e8 2a 55 f3 ff e9 ed fc ff ff e8 20 55 f3 ff e9 b3 fd ff ff [ 997.911211][ T4091] kobject: 'loop1' (000000008c95d2e0): kobject_uevent_env [ 997.919849][T24459] RSP: 0018:ffffc90001b57698 EFLAGS: 00010212 [ 997.919859][T24459] RAX: 0000000000040000 RBX: ffff888093917400 RCX: ffffc9000e1d9000 [ 997.919866][T24459] RDX: 000000000003bc21 RSI: ffffffff81bf42bf RDI: 0000000000000004 [ 997.919872][T24459] RBP: ffffc90001b576d0 R08: ffff88809ae02200 R09: ffff88809ae02a98 [ 997.919887][T24459] R10: fffffbfff1501518 R11: ffffffff8a80a8c7 R12: ffff8880a8386580 [ 997.940244][ T4091] kobject: 'loop1' (000000008c95d2e0): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 997.941616][T24459] R13: 00000000fffffff0 R14: 0000000000000010 R15: 00000000000007e0 [ 997.941628][T24459] FS: 00007fc7c2831700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 997.941642][T24459] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 997.967658][ T4091] kobject: 'loop0' (000000001e7016c2): kobject_uevent_env [ 997.975866][T24459] CR2: 00007f48d6230270 CR3: 00000000a6aaf000 CR4: 00000000001406f0 [ 997.975876][T24459] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 997.975882][T24459] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 997.975887][T24459] Call Trace: [ 997.975908][T24459] ? pipe_unlock+0x80/0x80 [ 997.975928][T24459] do_select+0x922/0x16f0 [ 998.043589][T24459] ? select_estimate_accuracy+0x330/0x330 [ 998.050356][T24459] ? finish_task_switch+0x147/0x750 [ 998.055554][T24459] ? find_held_lock+0x35/0x130 [ 998.060304][T24459] ? poll_freewait+0x260/0x260 [ 998.065056][T24459] ? poll_freewait+0x260/0x260 [ 998.069802][T24459] ? poll_freewait+0x260/0x260 [ 998.074548][T24459] ? poll_freewait+0x260/0x260 [ 998.079291][T24459] ? poll_freewait+0x260/0x260 [ 998.084034][T24459] ? poll_freewait+0x260/0x260 [ 998.088777][T24459] ? poll_freewait+0x260/0x260 [ 998.093524][T24459] ? poll_freewait+0x260/0x260 [ 998.098286][T24459] ? lock_downgrade+0x920/0x920 [ 998.103130][T24459] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 998.109351][T24459] core_sys_select+0x444/0x9e0 [ 998.114098][T24459] ? core_sys_select+0x444/0x9e0 [ 998.119036][T24459] ? do_compat_pselect+0x230/0x230 [ 998.126211][T24459] ? mark_lock+0xc2/0x1220 [ 998.130608][T24459] ? __might_fault+0x12b/0x1e0 [ 998.135368][T24459] ? lockdep_hardirqs_on+0x421/0x5e0 [ 998.140647][T24459] ? retint_kernel+0x2b/0x2b [ 998.145218][T24459] ? trace_hardirqs_on_caller+0x6a/0x240 [ 998.150837][T24459] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 998.156275][T24459] ? __this_cpu_preempt_check+0x35/0x190 [ 998.162028][T24459] ? retint_kernel+0x2b/0x2b [ 998.166614][T24459] ? set_user_sigmask+0x166/0x1e0 [ 998.171624][T24459] ? sigprocmask+0x2b0/0x2b0 [ 998.176199][T24459] do_pselect.constprop.0+0x199/0x1e0 [ 998.181569][T24459] ? kern_select+0x1e0/0x1e0 [ 998.186144][T24459] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 998.191586][T24459] __x64_sys_pselect6+0x1fc/0x2e0 [ 998.196593][T24459] do_syscall_64+0xfa/0x790 [ 998.201097][T24459] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 998.206966][T24459] RIP: 0033:0x45a6f9 [ 998.210843][T24459] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 998.231555][T24459] RSP: 002b:00007fc7c2830c78 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 998.240052][T24459] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045a6f9 [ 998.248003][T24459] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000040 [ 998.255953][T24459] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 998.263905][T24459] R10: 0000000020000140 R11: 0000000000000246 R12: 00007fc7c28316d4 [ 998.271858][T24459] R13: 00000000004c8a54 R14: 00000000004e0088 R15: 00000000ffffffff [ 998.279813][T24459] Modules linked in: [ 998.287491][ T4091] kobject: 'loop0' (000000001e7016c2): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 998.342605][T24459] ---[ end trace 60ccdf7e5668b69c ]--- [ 998.349509][ T4091] kobject: 'loop3' (00000000b7344d6a): kobject_uevent_env [ 998.356806][ T4091] kobject: 'loop3' (00000000b7344d6a): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 998.370011][T24459] RIP: 0010:pipe_poll+0x37f/0x400 [ 998.375248][T24459] Code: ff 85 db 75 09 e8 71 b2 b5 ff 41 83 ce 08 e8 68 b2 b5 ff 44 89 f0 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 51 b2 b5 ff <0f> 0b e8 2a 55 f3 ff e9 ed fc ff ff e8 20 55 f3 ff e9 b3 fd ff ff [ 998.408032][ T4091] kobject: 'loop5' (000000007c6552ec): kobject_uevent_env [ 998.424217][ T4091] kobject: 'loop5' (000000007c6552ec): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 998.439547][T24459] RSP: 0018:ffffc90001b57698 EFLAGS: 00010212 [ 998.447620][T24459] RAX: 0000000000040000 RBX: ffff888093917400 RCX: ffffc9000e1d9000 [ 998.456060][T24459] RDX: 000000000003bc21 RSI: ffffffff81bf42bf RDI: 0000000000000004 [ 998.466094][T24459] RBP: ffffc90001b576d0 R08: ffff88809ae02200 R09: ffff88809ae02a98 [ 998.475368][T24459] R10: fffffbfff1501518 R11: ffffffff8a80a8c7 R12: ffff8880a8386580 [ 998.483479][T24459] R13: 00000000fffffff0 R14: 0000000000000010 R15: 00000000000007e0 [ 998.491546][T24459] FS: 00007fc7c2831700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 998.500599][T24459] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 998.507235][T24459] CR2: 0000000001701e80 CR3: 00000000a6aaf000 CR4: 00000000001406f0 [ 998.528074][T24459] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 998.536190][T24459] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 998.539922][ T4091] kobject: 'loop1' (000000008c95d2e0): kobject_uevent_env [ 998.544302][T24459] Kernel panic - not syncing: Fatal exception [ 998.555664][ T4091] kobject: 'loop1' (000000008c95d2e0): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 998.558523][T24459] Kernel Offset: disabled [ 998.572978][T24459] Rebooting in 86400 seconds..