xdfa, 0x1b81, 0x0, 0x40, 0xfffffffffffffe00, 0x4, 0x6, 0x4, 0x438, 0x9, 0x6, 0x9]}, &(0x7f00000002c0)=0x100)
ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000000)={'macvtap0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="0000000000000000000000000d011fee0000000000000000000000000000000000000000000000000000000003000000"]})
ioctl$sock_ifreq(r0, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00', @ifru_flags})

13:11:24 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x600, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3038.676577][T15759] IPVS: ftp: loaded support on port[0] = 21
[ 3038.710548][T15753] device ipvlan1442 entered promiscuous mode
[ 3038.759817][T15759] lo speed is unknown, defaulting to 1000
[ 3038.771412][T15760] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3038.779867][   T29] audit: type=1800 audit(1596805884.434:2942): pid=15753 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15986 res=0
[ 3038.857516][T15760] device ipvlan1443 entered promiscuous mode
[ 3038.877948][   T29] audit: type=1804 audit(1596805884.514:2943): pid=15753 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1477/cgroup.controllers" dev="sda1" ino=15986 res=1
13:11:24 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d2c2}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3039.132522][T15779] IPVS: ftp: loaded support on port[0] = 21
13:11:24 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x700, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:24 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x224e, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3039.491052][T15761] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3039.628999][T15761] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3039.905528][T15761] IPVS: ftp: loaded support on port[0] = 21
[ 3039.987204][T15794] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3040.006682][T15794] device ipvlan1444 entered promiscuous mode
[ 3040.012789][   T29] audit: type=1800 audit(1596805885.674:2944): pid=15786 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15748 res=0
[ 3040.044459][T15779] lo speed is unknown, defaulting to 1000
[ 3040.069206][T15793] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3040.141068][T15783] IPVS: ftp: loaded support on port[0] = 21
[ 3040.145189][   T29] audit: type=1804 audit(1596805885.784:2945): pid=15786 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1478/cgroup.controllers" dev="sda1" ino=15748 res=1
[ 3040.163222][T15793] device ipvlan1445 entered promiscuous mode
[ 3040.301525][T15796] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[ 3040.324734][T15796] CPU: 1 PID: 15796 Comm: syz-executor.0 Not tainted 5.8.0-syzkaller #0
[ 3040.333213][T15796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3040.343266][T15796] Call Trace:
[ 3040.346561][T15796]  dump_stack+0x18f/0x20d
[ 3040.350896][T15796]  sysfs_warn_dup.cold+0x1c/0x2d
[ 3040.355838][T15796]  sysfs_do_create_link_sd+0x11e/0x140
[ 3040.361308][T15796]  sysfs_create_link+0x5f/0xc0
[ 3040.366069][T15796]  device_add+0x6ff/0x1c40
[ 3040.370488][T15796]  ? devlink_add_symlinks+0x450/0x450
[ 3040.375877][T15796]  ? ieee80211_set_bitrate_flags+0x3d1/0x610
[ 3040.381864][T15796]  wiphy_register+0x1d66/0x2850
[ 3040.386728][T15796]  ? wiphy_unregister+0xc10/0xc10
[ 3040.391775][T15796]  ? generic_xdp_install+0x700/0x700
[ 3040.397070][T15796]  ? ieee80211_init_rate_ctrl_alg+0x121/0x500
[ 3040.403148][T15796]  ieee80211_register_hw+0x22c9/0x39a0
[ 3040.408790][T15796]  ? ieee80211_restart_hw+0x2f0/0x2f0
[ 3040.414167][T15796]  ? lock_downgrade+0x830/0x830
[ 3040.419018][T15796]  ? lock_is_held_type+0xbb/0xf0
[ 3040.423966][T15796]  ? memset+0x20/0x40
[ 3040.427970][T15796]  ? __hrtimer_init+0x12c/0x260
[ 3040.432838][T15796]  mac80211_hwsim_new_radio+0x2353/0x4540
[ 3040.438572][T15796]  ? hwsim_virtio_rx_work+0x350/0x350
[ 3040.443947][T15796]  ? memcpy+0x39/0x60
[ 3040.447978][T15796]  hwsim_new_radio_nl+0x93e/0xf8c
[ 3040.453784][T15796]  ? mac80211_hwsim_new_radio+0x4540/0x4540
[ 3040.459787][T15796]  ? genl_family_rcv_msg_attrs_parse.isra.0+0x19a/0x250
[ 3040.466718][T15796]  ? genl_family_rcv_msg_attrs_parse.isra.0+0x8d/0x250
[ 3040.473572][T15796]  genl_rcv_msg+0x61d/0x980
[ 3040.478080][T15796]  ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250
[ 3040.485021][T15796]  ? lock_release+0x8e0/0x8e0
[ 3040.489805][T15796]  ? netdev_core_pick_tx+0x2e0/0x2e0
[ 3040.495093][T15796]  netlink_rcv_skb+0x15a/0x430
[ 3040.499852][T15796]  ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250
[ 3040.506787][T15796]  ? netlink_ack+0xa10/0xa10
[ 3040.511389][T15796]  genl_rcv+0x24/0x40
[ 3040.515369][T15796]  netlink_unicast+0x533/0x7d0
[ 3040.520132][T15796]  ? netlink_attachskb+0x810/0x810
[ 3040.525372][T15796]  ? _copy_from_iter_full+0x247/0x890
[ 3040.530739][T15796]  ? __phys_addr+0x9a/0x110
[ 3040.535236][T15796]  ? __phys_addr_symbol+0x2c/0x70
[ 3040.540252][T15796]  ? __check_object_size+0x171/0x3e4
[ 3040.545538][T15796]  netlink_sendmsg+0x856/0xd90
[ 3040.550302][T15796]  ? netlink_unicast+0x7d0/0x7d0
[ 3040.555242][T15796]  ? netlink_unicast+0x7d0/0x7d0
[ 3040.560175][T15796]  sock_sendmsg+0xcf/0x120
[ 3040.564595][T15796]  ____sys_sendmsg+0x6e8/0x810
[ 3040.569361][T15796]  ? kernel_sendmsg+0x50/0x50
[ 3040.574027][T15796]  ? do_recvmmsg+0x6d0/0x6d0
[ 3040.578619][T15796]  ? lockdep_hardirqs_on_prepare+0x530/0x530
[ 3040.584600][T15796]  ? lockdep_hardirqs_on_prepare+0x530/0x530
[ 3040.590569][T15796]  ? __lock_acquire+0xbb5/0x5640
[ 3040.595501][T15796]  ___sys_sendmsg+0xf3/0x170
[ 3040.600178][T15796]  ? sendmsg_copy_msghdr+0x160/0x160
[ 3040.605465][T15796]  ? __fget_files+0x272/0x400
[ 3040.610147][T15796]  ? lock_downgrade+0x830/0x830
[ 3040.614985][T15796]  ? find_held_lock+0x2d/0x110
[ 3040.619739][T15796]  ? __might_fault+0x11f/0x1d0
[ 3040.624507][T15796]  ? __fget_files+0x294/0x400
[ 3040.629181][T15796]  ? __fget_light+0xea/0x280
[ 3040.633772][T15796]  __sys_sendmsg+0xe5/0x1b0
[ 3040.638269][T15796]  ? __sys_sendmsg_sock+0xb0/0xb0
[ 3040.643301][T15796]  ? trace_hardirqs_on+0x5f/0x220
[ 3040.648320][T15796]  ? lockdep_hardirqs_on+0x76/0xf0
[ 3040.653416][T15796]  do_syscall_64+0x2d/0x70
[ 3040.657814][T15796]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 3040.663683][T15796] RIP: 0033:0x45ccd9
[ 3040.667570][T15796] Code: 2d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3040.687180][T15796] RSP: 002b:00007f4b5f36ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 3040.695589][T15796] RAX: ffffffffffffffda RBX: 000000000002bec0 RCX: 000000000045ccd9
[ 3040.703550][T15796] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000008
[ 3040.711511][T15796] RBP: 000000000078c080 R08: 0000000000000000 R09: 0000000000000000
[ 3040.719468][T15796] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078c04c
[ 3040.727429][T15796] R13: 00007fff9775b99f R14: 00007f4b5f36b9c0 R15: 000000000078c04c
[ 3041.264595][T15761] lo speed is unknown, defaulting to 1000
[ 3041.433570][T15807] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[ 3041.447373][T15807] CPU: 1 PID: 15807 Comm: syz-executor.0 Not tainted 5.8.0-syzkaller #0
[ 3041.455722][T15807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3041.465770][T15807] Call Trace:
[ 3041.469066][T15807]  dump_stack+0x18f/0x20d
[ 3041.473412][T15807]  sysfs_warn_dup.cold+0x1c/0x2d
[ 3041.478349][T15807]  sysfs_do_create_link_sd+0x11e/0x140
[ 3041.483811][T15807]  sysfs_create_link+0x5f/0xc0
[ 3041.488579][T15807]  device_add+0x6ff/0x1c40
[ 3041.493001][T15807]  ? devlink_add_symlinks+0x450/0x450
[ 3041.498374][T15807]  ? ieee80211_set_bitrate_flags+0x3d1/0x610
[ 3041.504366][T15807]  wiphy_register+0x1d66/0x2850
[ 3041.509230][T15807]  ? wiphy_unregister+0xc10/0xc10
[ 3041.514251][T15807]  ? generic_xdp_install+0x700/0x700
[ 3041.519554][T15807]  ? ieee80211_init_rate_ctrl_alg+0x121/0x500
[ 3041.525625][T15807]  ieee80211_register_hw+0x22c9/0x39a0
[ 3041.531097][T15807]  ? ieee80211_restart_hw+0x2f0/0x2f0
[ 3041.536471][T15807]  ? lock_downgrade+0x830/0x830
[ 3041.541326][T15807]  ? lock_is_held_type+0xbb/0xf0
[ 3041.546263][T15807]  ? memset+0x20/0x40
[ 3041.550245][T15807]  ? __hrtimer_init+0x12c/0x260
[ 3041.555099][T15807]  mac80211_hwsim_new_radio+0x2353/0x4540
[ 3041.560832][T15807]  ? hwsim_virtio_rx_work+0x350/0x350
[ 3041.566207][T15807]  ? memcpy+0x39/0x60
[ 3041.570191][T15807]  hwsim_new_radio_nl+0x93e/0xf8c
[ 3041.575219][T15807]  ? mac80211_hwsim_new_radio+0x4540/0x4540
[ 3041.581136][T15807]  ? genl_family_rcv_msg_attrs_parse.isra.0+0x19a/0x250
[ 3041.588067][T15807]  ? genl_family_rcv_msg_attrs_parse.isra.0+0x8d/0x250
[ 3041.594916][T15807]  genl_rcv_msg+0x61d/0x980
[ 3041.599425][T15807]  ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250
[ 3041.606367][T15807]  ? lock_release+0x8e0/0x8e0
[ 3041.611038][T15807]  ? netdev_core_pick_tx+0x2e0/0x2e0
[ 3041.616334][T15807]  netlink_rcv_skb+0x15a/0x430
[ 3041.621093][T15807]  ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250
[ 3041.628028][T15807]  ? netlink_ack+0xa10/0xa10
[ 3041.632628][T15807]  genl_rcv+0x24/0x40
[ 3041.636628][T15807]  netlink_unicast+0x533/0x7d0
[ 3041.641392][T15807]  ? netlink_attachskb+0x810/0x810
[ 3041.646501][T15807]  ? _copy_from_iter_full+0x247/0x890
[ 3041.651866][T15807]  ? __phys_addr+0x9a/0x110
[ 3041.656380][T15807]  ? __phys_addr_symbol+0x2c/0x70
[ 3041.661392][T15807]  ? __check_object_size+0x171/0x3e4
[ 3041.666675][T15807]  netlink_sendmsg+0x856/0xd90
[ 3041.671441][T15807]  ? netlink_unicast+0x7d0/0x7d0
[ 3041.676382][T15807]  ? netlink_unicast+0x7d0/0x7d0
[ 3041.681313][T15807]  sock_sendmsg+0xcf/0x120
[ 3041.685725][T15807]  ____sys_sendmsg+0x6e8/0x810
[ 3041.690496][T15807]  ? kernel_sendmsg+0x50/0x50
[ 3041.695164][T15807]  ? do_recvmmsg+0x6d0/0x6d0
[ 3041.699754][T15807]  ? lockdep_hardirqs_on_prepare+0x530/0x530
[ 3041.705749][T15807]  ? lockdep_hardirqs_on_prepare+0x530/0x530
[ 3041.711723][T15807]  ? __lock_acquire+0xbb5/0x5640
[ 3041.716661][T15807]  ___sys_sendmsg+0xf3/0x170
[ 3041.721251][T15807]  ? sendmsg_copy_msghdr+0x160/0x160
[ 3041.726534][T15807]  ? __fget_files+0x272/0x400
[ 3041.731211][T15807]  ? lock_downgrade+0x830/0x830
[ 3041.736052][T15807]  ? find_held_lock+0x2d/0x110
[ 3041.740814][T15807]  ? __might_fault+0x11f/0x1d0
[ 3041.745588][T15807]  ? __fget_files+0x294/0x400
[ 3041.750271][T15807]  ? __fget_light+0xea/0x280
[ 3041.754858][T15807]  __sys_sendmsg+0xe5/0x1b0
[ 3041.759359][T15807]  ? __sys_sendmsg_sock+0xb0/0xb0
[ 3041.764396][T15807]  ? trace_hardirqs_on+0x5f/0x220
[ 3041.769423][T15807]  ? lockdep_hardirqs_on+0x76/0xf0
[ 3041.774537][T15807]  do_syscall_64+0x2d/0x70
[ 3041.778949][T15807]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 3041.784835][T15807] RIP: 0033:0x45ccd9
[ 3041.788726][T15807] Code: 2d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3041.808323][T15807] RSP: 002b:00007f4b5f2e6c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 3041.816729][T15807] RAX: ffffffffffffffda RBX: 000000000002bec0 RCX: 000000000045ccd9
[ 3041.824711][T15807] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000008
[ 3041.832679][T15807] RBP: 000000000078c300 R08: 0000000000000000 R09: 0000000000000000
[ 3041.840641][T15807] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078c2cc
[ 3041.848605][T15807] R13: 00007fff9775b99f R14: 00007f4b5f2e79c0 R15: 000000000078c2cc
13:11:33 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$qrtr(0x2a, 0x2, 0x0)
ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f0000000040))
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="020000009f84bb57964baaaaaaaaaaaa0800450000580000000000119078ac1414bbac1414bb0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb80000000200000000600000000000000000000000800655800000000"], 0x6a)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r3, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r3, 0x0)
r4 = openat$cgroup_ro(r3, &(0x7f0000000080)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0)
r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00')
sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x88, r5, 0x4, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x74, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x16b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3f}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4805}, 0x20000000)

[ 3047.812481][T15884] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3047.849553][T15884] device ipvlan1446 entered promiscuous mode
[ 3047.873867][   T29] audit: type=1800 audit(1596805893.535:2946): pid=15884 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15760 res=0
13:11:33 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x3f00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:33 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xb00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:33 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d2c3}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:11:33 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xf00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3048.013393][   T29] audit: type=1804 audit(1596805893.675:2947): pid=15884 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1479/cgroup.controllers" dev="sda1" ino=15760 res=1
[ 3048.037841][T15896] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3048.189196][T15896] device ipvlan1447 entered promiscuous mode
[ 3056.236987][  T133] tipc: TX() has been purged, node left!
13:11:42 executing program 0:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000180)={{0xc, @multicast2, 0x4e24, 0x0, 'sed\x00', 0x6, 0x81, 0x5a}, {@broadcast, 0x4e20, 0x10000, 0x1, 0x9b, 0x40}}, 0x44)
splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0)
sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r5 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
ioctl$sock_SIOCSIFBR(r5, 0x8941, &(0x7f0000000280)=@add_del={0x2, &(0x7f00000000c0)='tunl0\x00'})
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x40483}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r4}, @IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x1}]}}}]}, 0x40}}, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0xfffffecc)
sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e20, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @empty}}}], 0x20}}], 0x1, 0x0)

13:11:42 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
socket$netlink(0x10, 0x3, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket(0x0, 0x0, 0x0)
getsockopt(0xffffffffffffffff, 0x800000010f, 0x87, 0x0, 0x0)
syz_genetlink_get_family_id$fou(0x0)
sendmsg$FOU_CMD_GET(0xffffffffffffffff, 0x0, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r3, &(0x7f0000000100)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, 0x0, 0x0)
sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000000c0)={0xfffffffffffffffe, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r0], 0x1}, 0x1, 0x0, 0x0, 0x4010}, 0x0)
setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000180)=@req3={0x6, 0x0, 0x0, 0x2, 0x81, 0x80000000}, 0x1c)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r1, r4, 0x0, 0x100000002)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r5, r1, 0x0, 0x100000002)
setsockopt$netrom_NETROM_T4(r1, 0x103, 0x6, &(0x7f0000000040)=0x8, 0x4)

[ 3056.669699][T15935] IPVS: set_ctl: invalid protocol: 12 224.0.0.2:20004
[ 3056.704661][T15935] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3056.712762][T15935] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3056.910709][   T29] audit: type=1804 audit(1596805902.576:2948): pid=15934 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir327749771/syzkaller.if7ufm/1359/cgroup.controllers" dev="sda1" ino=16082 res=1
[ 3056.940604][T15942] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3056.968379][T15942] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3057.588700][   T29] audit: type=1804 audit(1596805903.256:2949): pid=15940 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir327749771/syzkaller.if7ufm/1359/cgroup.controllers" dev="sda1" ino=16082 res=1
[ 3057.665452][   T29] audit: type=1804 audit(1596805903.296:2950): pid=15955 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir327749771/syzkaller.if7ufm/1359/cgroup.controllers" dev="sda1" ino=16082 res=1
13:11:43 executing program 4:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
sendto$inet6(r0, 0x0, 0x0, 0x48820, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @mcast2}, 0x1c)
sendmmsg(r0, &(0x7f0000001a00)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
socket$inet6(0xa, 0xa, 0x101)

13:11:43 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x3f00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:43 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x4000, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:43 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d2c4}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:11:43 executing program 0:
syz_emit_ethernet(0x166, &(0x7f00000000c0)={@link_local, @random="936c86a18c2d", @void, {@ipv4={0x800, @gre={{0x16, 0x4, 0x3, 0x2, 0x158, 0x64, 0x0, 0x3, 0x2f, 0x0, @multicast1, @multicast1, {[@rr={0x7, 0xb, 0xea, [@loopback, @multicast2]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x34, 0x2, [{0x7, 0x11, "b382cac7412e382fb4156c1f293647"}, {0x5, 0x10, "f3d74bc60e0f5ff568d52f98d5a4"}, {0x7, 0x3, '@'}, {0x6, 0xa, "a516dfd4d4dafadf"}]}, @end]}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x1b, 0x3, [], "5d5a7847cf4230ce54a80f1e97f001b2694e1ce8317ba1e006c6d7"}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x800, [], "9cfdddada9329a80c2c0fb88de09dffb669a905e5a48aa289127bb3721f65e1a993b0809826f74b8e50c605d985f5dd36dffc1fbc1c036f2796d30be6a00d57565599319f68f8e79942f1e18a53f6d5eb3717aa1d354c352fb54152bf4"}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [0x5], "7f48f0725405cbf10615c33015ca19f416d5d8b6f99d2f8f3ac8b6ee128966cb405c55c0bb65aea8705a05a2b0be7d6ad3"}, {0x8, 0x88be, 0x4, {{0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x2}, 0x1, {0x6}}}, {0x8, 0x22eb, 0x4, {{0x8, 0x2, 0x7f, 0x3, 0x1, 0x1, 0x5, 0x20}, 0x2, {0x6, 0x40, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x3, "0d860f38d6e26737f6d518c1bb3bf50bf7"}}}}}}, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000280)=[{&(0x7f0000000080)="2e0000002d000511d25a80648c63940d0424fc600400064008251acd4c144d20b40bb243bad40003000200000037153e370a00018004000300d1bd", 0x33fe0}], 0x1, 0x0, 0xffffffffffffffe1}, 0x0)
ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x0, 'veth0\x00', {0x1}, 0x101})

13:11:43 executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x70, 0x0, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20040010}, 0x4000000)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r7 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r7, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r6, &(0x7f00000001c0)=ANY=[@ANYBLOB="020001009f84bb57964baaaaaaaaaa29f95584eb1a0fb066020e22bbaa0800450000580000000000119078ac1414bbac1414bb0420880b00000800000086dd080088be000000001000000001000000000000000c0022eb00000000200000000600"/106], 0x6a)

[ 3058.184162][T15965] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3058.207617][T15965] device ipvlan1448 entered promiscuous mode
13:11:43 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x4e22, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:43 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x4000, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3058.236890][T15969] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3058.266354][   T29] audit: type=1800 audit(1596805903.936:2951): pid=15965 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16197 res=0
[ 3058.313429][T15979] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
13:11:44 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r6 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r6, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r8, r7, 0x0, 0x100000002)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000380)=r7, 0x4)
r9 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r9, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r5, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000", @ANYRES16=r6, @ANYRESHEX=r9], 0x48}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newtfilter={0x48, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x4}}, [@filter_kind_options=@f_rsvp6={{0xa, 0x1, 'rsvp6\x00'}, {0x18, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @ipv4={[], [], @loopback}}]}}]}, 0x48}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001740)=@newtfilter={0x24, 0x29, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0)

[ 3058.394168][   T29] audit: type=1804 audit(1596805904.066:2952): pid=15965 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1480/cgroup.controllers" dev="sda1" ino=16197 res=1
[ 3058.458560][T15994] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3058.467824][T15994] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3058.487308][T15978] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3058.557834][T16001] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
13:11:44 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x5c00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:44 executing program 4:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$alg(0x26, 0x5, 0x0)
vmsplice(r1, &(0x7f0000000080)=[{&(0x7f0000000140)="7f91df129aa36e0632beb3ba74c0d7e08f5a4b30a45e21888868632cd7e31e01212a7e8f5bd1d8e483495eadcc2b9bc91f6bf895c288", 0x36}, {&(0x7f00000002c0)="448924deac776715d226", 0xa}], 0x2, 0x0)
mmap(&(0x7f00004cc000/0x3000)=nil, 0x3000, 0x1, 0x110, r1, 0x0)
bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58)
r3 = accept4(r2, 0x0, 0x0, 0x0)
r4 = accept4$alg(r3, 0x0, 0x0, 0x0)
r5 = socket$netlink(0x10, 0x3, 0x0)
ioctl(r5, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071")
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
connect$rds(r1, &(0x7f0000000180)={0x2, 0x4e20, @local}, 0x10)
epoll_create1(0x80000)
sendfile(r7, r6, 0x0, 0x100000002)
bind$inet6(r6, &(0x7f0000000000)={0xa, 0x4e23, 0x6, @rand_addr=' \x01\x00', 0x1008}, 0x1c)
splice(r0, 0x0, r4, 0x0, 0x9, 0x0)

13:11:44 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x5c00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3058.598968][T16001] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
13:11:44 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x7000, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:44 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x7000, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3058.676616][T15978] device ipvlan1449 entered promiscuous mode
13:11:44 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d2c5}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3058.933978][T15994] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3058.952207][T15994] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
13:11:44 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x7f00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:44 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x7f00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3059.774130][T16033] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3059.783993][   T29] audit: type=1800 audit(1596805905.456:2953): pid=16027 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16194 res=0
[ 3059.805652][T16033] device ipvlan1450 entered promiscuous mode
[ 3059.904159][T16033] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3059.920367][   T29] audit: type=1804 audit(1596805905.586:2954): pid=16027 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1481/cgroup.controllers" dev="sda1" ino=16194 res=1
[ 3059.946750][T16033] device ipvlan1451 entered promiscuous mode
[ 3063.015883][T12672] Bluetooth: hci2: command 0x0406 tx timeout
13:11:50 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
socket$netlink(0x10, 0x3, 0x0)
unshare(0x6c060000)
pipe(&(0x7f0000000280)={<r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
splice(r1, 0x0, r2, 0x0, 0x80000001, 0x0)
r3 = openat$cgroup_ro(r1, &(0x7f0000000000)='memory.stat\x00', 0x0, 0x0)
getpeername$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
r5 = socket$l2tp6(0xa, 0x2, 0x73)
setsockopt$inet6_int(r5, 0x29, 0x18, 0x0, 0x0)
setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000140)=0x8, 0x3)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={<r6=>0x0, 0x3ff}, &(0x7f00000000c0)=0x8)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={r6, @in={{0x2, 0x4e23, @empty}}, 0xff01, 0x6d}, 0x90)
connect$inet(r4, &(0x7f0000000440)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r4, &(0x7f0000007fc0), 0x400000000000695, 0x0)
sendmmsg(r4, &(0x7f0000000540), 0x187, 0x0)

13:11:50 executing program 4:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x6)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="480000009ba3aa924e1f4dc6c45cca91520852c1a7ff0b61ae0788f1b44f26d96172396d39bf5f69ce73aa78d51ca988fd6e89fb570cf4c5743b13dc1af3c07835b3e86ced94ab9e924c2bac08a806deef459e74534b1bfe521c2406cd3fe4f0543485f26d0e59b28c093bb242643faadbfef08ab81df9aeaed4f7451fcc393ffbae4c57fd8f1ca15fd7e99055d3bd670f82f94401eaed69bccee5e1f056af1e3856e16361ac747303dca702bc0014", @ANYRES32=r3, @ANYRESHEX], 0x48}}, 0x444d0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0x14}]}, 0x28}}, 0x0)
ioctl$FS_IOC_GETFSLABEL(r2, 0x81009431, &(0x7f0000000400))
setsockopt$inet6_MRT6_DEL_MFC_PROXY(r2, 0x29, 0xd3, &(0x7f0000000500)={{0xa, 0x4e21, 0x0, @remote, 0x3f}, {0xa, 0x4e24, 0x4, @loopback, 0x3}, 0x20, [0x9, 0x101, 0x401, 0x8, 0x7fffffff, 0x4, 0xfffffffa, 0x8000]}, 0x5c)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x1, 0x803, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x100000002)
getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000600), &(0x7f0000000640)=0x4)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000740)={'sit0\x00', &(0x7f0000000780)={'ip6gre0\x00', 0x0, 0x4, 0x7, 0x1, 0x4, 0x10, @mcast2, @local, 0x20, 0x10, 0xff, 0xcee5}})
getsockname$packet(r4, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="170900000000000000000100000005000700000000000800090000000180000000000000000000000000000000000000000108000a0000000000060002000000000014001f004800000000000000000000000000000006001a0000000000"], 0x64}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=0x0, @ANYRES16=r6], 0x78}, 0x1, 0x0, 0x0, 0x4}, 0x0)

13:11:50 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x80fe, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:50 executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x80000000000000a, 0x2, 0x0)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580)='batadv\x00')
socket$nl_generic(0x10, 0x3, 0x10)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r5, r4, 0x0, 0x100000002)
setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f00000000c0)={0x5, {{0x2, 0x4e24, @multicast1}}}, 0x88)
r6 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000000000000f10000008000300", @ANYRES32], 0x4}}, 0x0)
sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000400)=ANY=[@ANYBLOB="46040000", @ANYRES16=r3, @ANYBLOB="ff830a00000016000a00d8357cb64d12f41672f2d8402dab6cacbed2a6562da0890cd69c353cfe46f39722df46aac12835ee3f42335d4470f1711b03830329e324d95ef925d45a37f859be964cb6585e17d9c3bd3db62581162b69368d5075dfee8652e12f58f0a309faf65017bde56d0223f8e994fcde65c5a49ae2d887ab8071a080fd4cc9e9ee24bb449e1d36772184e4b9a98090a6a8c8316b05d909f3d7b569e55dc1de4c111b4c281a33877b493a3247a6d0b604eb1b645c8c004236de7c56b0289913f075d3446a5ba6a72b3276038185a7b0defdf61e203217ad224bb95dd9796eebc8d96eb1a9ccefa176182db19cc25de470a000f83b6c6e2f0cc00923fe88c1448b06", @ANYRES32=r6], 0x4}}, 0x0)
sendto$rxrpc(r0, &(0x7f0000000200)="302e742e4baadd999f05990e56a43cf0bb79a0042246d2c2f67da4df2d9f490b05162fa7c9636b863251ea112b51845352c118952fbd954cd83b64b7559855639c6ad78f04840af42921c0678c3bdfdbab0044b734e40a27cb214babce62c9429ae88baaa0acb508a199db9e5a63f7e3a21432b59d5a63e69ac3b224dd38c8c7c95ef93bf24f1ed65c86265bd392aa371b4faab94362a665d07d06b98501c810e0f73b012d17408ea4b644ee1342", 0xae, 0x8000, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x24)
sendfile(r2, r1, 0x0, 0x100000002)

13:11:50 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x80fe, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:50 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d2c6}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3064.399606][T16055] netlink: 64 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3064.420032][T16057] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:11:50 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xc0fe, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3064.461366][T16062] netlink: 64 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3064.471760][   T29] audit: type=1804 audit(1596805910.147:2955): pid=16056 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1689/cgroup.controllers" dev="sda1" ino=15786 res=1
13:11:50 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xc0fe, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:50 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, 0x0, 0x45, 0x20000004, &(0x7f0000000280)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c)
r2 = accept$inet6(r1, &(0x7f0000000000), 0x0)
r3 = socket(0x2c, 0x0, 0x7)
sendmsg$can_raw(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=@can={{0x3, 0x1}, 0x1, 0x0, 0x0, 0x0, "6607433133f7bdf0"}, 0x10}, 0x1, 0x0, 0x0, 0x810}, 0x4)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = socket(0x15, 0x5, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x100000002)
setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f00000003c0)=0x5c26, 0x4)
getsockopt(r5, 0x200000000114, 0x5, &(0x7f0000019580)=""/102393, &(0x7f0000000000)=0x18ff9)
getsockopt$inet_sctp_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000340), &(0x7f0000000380)=0xe)
syz_genetlink_get_family_id$devlink(&(0x7f0000000280)='devlink\x00')
sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0)
mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x5, 0x100132, 0xffffffffffffffff, 0x0)
write$binfmt_elf32(r2, &(0x7f00000002c0)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}, [{0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x20, 0x7}]}, 0x58)
sendto$inet6(r0, &(0x7f0000000080)="a1b07002000000ad3008b2d4d8dd009682f696ebf4eefefee678fbca4efb4b130b55647d04147f4957bc764a2d8e13714ce462eb2d4181c4539f9767528b78110655d59d3d77fc91e8c2e1b770b160a467af6a1f8534af79633fda5fca25a32dd7d424c1f8e76a60c2d46d2f848781dde22b4e0f3537df41b67d147460459c58f0eb22b289ec56dd857f9f48a209b28568656080ef13ce153e247e53907ad48dee043f6dee91fc2eef918c406a90c21f11bb51b1baf4bbb34bd14439b96af26d5fc70dc7425cd5cf7e2d3abdd5477859f3e561d7d837b5d7eeeccb6488b054df7a7659eda4c1195263f84d733e48d9407ce611c52a4a9198761a4cc6c9a21ede89e8cf9c5fcbf5ed139646400000000000000070d89a170ea12d401326f676b1cbf84ce19b1c4142710c0d", 0x12b, 0x8000, 0x0, 0x0)

[ 3064.530796][T16057] device ipvlan1452 entered promiscuous mode
[ 3064.580924][   T29] audit: type=1804 audit(1596805910.177:2956): pid=16056 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1689/cgroup.controllers" dev="sda1" ino=15786 res=1
13:11:50 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xfc00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3064.624640][T16063] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3064.645578][T16072] IPVS: ftp: loaded support on port[0] = 21
[ 3064.709335][   T29] audit: type=1800 audit(1596805910.297:2957): pid=16057 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15809 res=0
13:11:50 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xfc00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:50 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xfe80, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3064.838366][T16063] device ipvlan1453 entered promiscuous mode
[ 3064.917420][   T29] audit: type=1804 audit(1596805910.337:2958): pid=16057 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1482/cgroup.controllers" dev="sda1" ino=15809 res=1
[ 3064.970691][T16072] lo speed is unknown, defaulting to 1000
13:11:54 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="020000009f84bb57964baa0000580000000000119078ac1414bbac1414bb0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb00000000200000000600000000000000000000000800655800000000747bc6ea7aaac712bd50ff28b4aeb26297851f545182a66abc337739f251a20aed7b9fe60f53650e3aef94d8037848fbec098e6010bfc5ac7ff58b6967b5762138fdf93fafd6e31f36909dcd8e2892b4daffe28f1777301a17d23a06777565f193ea9fb05b9625aae362ecc66b5ca0e31539b98597870d7f6291b4e53f29f3a5949cb22ac3d9a3e684bdcff543b0a77e4ffc20b2e853dc48dd1ae9bb110000000000000000"], 0x6a)

13:11:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xfe80, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:54 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xfec0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:54 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d2cc}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:11:54 executing program 0:
r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r0, &(0x7f0000000000)={{0x6, @rose}, [@bcast, @null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @null]}, 0x48)
listen(r0, 0x0)
pipe(0x0)
socket$inet6_sctp(0xa, 0x0, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, &(0x7f0000000100))
unshare(0x40000000)
socket(0x0, 0x2, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0x208e24b)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, 0xffffffffffffffff, 0x0, 0x100000002)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x28, &(0x7f0000000080)}, 0x10)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x8010, 0xffffffffffffffff, 0x0)
sendmsg$NLBL_CALIPSO_C_LIST(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0}, 0x0)
recvmmsg(r0, &(0x7f0000000680)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x20}}, {{0x0, 0x0, 0x0}, 0x10001}, {{&(0x7f0000000140)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/20}, {&(0x7f0000000240)=""/6}], 0x0, &(0x7f0000000300)=""/33}, 0x200}, {{&(0x7f0000000340)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @empty}}}, 0x0, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/228}], 0x0, &(0x7f00000005c0)=""/188}, 0x2}], 0x2, 0x40012162, 0x0)
write$binfmt_misc(r0, 0x0, 0x0)

13:11:54 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x40)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
socket$inet6(0xa, 0x0, 0x8)
sendmmsg$alg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0)
ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x0)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r8, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r8, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r8, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f00000000c0)={0x28, 0x1412, 0x400, 0x70bd26, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4000)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x10, 0x0, 0x0, r9}}, 0x20}}, 0x0)

[ 3068.677680][T16137] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3068.717065][T16151] IPVS: ftp: loaded support on port[0] = 21
[ 3068.770408][T16145] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:11:54 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xff00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xfec0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:54 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xffff, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xff00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3068.861265][T16145] device ipvlan1454 entered promiscuous mode
13:11:54 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0xffff, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3069.036694][   T29] audit: type=1800 audit(1596805914.707:2959): pid=16140 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16004 res=0
[ 3069.152198][   T29] audit: type=1804 audit(1596805914.787:2960): pid=16140 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1483/cgroup.controllers" dev="sda1" ino=16004 res=1
[ 3069.722863][T16146] bond2: (slave bridge3): making interface the new active one
[ 3069.737483][T16146] bond2: (slave bridge3): Enslaving as an active interface with an up link
[ 3069.810082][T16145] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3069.855194][T16145] device ipvlan1455 entered promiscuous mode
[ 3069.932150][T16211] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3070.002164][T16172] tipc: TX() has been purged, node left!
13:11:59 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)
r2 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
recvmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000240)=""/173, 0xad}, {&(0x7f0000000040)=""/64, 0x40}], 0x2, &(0x7f0000000140)=""/4, 0x4}, 0x10101)

13:11:59 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x2, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:59 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:11:59 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d2cd}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3073.933829][T16233] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3074.019859][T16238] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3074.032761][T16238] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3074.045165][T16233] device ipvlan1456 entered promiscuous mode
[ 3074.157023][   T29] audit: type=1800 audit(1596805919.827:2961): pid=16233 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15753 res=0
[ 3074.350678][   T29] audit: type=1804 audit(1596805919.977:2962): pid=16233 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1484/cgroup.controllers" dev="sda1" ino=15753 res=1
[ 3074.704730][T16243] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3074.767304][T16243] device ipvlan1457 entered promiscuous mode
[ 3075.681500][T16253] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3075.689607][T16253] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
13:12:02 executing program 0:
mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuset.effective_mems\x00', 0x26e1, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r2, 0x0)
r3 = openat$cgroup_ro(r2, &(0x7f0000000180)='pids.current\x00', 0x7a05, 0x1700)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000740)='cgroup.controllers\x00', 0x275a, 0x0)
ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x80000000})
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0)
write$cgroup_int(r0, &(0x7f0000000140), 0xff4d)
r5 = socket$inet6_mptcp(0xa, 0x1, 0x106)
ioctl$EXT4_IOC_PRECACHE_EXTENTS(r5, 0x6612)
sendfile(r3, r1, 0x0, 0xffffffff800)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000100))
r6 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r6, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
sendfile(r3, r6, &(0x7f0000000040), 0x1)

13:12:02 executing program 4:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xf03b0000)
sendfile(r0, 0xffffffffffffffff, 0x0, 0x800000000000c)
r1 = socket$netlink(0x10, 0x3, 0x30)
write$binfmt_script(r1, &(0x7f0000000840)=ANY=[@ANYBLOB="2321202e2f6669205e2d20656d6f72792ebcaf6c616e317b206d656d6f7279d8ad3b83eb521d078e2372c64b9cd509bf542d6943a89ac7f0a5cd01ffc671f4afd52f9209dfb706a9a6ef38a967c34a000e6aa52f4a78b569fa0600000000000000d5eeeacb5d65f04751f1caca27b2b1f3608cc2d66a18c484aecb57cd50a92e2214ac48a53c09db4ca9722d602042e641c1d511a45053d271df06354ba38683474f457763558cd893e1b22d112c4601c79e1e72bbabf385b3c47cfb0af700000051a400000000000000000000003db85b12618c42624a043ada3377e49c53bee9bdead00ea8681361c18a124419bb93e420e42ed65f78a573a100000000afbdf007f4deea9c76473499025de3b7ee000000b3866fcfe60f7eab31850359000000000000000000000000000000000000091516cf000000000089b9a6490a0da740accfd232ac24f6ca5413870c6fbf3db440ae81a35c0caf0480d2557554cdbabe147ddee3e534aa8e766f18af6469ccb995e9947a4238e3fcd7ba3420a5e923805880e8279041b2acad6d70b50747c0fb0cfa7bca0a8d57338c63193ae2a3fb6ec298675c09e86b4c662d54e5918353501588085bbf3850651c6b314c292b7316004cead8618e858c97e4753b78f7b88e17e2512dc4697a99335bc5c2aa818e9d54633763792950cf24dd797438ee92287f560ec2aec97c05e9965a098bf971e9b77d64a339e5727114f47f3091ce3c73e800566a6daa36ce4118771959ed02f4bf6a46c61ff985c71c6a13c5fd7f23dad7856bb4da75989f09d83d3c0ae41a641dc17e414ca3d6ab96be3bf1d21ef642b63c1fe2c1a2983178543fd45870b488a15f2585a4281b7c316589501361717954e800e81adf113cce3a1cca9d41b0515cd70ca428ba14b04c2fb8cddb842670e22e9fcbcc309270519582e4fc2836b6743df75f4526eb1d786b884d4fe8543548ab64fbbf1954ef082b33295b1bdfe2454b0d6a26e4186ac9e7400fc300000000b29702d69dc32cb7a03e564f216de59909000000000000005935603b880cf0d1c648488002f3228010daa44b875acaf78ee3d5e44152850114290f5cfd009d2e488fd5460debc85bf0575a4d7d4b48a4925303cea668c1f53f2797f7d0c10edd58b2300c534264ddcaaec09aba338cdea161c65fc6a346eef7e0d32dc84a84b0c26bfdb83691b904e62c69a72b83be38c76d22a1dedd7c69aee106db5f03f7e519ceac67a6c0d771838973bb6d05d01b8e3170222aa5f5e3a193de583030ab0cbdb40b37dfbccf6b3393618f3df1331c41b50688f5eb2c7f90af426e3f688886c73249c6"], 0x111)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x141080, 0x0)
write$cgroup_type(r0, &(0x7f0000000100)='threaded\x00', 0x9)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001})
close(r2)
ioctl$TUNGETSNDBUF(0xffffffffffffffff, 0x800454d3, &(0x7f0000000000))
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071")
ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000080)={0x0, 0xfffffffd, 0x2, 0x8308, 0x9})
pwrite64(0xffffffffffffffff, &(0x7f0000000600), 0x0, 0x0)
r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl$PPPIOCSMRRU(0xffffffffffffffff, 0x4004743b, &(0x7f0000000200)=0x7ff)
setsockopt$sock_int(r3, 0x1, 0x3e, &(0x7f00000000c0)=0x7, 0x4)
bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x10)
sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0)
ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0)

13:12:02 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x3, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:02 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x2, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:02 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d325}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:02 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x4, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3076.884369][T16266] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:12:02 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x3, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3076.962689][T16266] device ipvlan1458 entered promiscuous mode
13:12:02 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0xb8, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x4}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20000080}, 0x4080)
sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x581, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x1e, 0x14}}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x50}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000003c0)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x3}}, 0x20}}, 0x0)

[ 3077.098198][   T29] audit: type=1800 audit(1596805922.768:2963): pid=16266 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16207 res=0
[ 3077.155792][T16283] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3077.196710][   T29] audit: type=1804 audit(1596805922.868:2964): pid=16266 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1485/cgroup.controllers" dev="sda1" ino=16207 res=1
[ 3077.210460][T16283] device ipvlan1459 entered promiscuous mode
[ 3077.333467][T16289] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3077.477670][T16293] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3077.510924][T16289] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3077.554449][T16293] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
13:12:04 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x660003, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="020000009f840000964baaaaaaaaaaaa0800450000580000000000119078ac1414bbac1414bb0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb00000000200000000600000000000000000000000800655800000000"], 0x6a)

13:12:04 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x5, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:04 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x4, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:04 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d326}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3079.101596][T16326] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:12:04 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x5, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3079.207383][T16326] device ipvlan1460 entered promiscuous mode
[ 3079.313428][T16340] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3079.331369][   T29] audit: type=1800 audit(1596805924.988:2965): pid=16331 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16232 res=0
[ 3079.415547][T16340] device ipvlan1461 entered promiscuous mode
[ 3081.986623][T16356] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3081.989574][T16355] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3082.015774][T16356] device ipvlan1462 entered promiscuous mode
[ 3082.106710][   T29] audit: type=1800 audit(1596805927.778:2966): pid=16356 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16233 res=0
[ 3082.134472][T16355] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3082.178833][   T29] audit: type=1804 audit(1596805927.828:2967): pid=16370 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1693/cgroup.controllers" dev="sda1" ino=16209 res=1
13:12:07 executing program 4:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_route(0x10, 0x3, 0x0)
splice(r0, 0x0, r2, 0x0, 0x1420000a77, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="1d"], 0x48}}, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x581, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8, 0x1, 'hsr\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_MULTICAST_SPEC={0x5}, @IFLA_HSR_SLAVE1={0x8, 0x1, r8}]}}}]}, 0x40}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0)
write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffffd88)

13:12:07 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x6, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:07 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
ioctl$EXT4_IOC_PRECACHE_EXTENTS(r2, 0x6612)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000040)={<r3=>r0, 0xfffffffffffff28f, 0x0, 0x200})
getpeername$l2tp(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, &(0x7f0000000140)=0x10)
write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="020000009f84bb57964baaaaaaaaaaaa8137ffff0071021400000000ffffffffee8dccbf7d83ffff0001ffffffff9c18410fb40300078c2ff1428eff0ccd7e11e2adc7a93e981111fbd46fe0a772eb0e0cfefc4713a70b7e01d5d7d93a94e4b9d31b1241dca6c0075d2701d79388037e747c84dba8de1535e5c452f0617110b7c9cb71ee1d98d6de2f1ffdae782a99234b2eae957c6073ec0ae91e95b424be6e457ced14eb4aabd5d6ae4e297a08dd26ce710000000032439b246c242defa40ca8cbb126d69d99041411f2af90b989b70dd06d6501e3689f70d40b2086841f0c02bdbde175c3be3c7e3edfbb2168643bbfa0a45d664301d8be20371d6267f4b0d9181d93ee520d1da86612b0133cb875cfef769667f6f3eba0"], 0x83)

13:12:07 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x6, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:07 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d327}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:07 executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r1, r0, 0x0, 0x100000002)
sendmsg$DEVLINK_CMD_SB_POOL_SET(r0, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000240)={0x184, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x8c5}, {0x6, 0x11, 0x2}, {0x8, 0x13, 0x48f}, {0x5, 0x14, 0x1}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x5}, {0x8, 0x13, 0x81}, {0x5, 0x14, 0x1}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0xb, 0x101}, {0x6}, {0x8, 0x13, 0x1}, {0x5}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x400}, {0x8, 0x13, 0x9}, {0x5, 0x14, 0x1}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x1000}, {0x6, 0x11, 0x7b}, {0x8, 0x13, 0x1}, {0x5}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}, {0x6, 0x11, 0x200}, {0x8, 0x13, 0x1}, {0x5}}]}, 0x184}}, 0xc005)
pipe(&(0x7f00000015c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
close(r4)
sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="240000001e0007081dfffd946f610500070000001f00000000000400080009", 0x4c}], 0x1}, 0x0)
write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r5, 0x0)
sendmsg$IPSET_CMD_GET_BYINDEX(r5, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c000000000007200007050001000700000006000b0002000000050001000700"/44], 0x2c}, 0x1, 0x0, 0x0, 0x40001}, 0x0)
socket$netlink(0x10, 0x3, 0x2)
splice(r2, 0x0, r4, 0x0, 0x10003, 0x0)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r7, r6, 0x0, 0x100000002)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f00000001c0)=0x9, 0x4)

13:12:07 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x7, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:07 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x7, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:07 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:07 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3082.251113][   T29] audit: type=1804 audit(1596805927.898:2968): pid=16356 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1487/cgroup.controllers" dev="sda1" ino=16233 res=1
[ 3082.275249][T16368] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
13:12:08 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xf, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3082.394634][T16371] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3082.443009][T16371] device ipvlan1463 entered promiscuous mode
[ 3082.479547][T16373] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
13:12:08 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xf, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3082.975619][   T29] audit: type=1804 audit(1596805928.648:2969): pid=16375 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1693/cgroup.controllers" dev="sda1" ino=16209 res=1
[ 3083.538670][T16405] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
13:12:09 executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000000c0)=0x14)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_virt_wifi\x00', r1})
sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, 0x1, 0x9, 0x3, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8}}]}, 0x20}}, 0x48c8)
getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000240)=""/31, &(0x7f0000000280)=0x1f)
setsockopt$bt_rfcomm_RFCOMM_LM(0xffffffffffffffff, 0x12, 0x3, &(0x7f0000000040)=0x1, 0x4)
sendmsg$NFT_BATCH(r0, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x1c, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_FLAGS={0x8}]}, @NFT_MSG_NEWFLOWTABLE={0x38, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_HOOK={0x4}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}, @NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x10}}, 0xa8}}, 0x4000000)

13:12:09 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x5c, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:12 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
socket$netlink(0x10, 0x3, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getpeername(r2, &(0x7f0000000140)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, &(0x7f0000000040)=0x80)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'veth0_to_bridge\x00', {0x7, 0x4e20, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:12:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x5c, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:12 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d328}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x70, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:12 executing program 0:
unshare(0x40000000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r0 = socket$inet6(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xc8, &(0x7f00000007c0), 0x4)
r1 = socket(0x10, 0x80002, 0x0)
close(r1)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0))
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0)
close(0xffffffffffffffff)
connect$tipc(r1, &(0x7f0000000740)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x4}}, 0x10)
sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="6629e88500b6bc487edb69b46846e18343bdbd4ce806f74f6615b6400fcbbf478953e0f3612c8069a12424832793fb25aee452aa8c9f0ce759f655f3205f57a5663a8846aa2ae565c55989fbca059c23ed915b472fc8ab05f77cb7c5cf96a699f579b14725a46e2406ea41bf1fa205266f2352da48fe9242439768590df27ec1122e1029b81911e8f802edca3297dfc11eb60fdb16b8eb0db0b140e0d58507e31805b24ac82137e1994b3f1af23a9d916ced3ae134468f1c971e9593f8ea4fbd9d84b2e93fe750f5bdfd04e9989c5d33fa86f990d76f54d0f9dcc12e88e419e5e23d81d20d7a0a261f4b59a0702de53d6d3177", 0xf3}], 0x1, &(0x7f0000000800)=[@iv={0x1018, 0x117, 0x2, 0x1000, "a35571e74a2711b180fe4c174d037afe689a278cefcb201ee416f77a5e8d6258633454c4f80d5d7da7c8440ebb5c25483beba46ebcb11dd09366cf54b7a9e7a881d5d8135907c8874c61627d2880975c5805800b17ba984ad52fc565e46fa75c37d9ecbd91f54ad981404e4afc78442b4af9437bdcb45786830c11101a854266b31274ee48f2c71254f1cb7d89df6709b4d4f861196ab0211fd1abaa7b87ac9f53baf1348651e3935ade90bc891995bf7677dca7a543be8b880e72c52bd628009c8b952330b46e564e2ff2434aa1deacb785b3f861b2cefdd0919b0422d8962615a28d1242b1dd6af84f4688ff4073d647ac925c9c7e560d124fd5bbdf811965878b985dcb17046c58e882a8665687b1b5338775a823522ca4fc5e17e162a2e9b6b16237042f89f7e375485f1056c975eeebcb4c06393d386a35839b81ac3a1d09f240a219f09a68430300e78ee654227777a1ed5a79aefcef84814268df4837434190923eae3ed14d295c7ee1e80e44693302146d6ccab74f780f33b964afeaeab3fb5ddaec776b41ea3823fcb60ef141f2bd3786fc81af9cd8c70ee65e54fb204e74a81f319edeb0cf38d5930087635c9c39cd9d3bba2975dd224d79d5019bb6c6def25ee6538a4bd098c6a51e375581052cb947b4db025174ded796f42d7db89fdfa94e55d32d5575f8d58d6983c10c7b67e69c3d7ce3071b3cd8e347703b814da40e14614dedb4ac454f6c26a7bdd4ac91829f8b36a6727f58a5fa419f8643f7761ede013144ab650e8c280a1abcfb9eaa6525ce6220d6a493ff6feb6d8261fc9c7d8ce70ec23f4e4e894ecb755b54ea8c8ce234e3d406d883937f752ef778e85feb146b2a2efa3c9bce46e3ddb0d26ace805e5fcc23e745a4ba0b43407179bdf8fb21cbe972809486ca90dfacebd68e22b80ef7bc0ad1113ff0cde35e90c61905173e4e83ce11ff55ef8f7ebbad00a0598b63b87c730d75341d443b5cbf3c4859cac2e7143b6ac4271ec6bd014b95f942baa7b66dd6975ce0b24be885ea68f6f475ac0ec630f31df167b6fdfee152b000f914fe77f3ff0020735d3908d67cfdafee387fd1d6c197d7c6f17906e6b35ef54a51d3edd5fb277170259527434969cfc2360ee285d565c2a246d8ee560cf7f0d8d1acff01d6476a3165bf31305e88b0ec1703395a6f1d2d9340e2c2b52ff35939fce2f4211215092e0b6731fde7ed4857a4e6a03cbd8981eae90727e42b005e080f6698ce2b59537d31e8cd946135a2d3b0e757b09830a5b411d5b82f5d440afe345f0354a8042f0877cafcb6de17313ba8a960000dd1f8cdd62106d60867075f90ec4a72529241becfd7b5feee9133983aa289c99d6af31606537fc6f23f5cc6368d9f63b479f7e18376a8ebff90561ca61e21afc1d07fdd685ad9c6dd262d7a712dbe6308ba2cd8c60bf91e30c659202ab2dd27c238d5b374e49c6472b5cb4d29f2a947b3e4e4509bf315bdad91505331a55d38a694ed178f5deba94976231776121033f9b43c59977456a6f5eba03e2ea4da5477ce1cf79ae8803eabc66f4d2a93e64076acf611dbb01d4402d3016d9b49d0a9cd57647654b22505a9786fe8e3db8d13bb162e7b2c898d6bdca11f3d0a40ab443439e67b884ca5c8320b9ac7a212072d552c3014a07e571a2bf9c296e5432142a2f78d7dd4ec2651a16aa4136f8c7e67d89165784305197ebf68531bcbbb1b45aeee6188a1ad878869bd1291f707c5710f4124ff5947c4f884eb3a7e92200020f73b4487c030617f79214865146229f2c000c04cc0c7eba0e0e23d6cc9f5fbcf625eaabb5681b8fabf8952bcd9a726eb9cf7561aeed0a4d9adcb7f8e353d2e130bdb03ab0e9d3faab6ef4bf8099e7bf594874639ff1448539f3eebd0253c430351eb1cf3569556a957f6e4b53da598da5597417a30a3befc3b5bb4a7cdfc69a7d74d73e78ae297d1a2f81e5340881fcbd03fc88a0c7cf66e6f783aa6f6c56063797eb975541adf9962cc7af0ea0942818b9e6b4b3bb97d0350e3f8b1cadb6d774b82bf70f76233870d8432be79da643457ab2598e505e90d3eeac248fa10c83cf0597c4f7f6aea447e1e7063826489479f026b92706e41e9bd0b90c2784eb75da1b4f635d41276213d8eea6fde9574a9242743bb52bde74096ab5cf10e756336c4b8ce976ec69ef308e741ce5914684e62a41c79930c80a78cf2228c5e6371c4558f0d5c6d6e9797190a92b61bd4a0e28d03bc8621b6883e3b0d0cf2162a4d3dc51464af93d9da2579ccb95dfde4a04cbe7ec3e2fe50b3866fb0160f681bcd5a132b4bb55ecd0831b207a8dd9a76441c8bbc9e0edba09f4462f34b4ff99ec0c55fbd5757e7f7253fe4938fb1b807f95a17b5d750e9abc1d585030ba895c45eba4fa8950534bbf728c9c0302345b11be32441939b2014a6365a0ff2cd074983328cbc217a4a0b0b9286aed2a523882384521fd5a8d80cd5c6e69d5b7aa32da8bd80857ef4df153773f557d332d4807c0d89d1c996b42c2ca21bff25cfb200d716a0b1a517a8790f88aa3bbfcc7e8cdd3cc82931119d88445d5b5b020d89745a173cc32cbe261a94e9649e841a9323d480067a8e67a331661b82538924d71cf5971dd18b7cb78335025f847221553f1d0d3e866124777f79ba07b7398352f9b403aa683a1a63b64a730fc16df0b68e0669526945398602a7b5fd3195dd1ac88a4ff78e67adac1a4b5634aeeb54ee7493554da6f6566b304bc47ed063b5edfc0b4a4533a82ee53f5419cb69b8494e2d9fb3519122c6a8f3b833847d67fd20ae59f33197291e7eb8e6492e796333552715537254462df740797b0bc154c86a84eb9c020b9529c3b8a63793618e4584e6af335cecd1b9ae5c198757ee099e0d41f8c78f4942c0f9e8b33a274dbd9eaa17342fc2c64a8a1c91874e726c83b9dc47c8cd964479b07c87ccc27bccbe857112bbf919a8569d2d670451f5f460fd684b817635fcaf63791a53a4a96cc267ba4bc519bf608dde3a9ec3ccadbc758196b876e1c60c1ed0ea157281a249859298bb4816a7c7e2cd26e35ed666324ecc5327535cf95fc5b2a71d99c0bf8fe8b1b2bbaa1753b41588633558866340a0027f3bb2596ab1568a304655c591372d619a8e48c9c80916a77e99c6c3c9e27920641b88b2de9d478094b1246a3b2c5b027464cbe5b0d0a604be1dfc483d79c95cd116ed7511c9ab2e251c805e0e9b720dcf63de0252da5b7fd4848e2b3a9e09230ae3a0ffdcf2f10575a685e24888114e4f29251c0823e562d5a01f0e4a1a1bc5e82e4ac1ebe341949528240dfc4411a74200cb1bed6bed51bd514db360d74662b219d03c7f979c35b364dbf9a9c926357de5580b47fe936490a6bc6fa4cf3c7567916266ca6478355749276e076c88f40e73f43f0bf71ebb582e73cedda4570f06f2d284dad38608e8bacdc274ea4ce1ef27a859d687c769e40e391c1449b4bfcda753c8e9de31cd0c9937b80bd661f5429c49f0dfccd5ce09a9005d7ccaba805b4f91f2320223795ec90cd68537d22faf6b85da1c24d6cd833c66219cd00976cafeb4c374187d521e097430f629ceb7d1656c3a1c0820175f70e1ff2f72516009daae2436fb0941be299d5995f3e85851aa97f290feb99af82dda0960af8532fda91d56b43141631abbe94d88ad4d71edfe81bc15321138d50fa330cf500d7c2b2d9dcd268295b10a6389e014ee1ccb49614d2d2950514b92ccec32e7b267347776ade85489be8c4c43e1e4bc626de68c9cc0242d15ee95c7de9799da8a26653bd7418a8484a89a4324f1ef9a9c2ac821c2eceb2c3171b36fec0cc3b6d5e8b52d719ddd5686eb418337b3e288d7b06e0a93c0122977bc6b6ccf65e5758158f8aeb87d10fcfe9cbfe47c2ba3a7025c523ba36638ba14d0495dbc9f7208d403265702c77e3ae1d67eeb1dfd26b18481bc31751607778aa0e1877790d871972b4df383bfd6eb7393505db43573365dd4ecee51a4762d4ca288da85ed673c0e134c73d95c768fd87f4d4c1d981535bcb1fa96c88ece265b36ff81170327c751091f87da749386c1603754566eb2cc415edddf0a30f0a882016a35988fc37f1e1227aee961291f1a55c6f117af34baf901b75e9c93b60b3aec942c6b522bfed8275614d75dac086ea984bdecec94deec32686606f22ff571d665ec90d852c6e1ffdce2f2ff6c83c96624174be5b58ddd0a669a857ce5dce9ea7be740a758b2c54c17006df98b76a1ad13b5933d6c52fe75666ba2f789071bb9f4ee574a0948fe1163450e28400c401cb8042b7e145d54b5f34d005b9e06014bba8d2439116f66434f63853e00e5a957ac7abf2f9baed28d6de93c739ea2c1419df95e12b23ef1de303b7f44d67951c60051e75b739f0f3ec3b8f8b4789a66a5038ab23f34e53f327cf84a8c02e6a3ad5409f548fa509608db84f415909ca6d8bfa736559e241da267b78d2f66ebb1c3c093d3f224b6677664d146dbf128d8b54ef3cb2010e4402bfe607cf247e84c9d074f16b9dbd84b491555969372de1aa67f94601dbbe4ec685e9604d419b18b23e0c87571ec41e3ac483e2f1f28bcd414f8f1037ecc67f51281dc486dd16f9a7537bfc82464ba1facd8b3c19226a0653674f24d2d18f77963b03ead2d7c0eafb6fd19e047e4a572c6332632fa55727df38ca410ef34e94509e364ebdeb124f142cef24107c2e820d54ee224976777a214c37cdfa5a41c07ca3b26674d709d3e8025192501b9b49b431ad3a1b8feeb4a9b24bdf15a6347a23596c58077ee5a70e5912087d9f0b967fb64f20f52048c878535cb99cdb9927ce3fc5e43cb01042ff63574dda98cfbf90a91b85c045db38e399e45803b2e32cab4ea3d2ebc6bc9a726016c8ce155cc953ac1c7ef4a19a31e4b1e1f533d812ce26ad1f0c92a19343f51fbd60312e9fd43c94869c6f47c9bb3f559795839f10a530a5b32a0593f43129b0610a03739c568ac711d6ffe780b5c2fa2a312f4233ce276c1af116d9b954ae9f461dee10c042ae2cab630dc23eee514a38ef1320dc5a54fa825259e7d1ed8a20bd88ac67c12f4aba468e0d1ba9b0f6d2a0f9999b9873438d6bcdcb00e0924b5ca56ba4cf8a2916d36de1ef1548c57336f7d632e49b7c6fe8828fbe2c53e0802a0503b05b8b7fd958396211e7df0a52b72b659984957fcb75fe9300f37ade334fff5fb347c8c20eacd39d2e26ec245ccf0948690e77dd9294510fd337eae798f8a85a0f3da3e708d6de3f2a756d16faab0b4abc1c795fe12330c53f130bd50735414684e8e1735beefc5055ac6c00cfff9312ca137079faa81d5982cdf2d5e74882c6b7cf05981b7dca10e918117f9608ed230b11b79f1670ded10b7e6c5a9647eb85cedcd6f86f7cb5743834bb53bca7e547e9ac6f86d8878ce8b4a8eae11c6dd18ffdd73f172ee8dd8454e5a5233d1930e56572e71247588ecd6b2415510462cf333fd53d9340dec974e0351733f99a81784d244710642ace40b9aff0442544c4fc448d4bb7df925bb225154433295a7b03f70effec1e0fa6f75d3436e33741db3bd1c81692c4b9984819786d9c2a7b0df9aa05183565b113586437fac436be616953f4582c0f3fce6c9fb1ec8499e4c7ce0043b7c740753ed5ae001c7b701ca388e9c7a2e906304435e587eb842863feee221e00bfb311c3390075ef6b74273d7dab89d30113163dddaf5e06e66fcba09689aaeba0d6cf50a5d795b293efbcd1bb3867db1b4b32efd38295a0411c883d1f6de19"}], 0x1018, 0x48814}], 0x1, 0x40000)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(0xffffffffffffffff, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, r2, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000), 0x2)
ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, 0x0)
syz_genetlink_get_family_id$nl80211(0x0)

13:12:12 executing program 4:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b)
r1 = socket$inet6(0xa, 0x5, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000002c0)='nv\x00', 0x3)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
getsockopt$bt_hci(r1, 0x84, 0x22, &(0x7f00000021c0)=""/4117, &(0x7f0000001140)=0xf8)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r3, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r3, 0x0)
recvfrom$x25(r3, &(0x7f0000000080)=""/58, 0x3a, 0x1, &(0x7f00000000c0)={0x9, @remote={[], 0x3}}, 0x12)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)

13:12:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x70, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3086.725316][T16426] IPVS: ftp: loaded support on port[0] = 21
[ 3086.742226][T16427] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:12:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xfc, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3086.827396][T16437] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
13:12:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xfc, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3086.867962][T16437] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3086.897727][T16427] device ipvlan1464 entered promiscuous mode
13:12:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xff, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3086.978714][T16433] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3086.978724][   T29] audit: type=1800 audit(1596805932.649:2970): pid=16427 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15797 res=0
13:12:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xff, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3087.123679][T16433] device ipvlan1465 entered promiscuous mode
[ 3087.338318][T16426] lo speed is unknown, defaulting to 1000
[ 3087.351331][   T29] audit: type=1804 audit(1596805933.029:2971): pid=16432 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1694/cgroup.controllers" dev="sda1" ino=15788 res=1
[ 3087.519886][T16432] IPVS: ftp: loaded support on port[0] = 21
[ 3087.675346][   T29] audit: type=1804 audit(1596805933.349:2972): pid=16472 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1694/cgroup.controllers" dev="sda1" ino=15788 res=1
[ 3089.545859][T16432] lo speed is unknown, defaulting to 1000
13:12:15 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r2 = socket$inet6(0xa, 0x1, 0x84)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
getsockopt$bt_hci(r2, 0x84, 0xe, &(0x7f00000000c0)=""/4107, &(0x7f0000001140)=0x100b)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r3, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x2c, &(0x7f0000000080)=[@in={0x2, 0x4e21, @private=0xa010100}, @in6={0xa, 0x4e21, 0x0, @dev, 0x6}]}, &(0x7f0000000180)=0x10)
r4 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r5=>0x0}, &(0x7f0000000040)=0x8)
setsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f00000001c0)={r5, 0x8}, 0x14)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000240)={<r6=>r5, @in6={{0xa, 0x4e21, 0x800, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xfffffffd}}, 0x4, 0x3f, 0x10001, 0xe12c, 0x7}, &(0x7f0000000040)=0x98)
setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, &(0x7f0000000080)={r6, 0x3}, 0x8)
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

[ 3090.264704][T16519] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3090.277233][T16518] IPVS: ftp: loaded support on port[0] = 21
[ 3090.366062][T16528] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3090.409264][T16528] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3090.413303][T16519] device ipvlan1466 entered promiscuous mode
[ 3090.521747][   T29] audit: type=1800 audit(1596805936.199:2973): pid=16519 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15774 res=0
13:12:15 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d329}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:15 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:15 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:15 executing program 4:
unshare(0x40000000)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.stat\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpu.stat\x00', 0x275a, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000000)=@v1={0x0, @aes256, 0x8, "82eb0e1ea43317be"})
sendmsg$IPSET_CMD_HEADER(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, 0xc, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x50}}, 0x0)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000002, 0xb871, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000100)={'lo\x00', {0x2, 0x0, @empty}})

13:12:15 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x32, 0x285)
sendmmsg(r0, &(0x7f0000002280)=[{{&(0x7f0000000180)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x4, 0x2, 0x3, {0xa, 0x4e20, 0xffffffff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}}}, 0x80, &(0x7f0000001440)}}, {{&(0x7f0000001480)=@un=@abs={0x0, 0x0, 0x4e23}, 0x80, &(0x7f0000001980)=[{&(0x7f0000001500)="7c62c89a8af6a4d6e6ccac011d5364d800563c3c2ef220a290d3ab7bd5cadd8d289eba2d90927e90e8d0eab48ca212f222230b1dafb56efeac6eeacb37f25b52e09e97e5fa03ef0017f171c49839097891ad39b4347682cb26fdded188e8f4faae7b8456cfd03e2251be214eece41756901c297799e1cdf6fa482f4903c64507b5870ed4bc99ac984cc8efca82eceae24c4b7680d2e1bbe301299fe03d8c7a88774057c0d415ab6460116ce41e85f430cf8cf4a62e3aa9de523af492ade54b11edfd088352aaebad9bc72213cedc0bbec691b4a3873f4d685a59e153565553e4e05b9d98a7265c970a16db5448654d9549a7a9b6b7", 0xf5}, {&(0x7f0000001600)="0e634b82801ca5eaff3398726591c994a1779f8b739a7d2d97a6eebf3d5fff73439d7d2dcacb3536c319fbf023da7a6a20fefd45936c50056b5c2830c8e80f7a23415cc714c32e378f7a384a9de3c73f28d85cdb66a4d3196cecbbda24133b0303c637bb6ca0801c9383dd80409ac49ecf22dc5bcc70bc0e9a9fa4c7ad6cbde4476160ee85cc5b3733675a20e00729cc735bde693a9b05af1db6225fe421371ff35c6b87a754a492dfef723e9e3b5fb27b1452955280992d4cd8c383570444922a", 0xc1}, {&(0x7f0000001700)="a2b554fca637d974820988a9b0b8059e5121d9914f83ce7dbe7f94497b6178eb1227020aeba9388e1a30b5227d24811f63cabd55ef058fa62ab37d834441ac24a9691c4cdb1e291c077d6c4645f725c4f138048c63bbd42f78a863d0ffb7144a7c920d47727744ad779233034e0adee6216d0365a62887d1f9b728b0521609f32803509d531e9de190fdbcbd789c3479b1d6d8c44bbd3ac10e9887d8873081073ab3994f7b358745", 0xa8}, {&(0x7f00000017c0)="21d0afc8550ed1788172cfbf0b72603c55717b9db125a9fde5ac54cd35592cfca6b43216ed9098be7e5b3e8509d54e06d53a5d27155b96eee64db59b1d63d4224e10642103c1b1cd353f18a3a6b4210686b059e6db7e467b47a9d02e9253962696504be3268dba0ce419cfaf73564f0082f1e001086496288e185d578a166b18e1126b2cfad7fd0a4f55622a0b6fd614b74b1d04beabde53359647c563bcd517de94b125cbaa9d9aebd8d0c55856b05bbe803a89d2aa3c49f18a6c3f26da6355ff9822cbe2268750d4d8261accecc5fa8e5d2f5d343c7552e4c043c12ff7554e32c62e6a525975999a45", 0xea}, {&(0x7f00000018c0)="7729becb21c31fb49556c0d8f7e32fa053d72c295026bbf5a2b8e031f66af4c4a4d13c2ebf4edd922043073c9a6ec0e2e6edcb5c546fc0301e76af6941d585961d68a620e710f92ab0bfcf4ef9948922ed9d8e2f", 0x54}, {&(0x7f0000001940)="8dba2eaf5bd3088fbf309ed7251547208da342ce60b91d98e34079bfd6a88cb4b24b3b5515e74d98dcff117a6ef7b13969f2e9f2404c74ef", 0x38}], 0x6, &(0x7f0000001a00)=[{0x58, 0x11, 0x8, "443bbd3cac4e8a0b3d7df3d34f7c90e93ec7a0c846cf888fcc9eb2573f440b9f0d59ca1c6801674172ce59c881fe9a4022b2444761de5a0c7786d9dbf383ce997458e9fda6"}, {0xa8, 0x10e, 0x2, "3c7d11b535fca2e778b3df4fc0fff9ca41e950eaebe275d99374735314bb75c275b96f19dcd1e37004c2468711ed99e32494cb13a748b7a72ce164713787afff53a83a176c57d8d58a389d34fe0024a8ae642140b99a0e9d1e735d63e8346f140287dfb71593da261fbd1c89aa0089831b0b345598ba7576155f309e7340547e2a905a4e61881ac0a8d5dd9d2e5e1cc340"}, {0x30, 0x110, 0xfffff207, "0269b583f108fcb72ea00d9ec901b1674d7fd17ec5dd815557d105e6a5d29351"}], 0x130}}, {{&(0x7f0000001b40)=@l2={0x1f, 0x68b, @any, 0x3, 0x2}, 0x80, &(0x7f0000001d80)=[{&(0x7f0000000240)="b279309eba8cb5703cec1db28e97b78e56f4e7828de3b410d2259b9762614ced798e3d721b12e7f7cce30068be50c03c8c0ae5dc1478e79ea71c240b11593395b89efb9e522e6188aeb4a7c0fa536d449a3efdb256619b457ec76f8d2da2f13f4c18324d778a6d91d3f2ee0b9eb63f4fad4798bfd783d879c3060431516732ba96d27173520869f12550380fe841644cdeafbc5ecd0959ff5c332e3f52a547e2dcd11e01c1617aff3ad4a96fe79ec63c1a25402b21867495841ff332c4497ff6b26fbd7166585daff15c0ff810da239f11775d500bb262d8ef4ba15aaf1c9f3f99374e88d1ff61e1082b429b4b1cf471eece5889f220fe1965e4a10265c62fd6fb1b64eab7c35e853744d919ad94ae8596203efcb8df41e37e56f904001344587e10", 0x122}, {&(0x7f0000001cc0)="6bb003ee0a92a0d382ee249d8aa089bfe8f4b1e28feb25f6537d6bed9ac6afcea823fec59d65c56cf3cf74030819ec2e2dfc8e69c6bfe6d074cd3028ff61a11ab3d5401c36b533a8b8615722b5088f4ef3ca8e3e2f605a626dfeb7af3e7062f394a126", 0x63}, {&(0x7f0000001d40)="de40aaf23cbb52cb1ca8283bc63c9e", 0xf}], 0x3, &(0x7f0000001dc0)=[{0x50, 0x117, 0x0, "197718280cb51cd0ffc57bd0995db96f16505d8b52c1511400ea2ff803a619ca1a120a57d16a3e93f2badc1132ade97bb5d89ff26b322142c2"}], 0x50}}, {{&(0x7f0000001e40)=@rxrpc=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e23, 0x2, @remote, 0x1}}, 0x80, &(0x7f0000001f80)=[{&(0x7f0000001ec0)="acf076cb074f821c2bb16fe21a14bd7eefabf61d962e4d8103f9abcc650d39418f04df7b80ced9bbc94438d80ced0a9537a1afe1d9810f338c7dd3f551ad7e7febec28a47f91ca8f7fbe4a41ba94ade417a60a2c9ed974440477c10e8cf6392986f921e8e65b9c9c078fc19738c24d02a7c53f236f0ba74602db88c6f94c5c377bd6185eeb8e3aecbfe4e576143d00991d9459b049cd8ad84b79ad98cc5f6279a8707daa3fe0c81c3085e54de001", 0xae}], 0x1, &(0x7f0000001fc0)=[{0xb0, 0x0, 0x9, "28c803c8cca87b3957ae79aca35b4268663a38b2a806530315004c60d2b005f624999f1ca16e83d22c0157c04f169da5c293bd88419188c532b4a297b4a69c3bf5435276c93801edbb1756642d724611847303eef2b5b022c8333a0918ee9c24c2eb8406e3cf27bade5ffb7a2b31bf5879d5be0d9575be443120c8b1b58de846f93a86ec446ae01097809fbe2a58cca8f47bc542039ede1feded"}, {0x50, 0x101, 0x8001, "269f1b06c17985bc61c8ccc0efce28742754d104869b36d45618939799a455f71328abd373f9b1d9a3af0bb51eeae7d7049601529d70cad8e5db39f47f2b9a5f"}, {0x78, 0x104, 0x2, "41626a92949faaa6ce498edc17565a1b102aa7b7153f1161f0505d4839ff53891f257ed438ca2d223db8db04b5a5d565f2e7f118694797b6261ea8e28f45a016d65b6e6c8b2bfa68c7935eb2d699f259170b1207bbd6ad6ccd19afddb25257c64318f19ad15fa62b"}, {0x100, 0x88, 0x3, "1deab8573c924d4d146fc0076255dd3ee2f402d5a45a14d31a1e9cf27abc988825ce7bd0f48989561ca34ba02bdf30ccff26884127ac00ca6c7c04bcd468aa74eff415a9263c6f1bb32e6e204ac55796334a3744364953437c7f682d2ddafa315d2d54a2d49fdd42647b0c2e2580a12fdbf7a7f4022ce3a6852eac9900b8349dd5d300a816921d2cf088232695cda26442416af801db478d97a0ff1f7297a26ae964b47c8506436a511e9daf8e1c6812d16df738af1c08365339d100f9a0e556a154ed96b5bb5c2a77c0e92cb913658c04857219916441ff69218f271200794f03dfea356bdb31e4c4e4972379f3"}, {0x18, 0x10d, 0x3f, "78da1a5a8f0f"}], 0x290}}], 0x4, 0x4008890)
ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x18}}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x42, {0x2, 0x4e21, @multicast2}, 'batadv_slave_1\x00'})
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000000c0)={0x1, 0x1}, 0x8)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f0000000380)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10)
setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000000)=0x32, 0x285)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
ioctl$PPPIOCDISCONN(0xffffffffffffffff, 0x7439)
sendmmsg(r3, &(0x7f0000007fc0), 0x0, 0x845)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000140)={0x0, 0x8}, 0x8)
epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000100))
close(r1)

13:12:16 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:16 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x3, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:16 executing program 0:
unshare(0x2a000400)
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f0000000140)=0xa, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d)

13:12:16 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:16 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x3, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3090.711364][   T29] audit: type=1804 audit(1596805936.379:2974): pid=16519 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1489/cgroup.controllers" dev="sda1" ino=15774 res=1
13:12:16 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3091.067904][T16528] IPVS: ftp: loaded support on port[0] = 21
[ 3091.163907][T16564] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3091.207617][T16564] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3091.540902][T16518] lo speed is unknown, defaulting to 1000
[ 3091.607968][T16529] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3091.635204][T16529] device ipvlan1467 entered promiscuous mode
13:12:20 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000040))

13:12:20 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x5, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:20 executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[], 0x3ff800)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r3, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@mpls_getnetconf={0x2c, 0x52, 0x4, 0x78bd25, 0x25dfdbff, {}, [@IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x5}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x80000001}]}, 0x2c}}, 0x0)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10)
setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x3f, 0x1d5)
connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10)
setsockopt$inet_mtu(r4, 0x0, 0x4, 0x0, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r5, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0xd0, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0x5640}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_OPMODE_NOTIF={0x5}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0xfff9}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0x3}, @NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0x7c, 0xbe, "ec4e58180f64296aff444e9d42ab49ec4f882739f7f6efc2b4c2222941aab6d2eb130c339b43f3295228aff33d36b98b6da9c69f8c0792c4a5e43ec51686a3c2f17fd61ba6c892323cc63d9d0bcf7a2789001f0328339c6feb011908cb203b30db8e827b6c2f99037e5dba2dbd93490bec6467d8972af6d7"}, @NL80211_ATTR_STA_VLAN={0x8}, @NL80211_ATTR_VLAN_ID={0x6, 0x11a, 0x2}, @NL80211_ATTR_STA_EXT_CAPABILITY={0x6, 0xac, "cc9f"}]}, 0xd0}, 0x1, 0x0, 0x0, 0x48800}, 0x91)
sendmsg$RDMA_NLDEV_CMD_SYS_GET(r5, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x18, 0x1406, 0x300, 0x70bd29, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x4040001)
sendfile(r4, r2, 0x0, 0x10000aa00)

13:12:20 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x5, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3095.202774][   T29] audit: type=1804 audit(1596805940.870:2975): pid=16601 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1697/memory.events" dev="sda1" ino=15745 res=1
[ 3095.292627][   T29] audit: type=1800 audit(1596805940.870:2976): pid=16601 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.0" name="memory.events" dev="sda1" ino=15745 res=0
13:12:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:23 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d32a}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:23 executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8)
ioctl$PPPIOCSMRU1(r1, 0x40047452, &(0x7f00000000c0)=0x7)
ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000040)=0xffffffffffffffff)
ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=<r2=>0x0)
syz_open_procfs$namespace(r2, 0xfffffffffffffffe)

13:12:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x7, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3097.894086][T16629] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:12:23 executing program 0:
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0xb3, 0x0, &(0x7f00000001c0)=""/179, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x17, 0x0, 0x40002, 0x2, 0x0, 0x1}, 0x2c)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000fe6000)={0x3, 0x4, 0x4, 0x100000009, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x80000000}, 0x40)
bpf$PROG_LOAD(0x5, &(0x7f0000001300)={0x3, 0x7, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000001810000000000000000000000000864726ec2055aaee419193a18bc8e78c5f26902082614ae58e27fd5c4b3892a8d0d1c6d9da04d05a15", @ANYRES32=r0, @ANYBLOB="000000000000000018100000", @ANYRES32=r1, @ANYBLOB="00000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x2, 0x1000, &(0x7f0000000280)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)
r2 = socket$kcm(0x2, 0x8000000000002, 0x0)
sendmsg(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000000)=@nfc={0x27, 0x0, 0x2}, 0x80, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0)
ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x890b, &(0x7f0000000000))

[ 3097.997256][T16629] device ipvlan1468 entered promiscuous mode
13:12:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x8, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3098.107409][   T29] audit: type=1800 audit(1596805943.780:2977): pid=16629 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15831 res=0
[ 3098.174227][T16635] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3098.249296][   T29] audit: type=1804 audit(1596805943.870:2978): pid=16629 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1490/cgroup.controllers" dev="sda1" ino=15831 res=1
13:12:24 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x7, @any, 0x0, 0x2}, 0xe)
r2 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:12:24 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d32b}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:24 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:24 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @multicast2}}, 0x0, 0x0, 0x2, 0x0, 0x32}, 0x9c)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000000c0)=@int=0x7, 0x4)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
pipe(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
vmsplice(r1, &(0x7f0000001640)=[{0x0}], 0x1, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYRES64], 0x48}}, 0x800)
sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000001000390800000000000000c9e7f7d35233609e146a0ba93654aaed06bec1bb8fe5578c9b7f10d29c28d0fd711fc4ac3a572665ba24dc8bdc398f04e6640975d4f905ffcd84920ec6a7d993f35955b3c552458771517c040532eac9d39d29219cb080267b98cbf2902a322940a0b7a0b30cd1bc1ec8593e40df1020060ed206535d393930b930681d95d2bdc19342edfd0cb0af9c944d38d67c6e20131bb159650116b33b10583c6db4af33e89f46efee3bfc4492b770a13b7c4fcdebf3752782ef06780e08afc5091328bcdee33766d3be2f2ea3069a578906a97d8c7281206318db6035022c98e53ed1d941bee59e9b5f259a0dea3c33c65b99ea6691b858cf2f1b54fd9cad4e66c6054d3a1b30b0d30017986f6bf2693a51453e5c0226999890b3810b17f75f590ab3c16b103d929302870000000000000000000000000000007929e750d0c47491ec8046fda8267b54aca8cd2cc8fcbc0e58a49cd0903e28f977c02e06a7952d34067acdfe900182189c02ad0b80f368bc135e29ad5438fe7dbe3459a57fd93cc8b86d3496f90419a85ae10f3fd4b2eea257bca38bd9c4a0a992c471566a27bed5de1145191288dc756a899324c7978c", @ANYRES32=r6, @ANYBLOB="000000000000000008000a0014"], 0x28}}, 0x0)
ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x8915, 0x0)
getpeername$netlink(0xffffffffffffffff, &(0x7f00000002c0), &(0x7f0000000300)=0xc)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="6c0000001800000827bd7000fcdbdf251c20803ffd00c80a0020000008000400", @ANYRES32=r6, @ANYBLOB="140012002300560ec61c9b5ba40900000058f9510c00090006000881", @ANYRES32=0x0, @ANYBLOB="0c00090004000620", @ANYRES32=r6, @ANYBLOB="05001a000400000008000100000000000c000900000080ff", @ANYRES32=0x0, @ANYBLOB], 0x6c}}, 0x0)
ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000240)={@private1={0xfc, 0x1, [], 0x1}, 0x15, r6})
shutdown(r0, 0x2)

13:12:24 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3098.962755][T16663] sctp: [Deprecated]: syz-executor.0 (pid 16663) Use of int in max_burst socket option deprecated.
[ 3098.962755][T16663] Use struct sctp_assoc_value instead
13:12:24 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2b, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3099.077880][T16662] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:12:24 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:24 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2c, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3099.125287][T16662] device ipvlan1469 entered promiscuous mode
13:12:24 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2b, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3099.269299][T16663] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3099.292328][   T29] audit: type=1800 audit(1596805944.970:2979): pid=16662 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15773 res=0
[ 3099.309262][T16675] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3099.384596][   T29] audit: type=1804 audit(1596805945.060:2980): pid=16662 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1491/cgroup.controllers" dev="sda1" ino=15773 res=1
13:12:25 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3099.424862][T16684] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3099.437625][T16663] sctp: [Deprecated]: syz-executor.0 (pid 16663) Use of int in max_burst socket option deprecated.
[ 3099.437625][T16663] Use struct sctp_assoc_value instead
13:12:25 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2c, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3099.520978][T16684] device ipvlan1470 entered promiscuous mode
13:12:25 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x3a, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3099.713257][T16675] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3099.744768][T16679] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'.
13:12:29 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="020000009f84bb57964baaaa33b775a7458206e9ecaaaaaaaa0800450000580000000000119078ac1414bbac1414bb0420880b0000000800000086dd080088be00000000100000000100000000000000080022eb00000000200000000600000000000000000000000000c5370e14ab370687f69839ca37ddcecb0014185a91ff11b066d1f862c2494404d964e541a5"], 0x6a)

13:12:29 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3103.838416][T16718] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3103.863330][T16718] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
13:12:29 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d32c}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:29 executing program 0:
r0 = socket$kcm(0xa, 0x5, 0x0)
sendmsg$inet(r0, &(0x7f0000010100)={&(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x22}}, 0x10, &(0x7f0000000ac0)=[{&(0x7f0000000040)="0000000000000000be570f", 0xb}], 0x1}, 0x80c0)
sendmsg(r0, &(0x7f0000000400)={&(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @private1={0xfc, 0x1, [], 0x1}, 0x8d}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000000)="be", 0x1}], 0x1}, 0x60)
close(r0)

13:12:29 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x3c, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:29 executing program 4:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8)
r1 = socket(0x10, 0x3, 0x4)
r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000bc7ef9642d29ba564165605dca29708efdf9b15a5c12a126fc1a2751f642635bcd9a8bf7a928a5d054b0d2c54d519ea75c52f41ed6f2886973626b684c8bcede3294f6e73d06ad16dc2d26725ff833b5f83b499918e6a6ec245b781d41aee9624c847e2f2312d6a1db45bad354fc1a3f20340547860f97d30d407ffe406483a0524937ee7559e4bf70136746b37fdfbbb152758d37ed8bcac41eb7243bdcd536249c7996e898b61927eaa5a8790054ba13d3ade593220f96027090234aaf7ea92f41aab73e7a85eef87e956bb7c5c76a347264fd99359f4e57b0dcc2bcc188ea880a4b11a8bb81eb22b0ddfc68c8079019996f5e65cab354149d9107d8a88b0aa5b5661555f00443aee5e71400"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r3, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r4, r3}, 0x78)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x14, 0x5, &(0x7f00000005c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffe1}, [@jmp={0x5, 0x1, 0x2, 0xa, 0x9, 0x1, 0xfffffffffffffffc}, @alu={0x4, 0x0, 0x8, 0x9, 0x0, 0x6, 0xfffffffffffffffc}]}, &(0x7f0000000600)='syzkaller\x00', 0x80000001, 0xad, &(0x7f0000000640)=""/173, 0x41000, 0x3, [], 0x0, 0x18, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000740)={0x4, 0x7, 0x6}, 0x10, r4}, 0x78)
r6 = gettid()
ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, &(0x7f0000000040)=r6)
getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000800)={{{@in=@empty, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f0000000900)=0xe8)
r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x102})
r9 = socket$rds(0x15, 0x5, 0x0)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, <r10=>0x0}, &(0x7f0000cab000)=0xc)
ioctl$TUNSETGROUP(r8, 0x400454ce, r10)
r11 = socket$inet6_icmp(0xa, 0x2, 0x3a)
sendmmsg$unix(r1, &(0x7f0000000ac0)=[{&(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000440)=[{&(0x7f0000000280)="989e19cdb6838769b872f9d0108707269a3caffd2a99323eed1c07ed2d3e50614d81bee35b35bd5a0642f21f2705d1fd170c4bc6c648f8cbcab3756e589e2ed9563eb17ff313422c561130762b5af7bb7334a68d17532feb41af17d23e5f201967cc535403d4dccadce2dd121635d82781c7daccb59d90043671d17644878c61e7b20f9eeeede658d2109781986a1a59835138403cc141fb1dfe0250eccd03b71a8e77320e5e94f968aa34af0b4a03ae7ed901fceccf34df8f8c58dd1b28090699cd4235ceff620f8e2a600ea095e3551da79c55c274a211b701eb06a70c80640a870c5c5ca2cb66010e8955820637a0c5b31161cd", 0xf5}, {&(0x7f0000000380)="ef7778c8cdc63eba51ed96b05b2df64e715c03a46a8dffc016bd50c1b7e70ccdae187ae22606c117ae251dcae64a72d93fae419d86f622b03fdf7682389b6f5bad9a9e7ca10e278e9d87e15eee1bbfcf5abee3e9de45763d9ee67dd1113df499df656acead09b72501394bd2f1919bf1a44dc938eb5a15ebe351d03b58f4f7694ae47d7beffeaae71d4ce3b7bff0afa04d5857f354082b774511c846155b0b18e262a0a3a482f46aa23cdb6aa8297bc95816a33daaff74235fa9d0ec8b96a1", 0xbf}], 0x2, &(0x7f0000000940)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r1]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [r1, r0, 0xffffffffffffffff, 0xffffffffffffffff, r1, r5]}}, @cred={{0x1c, 0x1, 0x2, {r6, r7, r10}}}, @rights={{0x18, 0x1, 0x1, [r0, r11]}}, @rights={{0x2c, 0x1, 0x1, [r1, r1, r0, r1, r0, r0, 0xffffffffffffffff]}}], 0x148, 0x20004054}], 0x1, 0x4000001)
write(r1, &(0x7f0000000100)="fc00000014000700ab092500090007000aab0700a90100001d60369321000100fec0ffff000000000000000000037515fa2c1ec28656aaa79bb94b44fe000000bc00030005000000140003000400117c22ebc20521400000d7d5bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201ded815486f74e4bdb2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd2000175e63fb8d38a8700000000000000", 0x141)

13:12:29 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0xe0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:29 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x3a, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:29 executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0)
r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000bc7ef9642d29ba564165605dca29708efdf9b15a5c12a126fc1a2751f642635bcd9a8bf7a928a5d054b0d2c54d519ea75c52f41ed6f2886973626b684c8bcede3294f6e73d06ad16dc2d26725ff833b5f83b499918e6a6ec245b781d41aee9624c847e2f2312d6a1db45bad354fc1a3f20340547860f97d30d407ffe406483a0524937ee7559e4bf70136746b37fdfbbb152758d37ed8bcac41eb7243bdcd536249c7996e898b61927eaa5a8790054ba13d3ade593220f96027090234aaf7ea92f41aab73e7a85eef87e956bb7c597abbf95c76a347264fd99359f4e57b0dcc2bcc188ea880a4b11a8bb81eb22b0ddfc68c8079019996f5e65cab354149d9107d8a88b0aa5b5661555f00443ae"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r4, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r5, r4}, 0x78)
r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=r5, 0x4)
r8 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r8, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
r9 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r9, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
r10 = socket$kcm(0x10, 0x2, 0x10)
write$binfmt_script(r7, &(0x7f0000001fc0)=ANY=[@ANYRES16, @ANYRES32=r4, @ANYRESHEX=r6, @ANYRES64=r8, @ANYRES32=r9, @ANYBLOB="f609427d1519430fc7308e2e295e9b02d2bda417a545fd0c15490a8a4454061ae08b304c0538b822c3b5decd41df4cf13954d4754d67cb86ec7fb6132d744b32fcb4b94ae808cd2e2a25a88acfa61b5cd2b6e07db2d20fb1cfb7ccb4bc4c8c0657a44cfb52979ceb2a4965a6e82560f83af6c52bcd7c82e81781802505ecfb0dc899aeaa8e37ffae1c4722a4c9de3ae464a2ce5450809a4f09ebbdbe85ed18786a55d8674c8dc89287ede4c54c3ba67d3585301aac77e8a281894429d39f383f18491f80769e2ec413e3a37190f9477fc6b6cc98463f506411ce2a46af491ac07ba1c9304f174a4d815eed8e66044a0d0e4d5cee319407d6e3451f52918ae64f9953530d596ea33c5a0b50d4735db0bce6b9d98211ccb1dbe0bccd2a8aedaccbad30bfeac5eb194e8400f88a952ca7f94e7640729f18f2d5db137a720d559fe9eeb8011c1fb6a2190fa4cfa8c054cf3ec427c9d2284be830207d47ed5adcd635f2bb5fab9c2a378de9ef6f7ebb1c73f36602c3fd65d8cf3651823786885445e5931a56df81bfd67a4610967f979dabee22433d3590d6dd5697d55ab3d3a8c96fac89b45b973f620ebf5a18db09c3060d45a991e6994b5607aed9a5d7df387be88e7f08394fda8caf6fcf75bd4055805825367010b4a8914fc68d2ad3c958d888e691901c51a4bdbc760ce2f0ac0a01bdfa5a516c08ecf6f78e33e36585599a7e5a1121a8ba33a04c22beec40eda9ed88ce2d14f162204770384e8c36a9615231cfb77771a523b33ec33bc26756775c813c3810d8d55443008c4d5d190f3e78af04d6aeedadbe4a9c41226170cda8645d10fdb0d578d3cfd4722e6c0380bb4ec64807a4dfeb6c5baf61aeac704cf5dfa8f396d304f09a374cd6f47ab4d3c136547f974ec9361dfb92eb30507866d5457e396890a4474c46c3fafd24c3f3e3cfa8a3db8e263d5e04087b405f2959ef059c268d06672ea6f132c58b0ed42895c95db291a4e47e35368150147f8dfd3f31b5df53aad5b6d2c2a330eff57ba93c6349f2d4e0fe47b457ad97e832f3b1033d3c2ab5e6e19cebf3c7a834cb67dec5826c13d3c19efad07f7ee472f82fa02bd6d0038a2cce20a3d521d666e8bfe026e805d2edae8a9090e45b53dcc01c30f0e118e79c4fbeb0f587c40cee8172b17137d822066860f020a1c55e7adbc31e5a4c87fd60c4df82b4952de26074f2fbb3f8fdb0640a0a431b1029dfc203e0603077357f2189b5ab9d473c6c2ed9365ef9c18cd9b28099f009e8bc4dcf7e10e07aba84cac00aede129f3d6a666a25dce05be34373a85af5ae9655567caa5e417c22194cf6caeb671268e2486c22eb9062f24f7588538a3926534da22350ac9f09b89305f758f09bc4d6c8803889a08e24224c5d035332c958d4c09b4c66f8c18542b858c2f0971d5250aee82f29b069c7b73eac5df117e21fefab321c00fd52ae4d3c715a4b95ae951d82d578a4ad7681b14654f0cc47ca8ac5245f14b232814607f0d3c43fd633321e0aae97daf89750879c8aa78b8a1626eb2fed1eedf2e7db22f32327473714ce7182ff842df601cb8d8a6981e097f132200b7ebcea1629ce93cc62bc5556d2b8b8b48776cf9ac41b26247ecf7932ed95edb0b772f9630aeba7afec5ea8b56ed340a7509aae88e4e592abf5a78adb7ac2cc535f908d76f053262cf32e80ffd8329bdd884d4cd259f66896a9b734b9a22cdd6f0d332337bafe6d8178e2b8a293ec9b20bcf9ce9dd8b26f009c7ad3fc527b7e058b9530101dd28c05e2d60d97a78dc504706d88a636fe8fcce611a5647cfda2d862fe21cf5f5a1179a78cc4740251231bf3f3095376af4418559ba89389020d22941d71747179ad1f3b8fae27a4e6b508335e6c6cd6578a971e11d4144178bcf78931b71608cb345a47e9059558d56355a329c56bdf4ff1f4205f3126d42cc65fda2f172808cf288dc31c5ec2922e944d61ed48d818884ef0fb3d950e5fe10e6de243789299d23cb4ae43cb543246123e8f9f9a247a2e5929d042e4a7b768efa68efe46d06e89ae028201f582f6b4159a8966dfbd223fe3013333cf3531993539d9a88b42e56179b088c2528f7376a09421fac6991747173b1c90fc47b322685ffda4dacca5846abbac9d19b21ee1b8e87be5cb0cf079c5cf898b3103463de32b811acbda226917ccb3a0fd1c86d5efeb3495d9c23251a996f20b070daa559ec53f549fa85d3f424a0fae8c34585fca8d5b1dce0fa893c5fa228eb2678079b75054aa473de2190fd36a1eb8f17692179526a2e220ddc009d0a83900e7a54870a571b417181a1c7c735e6bf4efbbe1afabc87edc8da9ba057d8e8f64195d6752e362142fca2e208922c52b03c8406debad05cd4c1fe3116ec75c29cdd18b2d75ff4d7d8281ffad118c412779f97628ebef2abcf448abfc1417946299f6b526bf8457637d097bc60c45bd988aa1edea4dcca0a9434f6e0b95f88001f53015513758072b5dd174cef6f389b5465b1af3c9c8eaac2dcfb23830505327788474db450878f95ccb6026a6b8ee0a8b0945e21b6b78cdfd15c08affb183f86aaf495434ed2e57dd84c09fd32289aaad9aea35764bcf0de2785acc3feeb4e3aadebfd66546229b2ddbe224a9a8d0302669f5458e37cddd407e3c61e5e5f51f7325ef197a8a835872417aff39a15d7cbd0338c85464987b079dc75e34c21ef6ff8de1b90433b949f34e0746d9310d3ca70900126f9641de70f621b8c79744a94f5540fd6574deccd354db176ba6a061cf26a6fe73292902d961c1f1a131eb724e5e263c78c60e41d4fd07d489d733e3253c1559742161904b9591cac707834296da82ec583010293bdd219ac0343c4b563786279fb6f7a14fd7ffdde8c7467e6d0dc40a9a58c7318c9c49504ab25258ba6f389a75ce6f58a68efb5327d9ecbd3fbc928b1bf513f400d2874a4b8873d687de25e9e866d7f4f0f4cbd7caffc375f260cd529573f099ca97fcb577dc7bdea5b9c068ced12beda82e55a7f4232401337ca7d8710f4289a762e7443ea986f22bfa0bcf04af106d1aa49324863bac647a5758d79d83c9381364cd19a834709b2b57edbc466f5187499be1cd40fbcfcfa43782b762b430990c630f218c21a60d9ab5f768928c17c0eda114e4f813efa159646f1793e4dd402ae37e3e74ffadd0620a3fc5d84134dacf8eb70d520866980c8293784cd635816a79b61afd8c32971ad7487e995dfd5c391efe80522c6e0a1ce154fc26dd248a234f85115a29eeb077d336bfe9c505bb7a28886d77df14fc4f6f85f81ecd31ec5222450798d562676f2da6e057cc9e57436eee1d32db8a7916ad3f5d41ff9235c665b3c2cb54a509c11d64871b80201e698cc03d15db03e4532a85057137da88a91844fc50e23dbf0a895eb343f9cd4faf77fdd705b291f191754e40bc2306ede1eb3476470fd65a0f649cdf235c81aba07e20fcf86d281b79eb3e4302690a8f632bc09b66112bf629998d00ef3091811738d4f5077131193379df61e315d48a0268904e864580acb4923cb38c2c6fe4dde241a2f083e6ad6e43c34409918b2828d6d5804e5f451d910c95030e8ea4b6878c227da2322571ec6bd4ade3781ac0a114365a37028e2d20c3dfc8254fe00debe531264335ac3d1e9e1fbf75f806eab881fd0244abc24a2864c8fa19806d8d71e3ed1c1f1c280941e20a0f2067f5ca346509ae516f16e0a09cd4cf144990d20dc6339c8a11c3121795180eefd2b1acbaa2ed1aef6823be539bb50ad3d0807107a46b7cd64daf6d7bad146ab867fdde1226b2495f899919cfb76f36a79417f7d2bdb2ff660a85d8baccb7225313f65c33ad3398d9643bcdd53a43fd143e46b2adb8d3c4be9a126f62c171fe0031ba48f3fe8d039e9e636d133f48d4010382ff2ea58d267a32aa0af41d79da3745548349ab0be9e7712f11f54bf009b36b28d4c41a94168c0e2ee94523c407c73f17b11996bdbeaf483fc037d3c46739fb490871c6092e7e26b3e7818fdb63bcf2900ae16a13a625e1160e375e53f7f0bad2d6696f9f4f1aab33dedccbdd05d05f11d7f727feda9841b342e09a50a36d1dc42ee922f56bcabf6933c1f598fb9c48c3c41192d79dc678c23ae54e44f1d3e58e2bc5331054fa0454732de993d3c805bce2a35cac044248b50e8b229d6c3746bf313cf043f514d9f2afc6ff14b12639c9ee6d96808e541b1456e62f53c2a273325fd903da4973dd589ef86a4fb524eeb6ffcaf2b534a6fc592ce8b184c5f7cd7169c0e1c582c6208004d2517004f717f174da631bd436509cb96f80fc9d36b8f0f4f16a97f4471f8c98fd338f0272bdea8c0084a60a37a7f44882c224a33868c02ef9ee8bb53fd061634a0745b78d1e855b7112149f740ec37889ce3357902cd76dfd231d143a1c9e7451fa926d898bd2fbbd3effddae5fb8d4db61ceeb848505996429a5a11ccdb39faeb548441b77ee75432f7d2c7e58dc99f791cdbe4b8c46bfa952c92ad362b5e0d8f50dbaf9eac046bdb23554f0cc5e8ce7e6d3bd5435832ed69068cb207a41f6f09521bdd42d10e3a646ae95542bba933c9bbe38fab71bd7b4a1231a90272d2bebfe2e3395542fed02b62eb9b1a79bac3aad651395b56fbe94366f8b725659c4da0d2c3d2de59b9390732b151c6f4a4fcc418827991f1fd4329d6271debc29577626b34fa12d1534922503715872ed51d34120a330c9709844d44964944a07671a04c024e4e2b1b41d76f21a53a34d74a282db46bb001db3f0fe389ec22e19b785f3987aace4a02108f91cf485592e93c0520455c8b250970641557bebcd490df89f69962a9c362f3011d844f95c8dfb73731c724f5480603b4c5dfb5322406e19d3058aa0db873819cd08ef1be970ed3f2cfcfe65ccb139a64d015ff0349b2b48c4fcb41c760d8a56c56b010cd3cd228151388ecb985bfa069ba27954cd6f8c98d5975a71ce8b3d6a8c3ee9836252127a20fff229238fe510131b18ce161ac985ce712d2952a8130b403ab1c42764e4e767695383dd16d893d4684fff0f0f014ed0f2be61630d7d6ab32bb68cf3131f76d9e955c2d38cee487c7e775eb101d5bc13065591e7b93b8afa08f050fd76f0189ecab7f2565c72a5d309c84ad3a82fd62297d26eac74f8170cd27eff5ed789487280cf339de9a18ba0fd541411f22bc74f548713a34e511bbc4b8d23e015dbc02d42a1feeacb301dbbd718255acfc7f2b92a9990c4aff1725fdbc1fa169aca2c5d3a95a78849846b26e132fbaa6dc2e7d19a868a48c86e78a62aafbfb919769d17a07139121f71a40c7687cec0736bd7c9955406ba1d9f2983c810c22157571e5683e2d6c87e349023a7125c49432b0787ebe9dcf96a3da755681bd51c9302b0698bd562ac817ea3640b5b3c162e558a09154d7094c0cd1f3279cc6bb9a24bacfd09ed658d3ab22e8dcdbbddba2eff0d951d8eb9e2c09fa46726201efa5d3c7311369c1b01965d61fa758b46bab240fd44dbe89d9df9ecf5d0f81627952364616e4a20f17e70a785798ea12b28a65daffbb231fc48d28bd68f1245d6f173c57cf7f28550843b83356510efd73b473fd080522794a0aed8a70fd62abb72df625ade0fd599be88a0ffbaeeadf003ce20bdc4c7d77a57a9528d782b769c2a3e2e14fc275338daefdebfce22167d08b7120606adcb1d7f414f838c516fd45cbbe6eef44bd4a8871a58eb778f1b43129f713a13d134ce6df097f19912c2fbcd367258047651b69e23108aa8b56840704", @ANYRES32=r7, @ANYRES16=r10, @ANYRESDEC], 0x3af4701e)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r2, 0x0)
ioctl$FS_IOC_RESVSP(r1, 0x40305839, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000000})
r11 = socket(0x10, 0x803, 0x0)
sendto(r11, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r11, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000fc0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x7fff})

13:12:29 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3104.099090][T16733] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3104.114383][T16733] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
13:12:29 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x3c, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:29 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x2, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3104.193785][T16739] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3104.278737][T16739] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3104.639021][T16738] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3104.655808][T16738] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3104.665275][   T29] audit: type=1800 audit(1596805950.341:2981): pid=16734 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15856 res=0
[ 3104.776740][   T29] audit: type=1804 audit(1596805950.451:2982): pid=16734 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1492/cgroup.controllers" dev="sda1" ino=15856 res=1
[ 3105.086458][T16728] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3105.105778][T16728] device ipvlan1471 entered promiscuous mode
[ 3105.594397][T16754] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3105.643391][T16754] device ipvlan1472 entered promiscuous mode
13:12:34 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x9, 0x4)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)
r4 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r4, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f00000002c0)={0x1, &(0x7f0000000280)=[{0x3ff, 0x2, 0x2, 0x100}]}, 0x10)
r5 = syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r5, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x140f, 0x200, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xa, 0x45, 'ipoib\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x24}}, 0x48805)

13:12:34 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0xe0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:34 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x3, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:34 executing program 0:
r0 = socket$inet6(0xa, 0x802, 0x73)
socket$netlink(0x10, 0x3, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0x208e24b)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x307, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x10)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=@mpls_getnetconf={0x34, 0x52, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@NETCONFA_IFINDEX={0x8}, @NETCONFA_IFINDEX={0x8, 0x1, r2}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x20000400)
mmap(&(0x7f00007c1000/0x1000)=nil, 0x1000, 0x2, 0x28011, 0xffffffffffffffff, 0x1000)
bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f00000001c0)={r1, &(0x7f00000000c0), 0x0}, 0x20)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58)
r4 = accept4(r3, 0x0, 0x0, 0x0)
sendmsg$nl_netfilter(r4, &(0x7f00000002c0)={&(0x7f0000000000), 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="0100000000000000bb034d488c54f354d6125f25afb5b3317aaee93eaeef5a859e6a6e158fc6f309af08aa102ed6f300c47e410ea20881200115edb21d2be355baabe8b9f9bd96a2ef103ebf116ef873c5c51ef641a02a0fe39d6f6e64647bb95f128f8e9add1fe3640022142c63a6661bd05b4fbdd85cf9a5957558ea8c8bb9d4e2ca6ef176e5dc77e9e3a750942d65ee005d9861d5e7bbc3ee7d6bce59b1281c82a011ccc95eada1bc00b0ddb219eae5b9"], 0x20002154}}, 0x0)
setsockopt$sock_linger(r4, 0x1, 0x2b, &(0x7f0000000100), 0x8)
socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00')
sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)={0xfd23, r5, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_MON={0x4}]}, 0x18}}, 0x20000000)
sendmsg$TIPC_NL_PEER_REMOVE(r4, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x58, r5, 0x10, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x20, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x843}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfe3e}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000040)
setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f0000000040)=0x101, 0x33c)
sendmmsg$inet6(r0, &(0x7f00000032c0)=[{{&(0x7f0000000080)={0xa, 0x0, 0x7, @loopback, 0x3}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=[@dstopts={{0x18}}], 0x18}}, {{&(0x7f00000003c0)={0xa, 0x0, 0x0, @dev}, 0x1c, 0x0}}], 0x2, 0x0)

13:12:34 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d32d}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3108.723779][T16789] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3108.758915][T16789] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3108.882110][T16788] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3108.933975][T16788] device ipvlan1473 entered promiscuous mode
[ 3108.979138][   T29] audit: type=1800 audit(1596805954.661:2983): pid=16784 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15850 res=0
[ 3109.001547][T16788] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3109.040141][T16788] device ipvlan1474 entered promiscuous mode
[ 3109.051336][   T29] audit: type=1804 audit(1596805954.731:2984): pid=16784 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1493/cgroup.controllers" dev="sda1" ino=15850 res=1
13:12:35 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:35 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x4, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:35 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d32e}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:35 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x200000000000011, 0x3, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000180)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d878749cd8d984ebf11088a4fe52caf061e88fbc57b85583f94f6ad", 0x2e}], 0x2}, 0x0)
r4 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r4, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000001c0)={'netpci0\x00', 0x2400})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', <r5=>0x0})
bind$packet(r1, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14)
getsockname$packet(r1, &(0x7f0000000500)={0x11, 0x0, <r6=>0x0}, &(0x7f0000000040)=0x10eef0f1)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_SPOOFCHK={0xc}]}]}]}, 0x34}}, 0x0)

[ 3110.245865][T16817] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
13:12:35 executing program 4:
bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x14, 0x4, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x3c)
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000bc7ef9642d29ba564165605dca29708efdf9b15a5c12a126fc1a2751f642635bcd9a8bf7a928a5d054b0d2c54d519ea75c52f41ed6f2886973626b684c8bcede3294f6e73d06ad16dc2d26725ff833b5f83b499918e6a6ec245b781d41aee9624c847e2f2312d6a1db45bad354fc1a3f20340547860f97d30d407ffe406483a0524937ee7559e4bf70136746b37fdfbbb152758d37ed8bcac41eb7243bdcd536249c7996e898b61927eaa5a8790054ba13d3ade593220f96027090234aaf7ea92f41aab73e7a85eef87e956bb7c5c76a347264fd99359f4e57b0dcc2bcc188ea880a4b11a8bb81eb22b0ddfc68c8079019996f5e65cab354149d9107d8a88b0aa5b5661555f00443aee5e71400"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r1, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r2, r1}, 0x78)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r4, r3, 0x0, 0x100000002)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x11, 0xd, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x5}, [@exit, @jmp={0x5, 0x1, 0x7, 0x2, 0x1, 0x10, 0xfffffffffffffffc}, @jmp={0x5, 0x1, 0x5, 0xb, 0x7, 0xfffffffffffffffe}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0xe1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0xfffffff9}, @call={0x85, 0x0, 0x0, 0x65}, @map={0x18, 0x6, 0x1, 0x0, r3}]}, &(0x7f0000f6bffb)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r2}, 0x78)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r6, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r6, 0x0)
getsockopt$inet6_mreq(r6, 0x29, 0x15, &(0x7f0000000040)={@mcast1}, &(0x7f0000000080)=0x14)
write$binfmt_misc(r5, &(0x7f0000000100)={'syz1', "b57a26530e3fa6fbcce8af03fe3ca49bdd07f9a0a79c611038ead466ee1d5c0c0a0ecb71832b98af9e505677f1096a03e662661734a4c7ab18eebfd5ba085575e89b2c18859f72e83aa0030e7a1232fd7a50a9eaffbb57d3b56064633a7827c49116fac914b009a80ca245e95ee36440ed449a919a7a0c0e6006c03c35b019ced8349c385fbeae323ed27d22ac5e617df9c90afb48d8bf3a21d95aeaab5d5669e3d4a0f5d4d8"}, 0xaa)

[ 3110.309452][T16821] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3110.319481][T16818] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:12:36 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x2, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3110.352597][T16821] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3110.389750][T16817] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3110.422022][T16818] device ipvlan1475 entered promiscuous mode
13:12:36 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x5, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3110.526778][T16172] tipc: TX() has been purged, node left!
[ 3110.540953][   T29] audit: type=1804 audit(1596805956.221:2985): pid=16824 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir737268182/syzkaller.QFVM5g/32/cgroup.controllers" dev="sda1" ino=15899 res=1
[ 3110.570785][T16172] tipc: TX() has been purged, node left!
[ 3110.580704][T16172] tipc: TX() has been purged, node left!
[ 3110.592224][T16817] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3110.600247][T16838] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3110.606108][T16817] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3110.636420][T16821] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3110.637662][   T29] audit: type=1800 audit(1596805956.271:2986): pid=16818 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15898 res=0
[ 3110.708771][T16821] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3110.741226][T16838] device ipvlan1476 entered promiscuous mode
[ 3110.811771][   T29] audit: type=1804 audit(1596805956.381:2987): pid=16818 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1494/cgroup.controllers" dev="sda1" ino=15898 res=1
13:12:39 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x3, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x6, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:39 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d32f}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:39 executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r1, r0, 0x0, 0x100000002)
r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00')
sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x800, 0x70bd2b, 0x25dfdbfd, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000801}, 0x40090)
unshare(0x40000000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
r3 = socket$inet(0x2, 0xa, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000280)={'lo\x00', {0x2, 0x0, @remote}})
r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$sock_inet_SIOCSIFADDR(r4, 0x8918, &(0x7f0000000100)={'lo\x00', {0x2, 0x0, @local}})

13:12:39 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'vlan0\x00', <r3=>0x0})
r4 = socket$can_raw(0x1d, 0x3, 0x1)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000104fe104b67ec0001000000009f", @ANYRES32=r6, @ANYBLOB="00000000000000001c0012000b00010062726964676500000c0002000500070001"], 0x3c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r6], 0x28}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0xd001, &(0x7f0000000000)={&(0x7f00000003c0)=@newlink={0x40, 0x10, 0xffffff0f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8, 0x1, 'hsr\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r6}, @IFLA_HSR_SLAVE2={0x8, 0x2, r3}]}}}]}, 0x40}}, 0x0)

13:12:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x7, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3113.627742][T16859] bridge5: port 1(vlan0) entered blocking state
[ 3113.648943][T16859] bridge5: port 1(vlan0) entered disabled state
13:12:39 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r1, 0x0)
ioctl$TUNGETVNETHDRSZ(r1, 0x800454d7, &(0x7f0000000040))
setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1}], 0x2c)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r2 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
[ 3113.740390][T16864] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3113.845614][T16864] device ipvlan1477 entered promiscuous mode
write$tun(r0, &(0x7f0000000240)={@val={0x2}, @void, @ipv6=@generic={0x2, 0x6, "821963", 0x2240, 0x67, 0x1, @remote, @initdev={0xfe, 0x88, [], 0x0, 0x0}, {[@hopopts={0x87, 0x10, [], [@generic={0x64, 0x28, "133fee6c6e1ed50d227db8384f3c66ddf15bab10d4e1b36e1961bb19c2f578c0c67f2b3d235f6eaa"}, @padn={0x1, 0x2, [0x0, 0x0]}, @enc_lim, @calipso={0x7, 0x50, {0x3, 0x12, 0x0, 0x3ff, [0x1000, 0x726f, 0xffff, 0x8, 0x3, 0x2, 0x4, 0x8, 0x2]}}]}, @fragment={0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x66}, @hopopts={0xff, 0x0, [], [@jumbo={0xc2, 0x4, 0x3}]}, @srh={0x11, 0xc, 0x4, 0x6, 0x4, 0x40, 0x3, [@remote, @remote, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', @mcast2, @mcast1]}, @hopopts={0x11, 0x20b, [], [@ra={0x5, 0x2, 0x6cf}, @calipso={0x7, 0x20, {0x3, 0x6, 0x98, 0x4, [0x7, 0x6, 0x3]}}, @pad1, @generic={0x5, 0x1000, "5b94eadec69dea714a68a4eff7152865d91331d27a9255fa16298053eba4ff60886760a906e45dd98eb7f3d35e86778530b72da8d7c204a05055ac58e5df0ea0d7ca9d7d1aa42856bbfb9207fd66e1bfce21b4cc753e0bb80062cc22964a8e71bdb55ec432c83daf40335c8b56b117e57a8a2db41fed1e9288a2d74bcbf1f5d1de6f4129265527f378df502a0ae86d665e5a92a09b95dee667cd30d6257ac054f40e2e4c3693f6258282d5c76fea598afad3ee509bdf9beab9ba6922dc5c20db8aa828a2cfe9f96832a5a782158639064958d96ac59a5215afd0aee8eee27bd79f8e3695d596269f192afbe2a6a54a99a6494b72c03e59e87ca6c748c13244e1affaa493e341ad840e1965da1dc20ae331d9b41ad4644226e0072681cd1b8331d2c2fa9efb6550513a1fc0a2edfbeb6348c9642ab810069b34c20b395577e9d5b68580183467f0de97581f17ba30630918710c928d61b115d302c4b137b847efac3d5bdde0b52c77261f37d9451402c6c0f91b3bb68d734d8322e6caa5b86d30a76f02ee7b9f195bb5e811826ef82682f4dccd5a56a086a3d3a6eb7c0ebad572d848ecb4053f1e2abc831988493745e08ebf5f15ff0c731ab59b454fb9ab23ff4740c3089e15a5558a0e852f4f056d15d4422ecac8e9c09b7c79966053a21ae029f8aebb06e2f916046c3d1bc7de8196f9e89528721f37c6a20a8b3f7a817c86b22a36da4169084550f49d2075a02c247bc357080e8f321ff729c4a93685f80b3e11138d09369f1aa0c0f1800641724f7f05eeacaa9fb2b2ba28ca5b994534b254151b2a91b2020c9058a753140ed487b2b82e0bf84b34ca37c7a9be6dc894be9d0250d23077d2fb7d78f1bbc6601e2002dd10d56f36af43a1a772237e45758b2d21a222201367010477f545501c3e9de7d418dab1804069b16141f7617d98fd4c9159e7ff7ff7419e65ade8e2ef79a3938c1561f210f71e8d89a6afd2d7a90295ec8491dd3dbcb44d12279c00d0909e8975f4e3f5bda72df7625a502045d64b85166c551fefdd387acda4a148c008793abc984950e4c861e434436295873376a42734cbbc6844b94877d1fa29d40b7659a07ad2badd53c200b9177a7d957bb7cca46627f207f764c59eabd9306f8b4163177bd9285c4b4eea4fa9e063811812deb69bc343d13ecbdcb60a7101e3dfdafc9f87db68eb9a7fb357a1698558ef8482574b114ca5d043e49da1c68077acc697511c2436729db303a4f9bfd74a91f0e3fd7c0c3ac087ea62614a601e69a8bd54914b5b3227af9cc40fb14bbc3af1f42368ec4c42a15ed7c2d079fb27c486b06f5824e748b094ca446217e5a129df25e1ef6af6171f881e3ec563ecc4d59d6afbb1273a1f518a40d634ddcc556d01370e8c6370830f195d1608e4c84946c7ca275270c2f5a692b0de6649b25b1d33e1c127709d886e0f85e5fdbd8c9adb68c135033c34d82f82fa558ec78ba54cd353b71da919e75f32ddd185e8667feaab4ffafb6f2e10b2a374de5bfeff7b4a50b43a11d282bc227250bb286a70bfe41811fa73de0de27a97e0d568f585f27e6a9104327ac9457130ea7351781609b27c6b48d95f5aa17ec5c76ca846d84b7983ead7abdf265bd68c3e73f4240000499a11f5d1aa27abec7341122dbde3a6521cfcd270bcdd0d34333ff46c62c55991c2a4ac5174e597766c959f6b8fe7c4bb8224b3bf2b545e1bac1242351edd45bf4ae203f2c4da2cc66229c5b0e8e1313961ca8b9ed3474e87538fb7cc792ee8930be90c266714f0c379cabf57ff4545e244145b813a6f41ede830168c4e2ca2d5c1c66ed68862ae808d9d0f8bad906343ddfdaeba951a7194e3d00c7c2ac85c36ea5dc8ab019fd68f8d2a402bd609ab5536316566508f1eeeea1e4182fc47c084c48b70d25b236784835685fe8a00f8f25bbd392e3e9a762734df58a6621f59fdf5c3327f0534a6983430a38acbf5ab84694910ae00516298e38b6618827648d7bbe70152850782a625778e1dd48882185b78c79095edf8eab74ff71c9ebfc7852d189c5a4c25c8a7b3e79795d5e81e491644fbf863c08b68b9513241320f5f70811a76d0e462c7fcceafb73cf4f528d7b02ee07ffeff9ab3b0c58b1011074bdaf6b65cd7f9066ffe23189f69173668d9882e51f972a9b64f9b3b9b38532709cc93b36c80688320d6b72c922d72f05681fba3b5d8cd9f81369fcb627277716601add9afd5f5b56cfbd4ba04e94880365d6df9ea2c1c84aeefeca33324f3205073205e83d6294635b09ec9848b345764f36585b2e070e492760a6854428a25db60b490c1756216c9f8218a6e1f32086c2d51ace0dc98ed94d97605b68cf14ae056d463457fdc1103050dc1e66417fdc1988cf6f9d4d44129f5f6e09ff88e936d9a2a56eca59e786890cb8db7eda1903d3117314b17239196f99127380facde9a9bb45e1e5a52043f512f26f979197e89e25a58c655f63f38543b42a3dc3df53ec2e8a6008aa6aaeb0df5c2f349f4b85967d7c92619b4063ba23e1884022e71c82b7d3580c5de0a2022e43ba62a2018e28cf0467398d4c79ecce9fa62b10bb8afa064fe957ab2f966e460647c4b54a9abc7cc3978821d433cbf8b8b867d1831144146791f51410d4827baacfb3369390295877cdfbe456a331ee1b555d2b8d72d25bad45c3a431e641f141af401d3ee68b95e624b5690d4abadc82e0699e88e3e578b1a58e17b6e7c2103b6308c969da016873ac9950efbffee234f44e3abd8828523fdc854f73cc6ad4c7bde2af98686c85863842a40149f9c7023341a0cfb8e32f549b0504bca2aca2934b20305576304e4c40d1eacb49d23dc953e7bf0625545ca5cab4b5d79e65dcbc95f7864bf0e9a3aaf3695789f94a35deddf9108bb3d867f7323723e7dadee8ad5ae59ea4dbade70782de4866973da74177cd93a7f8864a7671657fa9cc46c7ba13757a6338f60ce447e94794dad17aaeb758e52a083a27e291071898c4260d82af59eb3810a9c70987292fbf75ce46355e44e5a73069549f4fc48416641eb4b74e3c8c20e5828c870ac29dac45503eb768c6c7239ef16930e38400cfdd07f68cd184f191eebac50754674662a5e69c537db24ace610c0750b10f2dc44ab9eb7a8db793b10cbe80bd5de39388ab2d116a0be684fd5e73b5919d9e7410a0dc026de4366227829e0ded625493de0a3a1d0e0c1a44ee5ae38682943e930b0baaae5c2fa5679b1fae23bc331808c876edd3e6bc2ee0cd15a38f02655d50de02f5f3115da812245ed54b8cb8a4604d5763e16c2e55a3885e86f3d8ed380e9c6baa2006d919657c462e3bc6dbd0d9732f000af1f7d744ce4f57706cece253e655ba2da9d346946ac075a6ba442c577c42f80795c2c240f7bac88d1f05d519d1b1a401f0a7f05673dfff7dcbc8cd10fdf322be6ad25ee8072afbc265eea5e2341a9b56867c2e1161e01bb4f0b90558449bc5b0bee4a30812d5f32266fc78881af521815c06a445eaf7b973c54c9565d0f628c530d7b9350683685bc681021589da9c7eb0ba19156b88e469da4706abbecb7d6ef2d772bf461cfb4fa37b8a1b8b901a758016c5741effc367232bf52e42f9edefa2aa5a62efb371ddf041829bc5234ba581c96bc749299b29c755195e9ad7c9f83652fe67cb078e39e691bd6112ea0a073c9c6eab29c8acc334aad803586ea96383fe981f8ad092d4068b81a867d90bcc90f98e1345a7f30273c6446c4d209b890ba2e3d25843387ce8e17804225b3ba5628b61771ca5a1c00ffd5e4ba10f68e589ce3ba84efa1a65ef214866dd44caecc1d04cb220fd27d01a4f264acd05953a1ddf6158199c080e45f7c19e2c6a99485008cfeb18bcad0ca9802c37fdd94b56efa0fc5b86445c48b399d0bbc9ffbad0137d63ea2a990fff56892ebe6aea1943e777814cb46ce2154d6e47c678b6c1fa3077d904ae00d1f2a41ab1fcb1623c6de3325193d52b0714283249b9690cd5686d5a3e1b6f9e342f3bd3e51b36f234b5b1785e6915ccdf3cc755d939ff66ea37ec7cc525fa69057b9c4b258b6b4cf7080346d15d060d4f2f67734dd30ef31cf5933956332f28f44f171e844a2f45acf288cfda4b38f936f577d127227f4323acd6a3b508312d9ec5259d51b55b964c97c3c82ee9c593998abd47fbeab75b3f6fce9323a7ee7d35e131b00abb95dd4fccd499251b01887d94ccfca31c9077333f0d6463cc189f42b252724f4dd124722f1b2249c7a5d139cc028ea9fde991eb3bfeeff7602b75c2181170aadeaefcbe15b262556b05166b65de0c7b52d8f630afc00598e32cd011d2ce52c68c524e7770eee37febea912338ff2c92dce1d2f3986497884c8b9e9edc50cd982aaf81d21640168f449ec7f9fab03df96ef5c360e56fca9dc9e1fa36b973de0198057cc5dd1f5f3c0b32f5a8b8e71656b12b85b2871ed8bae04cc974724b5ca190ccfcd2bf9ffd9c35e6a106f49099aa597d7afb3ebbe4872374d4230e4a912fb1fa494b5a0fd51b801fbf678556e30e64af559d7924326358b26256de25854b444950bec35e66a2ae7871413c6cc3686284a199e0b662bc7ab2f48af16b0168f04d3c003ee1f136bc1f511c2ba3ca8671a91cc9d4ba7c99566d57a149b950da4b0d428774fa2a88466a45eba14959e7781379d98ff5ff2486683cf675b5044748586e205e8f215da27f34ee67da9ff0e2f6fb86c779bece88a8879dccc91b5490b62d29d34960f30e80d7e752663179622a5a61e583a3f0b9dd9ec75083defc54491f17486ce1175226d41f8417cb947a4ec7770644e863da0c14f85cd3a903181357e3a5b9706c901b53dd9cb495060aad92653019de090bd42ac042d875b4d14bb220aca71a5dacf05400fa5413db2f28d47127d6c4fb15e9253af3c08c6e69b1a66da0cff59f69660181ce5173585a47565641fcb499d1d77cc0584af10d97b8319412a090bde573f9ea02c28223d83360e8e6d2970967e9ae1641c8f58fd207e5a49d9cd9665ee9f6d25e91b53b81963cb246082dd266b390272d6144058d555336be192b0a260ed5c1b3625810e7bf9bad3db2e2fd7641c1e730ea29edd207692aa1e9c3867469d253a04b63193e22a16928b330c11e8452fff8d30100285ed8701457e90f05c03904955d0f31c55a89bee75df5d4442248b6edd6ee47f6b8c63865e9b4c44e7b3f5df7796685f4fb16f0584d31bcf83eba203e5a4ccfb58c7fb8a556a91297d3ce158080c1d4baa4bc97907734d43f97271d74c855abd0abfeb1808702d03e0b91de121a273d89ef742d7c797ae5ec32da73dd1af30415572a15f63f98ea8072ee6160f1e54a8b02a360500737b422b996f83493f2342e118ecae8bbfe17192751237d24c76a2f37956ed8d0003218c140d4f7d3ecf984e254f010bcbadc4ae7f4cc93e0d9a69a2eef33ed10d5a5cd1a99d72cb4db585e23bfca8f2ee9af0cd75dfd8b0b609b86eed13dd51e8319e3cc0b2c0d0115be1680ba1663434b772b546ff43952ba891392285866137c6f7732b6beb999a4479a238ad83e18bba8537900b0817dd7c13ef24f9db214b84d6cd618fc2702cdf73c2214ea39b930404dd0160c866fd3beea1ffe653c594752f0269b2ea95f7d262dc9cbf504818e970b13a6ab35306cdffaa812f4f678eadcec52f3eea1cb1d3f50e1d329d6ece61af1300077386210fda1b7cc5a2fd44894ceab432139d6b6c6963d3340177a54d4a486ba815c587f216d0292b691bdb703f04e5244f4098"}, @ra={0x5, 0x2, 0x8}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, [], 0x26}}, @hao={0xc9, 0x10, @private0={0xfc, 0x0, [], 0x1}}, @pad1]}, @fragment={0x2c, 0x0, 0x1, 0x1, 0x0, 0x2, 0x64}, @routing={0x29, 0xc, 0x0, 0x5, 0x0, [@mcast2, @private2, @mcast2, @empty, @private1={0xfc, 0x1, [], 0x1}, @dev={0xfe, 0x80, [], 0x40}]}, @routing={0x0, 0x2, 0x0, 0x5, 0x0, [@ipv4={[], [], @multicast1}]}, @fragment={0x3a, 0x0, 0x2, 0x0, 0x0, 0x19, 0x65}, @routing={0x5c, 0x6, 0x2, 0x79, 0x0, [@private2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback]}], "3ca848213885388b0d078eebb4d39481ba0eb581841122a67d22b6718a9ee49ab504ed17521d68a216071b0c8e6d0689cc0c3a1fbbb617b42d4c3b75c5e947bdb943f49b1f44fcd5bb4134da48df50f822c745f1b470d108fe311bfa9b44bac629e202a197f419e6af13ed685afc71f9229195f0cef7974024c23192c31f174a0cf49309bf306c51a89f5529b3d4188e9de6ab47deaba7a38db6c3eeae09da354bf964d9abbc189a94353bcd95d609a3f981f8e4f23f266cdbab5f74736eaccf824312efc6a18bfb6e05fd774d023094802eb4cfb46e298b9e5f2000a8f8ef8b26b36ca6d48329cd3e3ee80e8f1b5b33494f9519a10938e262af6163984df8fd9e7e4ca2ff01b65fb8fa6cc0eb2a94bc9f45c0269e4c755c84e929d96f8aa1f6117d7fe261f8d344f521be4a758e7be5fb7e6aea5241be67896accaf81be706f3bb6a232f11e92b3747d94545e359b82286c97fb681fef7e050aa9c28716a480370de4f7c4aa7fef3a9ca0ea5c4b58bbcd9c6924b1720f95ac521032f1a7e7262c352f005c375a6a742539d7e00e6783f321b91afbd500957d12ba3199f2d8feb3ec27437af06701f7f0a3a9e6478b7f663e61179d1fcacc240301903660128429cafa47ca082de39dfaf33c60240b1c194cde017a005d7cc6d8d660fd668ddf6d7c97bc83dda5f2c18b0a084ec9369972c28e907148c75dfe4027fa69b2c713ec1fa76b9e1ef0a570cac8733dbe32c8444090674cbf74136a41ad7e230acbeac0b9f076e13cd6f62b9c60838c3aff9391a6f521a22395acf8d0f866ef61d787e6e977e2e9131de768b53c223353f1032243722b4619280a3faaae39b18ac9d72b718ecf80a1abfc8593f65d961c985f8fed8e6809e751fd12f10e2a8840e60dbfbbb4bc411915269cc75f9f9ff830b3326655eab674ec87b6b09bfec027cb21c6e8bdd95ff8aabbd7b1ec0210eaebfac5f9dedbb44cf8663312ea3feea10eb56268dff80bb6057ae0126c5c8da8593416bebac83e614851a5ce8cb65b786f1711ac559d32e651061b1b01893415f52bc619c476672b8133a8847ab81128ff8293d69b3a4d89e35c92390ebcd07356c095e4039aabc58acc50cf3f3ce2e98eb50c562f5709d8bbe21868b9fa80549e4c197589a5e50ac774564b9d097b7bc62647fd4cc9a4cbf1d4eae1df88814b9421d77c0318eb22f58096c919d4702c5090826ee6712dfc78e104ab6a9a644547691deb972c1cf6fd30e6af6d66e83712a9dc0ecff060dc2b461ed03b83b80326e28b2aa507fdff819e916976e05d10676c6ad5994708492860054b04f9335ba9f48e5de325f94e76b0c680747419b46a2208aaf1a286333c3303d3fc468b465cdc52cc8c916b1b4cb1cdf1445e0374ce866a45be170099ccbd77dfa56cc4c3fb6338cac75173337bcf18d64c9a7c0d13a818ee5c3e66cf2d78234c2e60009ca865c1f4ed39591756076094c9451ce3f87f8a902bcea2d9a827c6430b9f60ed06a701eb58aa57665481baefc8b6610e340cc8b0320c838bfd88006053ebd3b21538e8d68ebe126c29ef1511dc493a495e81417ee8a136dbc7664a5f3d5693a3f594d012d63331a110e322b22a8ea42f3007220e627868f2ed29cd4632f9a0e7cba44fd2307213f688241717362be5908a0dcb020c8f1a1be6e953cd8baa344f1389afdc00df603153670bb484b583fd33d4651c2d64c6a44bfc43bdde0a91b114f90f9713fa8ad7314e2511fd848771541c970688cdaa8041e8782c90e356342800ecbf30758bec21826d12de669490e4c14bf5a427491eef538005d95d846808d9a2f6ca118b5f36608a0e8b1d020e520bcea1edf9f05f923719ccf057ed76170e3d45596a30ea2a4ef652fa6717cf04175457898a90a96c709dbc79fdcc5639fa258d27993804bea60d7b196414d235a80e8410db47f5c9bc2923ceadbc910af46544189466c1a71836899b1f40225801eb006adf0bec83294cdbacaae3437c497dabb34783306743746a4fae75660d12a29c9cd53d05ca7306f69fb87679b2628acf1bf7b1109c7db36ca2fcd684df95f8964e2ddcd9125812764ee8fbca6751c0fd48495ac4d431abb023c642a35bf108df8773d7b61e4f1e6094b688ad54df473c0e86cd2c1ed251ef0deef4bea092d6860739beb34d26cd720b11c23d84731e2f1b9d75c0ceb5d3f579f212ef8a108393995045c7933933875416645feba4d75a3258143c115f285d2bf4cbbbfc8253fb5c5904fca7a12d9bbfbe2b12333de21ca8fcbd0c788546ea57f60bdfff52e882cc8d69667ce1f23cdc1901bc38f69dfcbd6af39efd2950f368eb90b41094849113ba6d0fe86e5c4229fc0c47ca59ed44aac146606e3e1915910db8174f45faafb837d380b968a3c75523608a9ff5e8305aaf4167f4df85e240da01d5fbf3e0737051d37977e6ddf1c3369fcb19b0a8cec97fcfecbc340a3c05f2182bd28a5f2375b13c47eea278deaac3ad0e48abc339519a6a60da3567558c794713bb1fe254cc29a2b41572a0dd9a413e0747506fd665676a111a58da52288f0ff512ea8f4b94e241c0bc1173b1000aa426e99aa7968e23277615b84b310cdc88b87b82ab6028ddd856258a8cb9418129f4bbe9418470e746257f15b30b02534f0fd47e328643f21aad5ff98a2047dc5e13b9a248b29457eda0c607ef7e59de2853c806978af5adc985d616f6414a5562a8c34edadefc44a5985ddec056a941cc115f1eb176ce3b6bb2d10cfb93125e64f21275d22149f13b9126c6e3bd2c6af59633ae7af80ca2a50a231d03538ffc6b0bc96138f907d7127b92ad7079100458f8cd04b013aed56c52160910b6e7e83595754f35136bf8e1a38b620cc88c1f2abb20eb48600e8fa035d3e12c060d02f3f97545effd4c7d393e32c9de42da70c61d9d3fe6bd0442417d6a2dce293b23597646d3e7d895efa716f268c2967742aeff17f27a2e0a65d945c63418dfe8948adc98c3bfb9e7f609f729777999a8353fc987927048bd2f9b944b4d87bf1dc490d482f3ae4e23b8b3e96233ee03125acbe9243d35e203d91f80d9fa8e4495bd3d14f8a061c9e20aeadae5ff73213616105f2a164a363700414d398b7a7f15d454ff4e423a5a738c47e43818f752891d3d6344faf79eafb257b7731903c0d62e262d8cd0aa3763ff41a23474106b3f1fb17ca04ef34bb475e6fbe9eeef99751d4b2251bb485bd5f436db912f1ea2c4a0ff85da70ffee4a3e799a0c2e2a62ebedaacab1091ba30f50f6951559c36ce10fd7efed55b85f4f1ff7b0250fbaa279793cdfce460eb03dd32ffeb2746ad31b544f2c00a6f65d89d13795b86a476c5a2551f7abdb2bcbc975c5b47a2d89a55930a745fc7a178be289aa1f69c95513dbe63d8719f669d5b02741b5ec26a0af4e2dbaa3be123f423165796ffad6e4ef0eb780b584ccd4c3052a503438242c9b201d76b996a3008aa6bb600f6572b9b5a25f0acc496c9bbb1e7e26c063ed977cd365e4287e81c87d4c8e39a6ddc2383e2fe831f7058cad8cf69c521ebf62975d9eff82ef34245ba0e52c8518b82ab65bc0a1c874ca7a2cef8f590d43d9aa4598db412eab410331179640a708e78cc33000289211faad9248e085cf9f61f0eb57cce084de782b022846b55a1ab218ad53684c1ba150254ec037629b8a5e9589caa6d1710ae47f59bd86a9264507c22b52bc51e9c57c36b961566b75c2f7c532d48b85e071e2f33c3a5a6aaa9995a73496a74d2a1d8bec7863091cc8dce8480c2f84a104dbc700b46d18f1a5abe3bb4fdbd3a8a40176a6ead432d87b6cd8bd6c5c32bcb798a8fefbdf29df7016695104152faafa0e7c565ce780b0b38987df0b61ebe229915eb9b558eab912710eeaacb5416439671c2ccfec36ff779cd9ccc64b99fbd155343b6eb165151c2c194da72c1bdc137a8f95ee3eabcf076b172c4bec71d100f28b15b164f0d1a747cf542a5b6d2f417ded7b5da5a4dd24df20dedf4c4e3e8cd60cf24b42fb383d42b865b0c285f30e11ae2362652787578f8ec383ec721ac9bbef437003361d5d85784d2ffee8f2f4c3c52dda2eb1bd85b8752564f0f2bbd6c3357b25049fcf0581f122281ec2364f917bfe964c8a51ffbff3591315a57f3c1772434cc88300cdedeca2ea85a9c180d321d5b1f24147ef57204e8f6b2f22d4a4a86d0473a5696d34d61f29c68283b36274d3cac454ef93ea44f2f65e45d7eff78994e13f712bcf1d53dcf3e64828694388c78f66802b6ffe98ae9afae2fb07f8795b6f0052af6f7272bebcd50219b0562209ff74dbb64a555145e9c84a9195aa1e901f95fa0bde6cddd0e2ee4c7b9d495f26d0cfe216910a3466d1fdc05258bffeb6f9aa33de8402a2581d0e3480359263ba7e41de4e56fda550c24ec208e242350ac34791ac9f10b9441f448d3b8e94361c33005c4361372fbee60a40179d36c6f744706f59c56c453856651884cdd070c8c4058a6f6f6771dc79f5ff4614c7bc7d26dc01e56bb2d7a0ac7c62c0218d3cc104832a1e8b2b83756d90571bcb65527b93389c688cf6194ca04bbc18e751db61ce5bdf1b2b65fa09f3b54b62f59656b00e252ffe88299179889eac6ff47be302f7eb5b3908b7655f0b77884d0431433d35a75725d753bae88a6da386fd7e9f632fa2d9ce1b472fdf1bee92b9b258541de828544bcdb3a6565a187245a012017a779f45ad95654be932cdd1750dfc02157ebb89f488a0f5e11b1261fab974eccea32faaab7b5dce69a3b60906d66aced26be457fb7a704b4d7cdd2ad68372d723486f169918b73d053190158e2e1aa9e78024d1048a308b591a533981948ab1249ce94e9339e54b2485a4a3a55adac3bc0abf3ec7b228cc229fffe80d57c3ea1fe24d645974fa765b8d1e962b7c10d1adc43aa087a40378b27456824cde90922caa44f52120021c7e3c920793dc1dcd00666e2be49d1c882228b5eb9af47094ecfc99772ebe7c82a58e2e1de98667be2fca7bec2927f45a4fe5b53808202607f52f77ee477cf7a14953b990772ba5eba3d7d50b4702f26759a69d71451c262c1fe23d18e73611a59db4a0f0623c29a6e3bae9ca14cae8423fd07af63bb896c4917bfee6f8f3214e8fdbfd0e68f233cf5ccff5df191dee1c8a3ea6d0ba5cf874cd46479aa150ccb53415c76fc081a102f7b8427af506f58720f47d0cb3d78d407ab7623a630ebf975c56daa591419341abced0c8d295db3e6833ba25d937bd9541fee80d95c457788f706208cb4f8ccdae6674fa046a2e3f95a01a5a25c0b32d04ad217e02bfd3c25ebcb56d2082a587d79d199eba8d653b72e35516d4644de59206f0dd9a4c0ef9011727fcff62b1edbac9fd7ee2e0961c2e21f1ef3f76c329c3b3f49a7754aa6ac7e03dd0046d72a19a2dcbdf7b3e9644419410d278c90607baffb6f137adfdfc5b0ef10066dc72d73b44113ca011c88b2e3b600fe5dd202b9ece1623d2cc30484eb658c8fa6cfcd3f939d324be4bae09d8fc7e840ce79297fffea8c3fb614dcd3779d0608212b1155cf69a936755f722104c880c0fd2821c7a96fdf0105b52dfb9edc5f31aafdaa2bf354057c30304a0b26fb8d55f052e61e4db787b43306445e21f3cc0fb430590012555e4880510a4f56d9b388b3e27b0161d7d0d13bba7337025b5a9883f699aad287f2609334a2ddcb2f63702aa34c924c0ebadd7a0d989c01787fa71af2709ef5145b890c318319901003453c34cd0cf082d57f3dd56f1a94db71c6c504770ee"}}}, 0x226c)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r3, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r3, 0x0)
r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000f00)='NLBL_UNLBL\x00')
sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xec, r4, 0x1, 0x70bd26, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:setrans_initrc_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_batadv\x00'}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x29, 0x7, 'system_u:object_r:hald_acl_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team_slave_1\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x16}}, @NLBL_UNLABEL_A_IFACE={0x14}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x42}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}]}, 0xec}, 0x1, 0x0, 0x0, 0x50000091}, 0x24000890)
sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00012abd7000060053c400d3d73102dbdf25070000001400060076657468305f746f5f626174616476002800070073797374656f5f753a6f626a6563745f723a736f756e645f6465766963655f743a73300014000300fe8000000000000000000000000000bb149058000300fe8000000000000068bfee59cdf581cfd11e674450fd993a5d983d291479c171058c5004b82d6aef088da623d584faaff3d43f5fd8b0b1a49a74a8f0cab9474a00896f8c1cc735e843a273c2af21df2b14b3262132"], 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40)
sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000340)={0x84, r4, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:zero_device_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast2}]}, 0x84}, 0x1, 0x0, 0x0, 0x8}, 0x48081)
sendmsg$NLBL_UNLABEL_C_STATICADD(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, r4, 0xb04, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x40001)

13:12:39 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x4, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0xb, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:39 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x5, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0xf, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3113.978804][   T29] audit: type=1800 audit(1596805959.661:2988): pid=16858 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15895 res=0
[ 3114.003212][T16867] device bridge5 entered promiscuous mode
[ 3114.024337][T16867] device vlan0 entered promiscuous mode
13:12:39 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x6, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3114.083824][T16867] device bridge5 left promiscuous mode
[ 3114.095171][T16867] device vlan0 left promiscuous mode
13:12:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x5c, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3114.227765][   T29] audit: type=1804 audit(1596805959.801:2989): pid=16858 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1495/cgroup.controllers" dev="sda1" ino=15895 res=1
13:12:40 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x7, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3114.417672][T16864] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3114.500212][T16864] device ipvlan1478 entered promiscuous mode
13:12:40 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d330}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3114.722524][T16902] bridge5: port 1(vlan0) entered disabled state
[ 3115.657721][   T29] audit: type=1800 audit(1596805961.312:2990): pid=16917 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15902 res=0
[ 3115.747037][   T29] audit: type=1804 audit(1596805961.402:2991): pid=16917 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1496/cgroup.controllers" dev="sda1" ino=15902 res=1
[ 3116.213636][T16912] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3116.253197][T16912] device ipvlan1479 entered promiscuous mode
[ 3116.291454][T16923] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3116.325815][T16923] device ipvlan1480 entered promiscuous mode
13:12:42 executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
socket$pppl2tp(0x18, 0x1, 0x1)
connect$netrom(0xffffffffffffffff, 0x0, 0x0)
sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c00000007000000fce934195cacd9e053e6810005000100070000002f09260a8ad78673655e7503d017cdc60f226e977ba3b0c4c0b597fbd646a390be5e68d7e17c1197be81cd41de2edb9fd451c32c44e9c2328466cd761be954056c2bd5bf4ed88721ab73c76f646119ff47855b101b05ecfb5a39d968a4dd9bcc22b834c7786ca4599fdb92459bcc07568a00"/152], 0x1c}}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg(0xffffffffffffffff, 0x0, 0x0)
recvfrom$phonet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000100), 0x0)
ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4})
sendfile(r2, r1, 0x0, 0x100000001)

[ 3116.748326][   T29] audit: type=1804 audit(1596805962.402:2992): pid=16933 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1706/cgroup.controllers" dev="sda1" ino=15854 res=1
13:12:49 executing program 4:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
r1 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
getsockopt$sock_int(r1, 0x1, 0x21, &(0x7f0000000000), &(0x7f0000000080)=0x4)
write$binfmt_script(0xffffffffffffffff, 0x0, 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)

13:12:49 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0xb, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:49 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x70, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:49 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d331}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:49 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f00000000c0)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x11, 0x1a001000000}, [@ldst={0x5, 0x5, 0x5, 0x0, 0xf001}]}, &(0x7f0000000040)='syzkaller\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x1000}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r1, r0, 0x0, 0x100000002)
r2 = openat$cgroup_ro(r0, &(0x7f0000000140)='hugetlb.2MB.limit_in_bytes\x00', 0xb00000000065808, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r3, r2, 0x0, 0x100000002)
sendto$isdn(r2, &(0x7f0000000080)={0x80000000, 0x9, "ca61c28607a368e9b18d0d15376ac893"}, 0x18, 0x8000, &(0x7f0000000100)={0x22, 0x2, 0xf9, 0x0, 0x9}, 0x6)

13:12:49 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @multicast1}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040))

[ 3123.456016][T16944] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3123.469761][T16944] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3123.488955][T16944] rdma_rxe: rxe_register_device failed with error -23
13:12:49 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0xf, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:49 executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='htcp\x00', 0xfd6b)
connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c)
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000740)='cgroup.stat\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0x5cc4bb59)
mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x300000a, 0x2012, r1, 0x0)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000280)='mptcp_pm\x00')
socket(0x0, 0x0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0)
sendto$inet6(r0, &(0x7f0000000200)='\n', 0x1, 0x0, 0x0, 0x0)

[ 3123.510711][T16953] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3123.516177][T16944] rdma_rxe: failed to add lo
13:12:49 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0xfc, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3123.646896][T16953] device ipvlan1481 entered promiscuous mode
[ 3123.662689][T16963] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
13:12:49 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x5c, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3123.701291][T16964] rdma_rxe: rxe_register_device failed with error -23
[ 3123.737913][T16963] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3123.766828][T16964] rdma_rxe: failed to add lo
[ 3123.776565][   T29] audit: type=1800 audit(1596805969.442:2993): pid=16953 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15894 res=0
13:12:49 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x70, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:49 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0xff, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3123.853001][T16974] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3123.869704][   T29] audit: type=1804 audit(1596805969.542:2994): pid=16953 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1497/cgroup.controllers" dev="sda1" ino=15894 res=1
13:12:49 executing program 4:
unshare(0x40000000)
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300)='batadv\x00')
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000240), 0xc, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="68ce26bd7000fbdbdf250900000005002dbc40c215acaeb9000100000008003b00715f6b6508003b0011080000051be20000000000db1eb68a5a80a66ce03b9b32cef3b20500000000000000a07c09b0fccb17d1498eff4182bf165b1a75b91e3150c7f0acaeb62a349e81ae9db8e70343392fbc6f354c75e000"/133], 0x34}}, 0x80000)
sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x44, r0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffff}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
socket$inet(0x10, 0x0, 0x0)
pipe(&(0x7f00000004c0)={<r1=>0xffffffffffffffff})
socket$netlink(0x10, 0x3, 0xf)
socket$netlink(0x10, 0x3, 0x10)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000000)='TIPCv2\x00')
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x4e24, @loopback}, 0x10)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f0000000100)={0x6, @rand_addr=0x64010100, 0x4e23, 0x1, 'sed\x00', 0x20, 0x1, 0x7}, 0x2c)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$wireguard(&(0x7f0000000440)='wireguard\x00')
pipe(&(0x7f00000004c0))
r3 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x4004800)

[ 3123.979907][T16974] device ipvlan1482 entered promiscuous mode
13:12:49 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x54}}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:49 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d332}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3124.110856][T16983] IPVS: ftp: loaded support on port[0] = 21
13:12:49 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0xfc, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:50 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0xff, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3124.884473][T16986] IPVS: ftp: loaded support on port[0] = 21
[ 3125.040697][T16995] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3125.124830][   T29] audit: type=1800 audit(1596805970.793:2995): pid=16993 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15885 res=0
[ 3125.127503][T16995] device ipvlan1483 entered promiscuous mode
[ 3125.199172][T16983] lo speed is unknown, defaulting to 1000
[ 3125.213033][T16995] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3125.337063][T16995] device ipvlan1484 entered promiscuous mode
[ 3125.753291][T16986] lo speed is unknown, defaulting to 1000
[ 3126.276564][T16172] tipc: TX() has been purged, node left!
13:12:54 executing program 3:
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r0 = socket$netlink(0x10, 0x3, 0x9)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000200), 0x8)
getsockopt$PNPIPE_IFINDEX(r3, 0x113, 0x2, &(0x7f0000000240), &(0x7f0000000280)=0x4)
ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000180)={0x6, &(0x7f0000000140)=[{0x9, 0x5, 0x9, 0x5d17}, {0x1f, 0x6, 0x3}, {0x6, 0x50, 0xff, 0x7}, {0x5, 0x1f, 0xf2, 0x9}, {0x2, 0x8, 0x0, 0x80000001}, {0x6c4a, 0x0, 0x0, 0x56d9}]})
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r4, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r4, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r6, r5, 0x0, 0x100000002)
read$alg(r5, &(0x7f00000001c0)=""/27, 0x1b)
connect$netlink(r4, &(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbfb, 0x40}, 0xc)
ioctl$sock_inet_SIOCSIFADDR(r0, 0x8914, &(0x7f0000000040)={'veth1_to_bridge\x00', {0x7, 0x0, @empty}})
write$tun(0xffffffffffffffff, &(0x7f0000000080)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x0, [0x0]}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6c)

13:12:54 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x70}}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:54 executing program 0:
unshare(0x40000000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x10, 0x0, 0x0)
splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
pipe(0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r3, r2, 0x0, 0x100000002)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f0000000040)=0xf, 0x4)
sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0xe4, 0x2, 0x9, 0x401, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFCTH_TUPLE={0x80, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x9}}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x3ff}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1a}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40}, 0x8001)
sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000000)={r4})
sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000800)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb, 0x1, 'geneve\x00'}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback={0x5}}]}}}, @IFLA_MASTER={0x8}]}, 0x50}}, 0x0)

13:12:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x54}}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:54 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d333}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:12:54 executing program 4:
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001c00)=ANY=[@ANYBLOB="640000001000055500000008520000af00000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008000a002e0000003c0012000c00010069703667726500002c00020014000600149ef0e1be118746bbbf83fb842f55121400070032"], 0x64}}, 0x0)
r0 = socket(0x10, 0x80002, 0x0)
sendmmsg$alg(r0, &(0x7f0000000140)=[{0x6, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100)}], 0x492492492492805, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r1, 0x0)
sendmmsg$alg(r1, &(0x7f0000000800)=[{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)="352586f335a2b70db334f7fdbffe0c01d3cab99094f8ad0944cf55d3a604e330c1e3a6d06376bf4125ea624ad2b6c74193237b7b092ed2dd1736e0081da68b3aebe4a5c8166ca473da4f0df4132068c05beefa9ea38daca341e52e2ba3457a208330dc06beaef4a80ba6e0644c01249617b4042a38abaeb46478dd5ce9aa3d6ef7c2ffb36b2f7220101040946ffc85d8d85c5637cfc169b6878962f2e88af635c7d53323ed3fa15e1281549ecc624d0ac07a6c8c9c2a5b4996a483f9ec7886df8bfe92457455422a3eb6c95f852d9c0007d42a8903f8c2bc542ea7fbf980880b7cb2c40c7e3076ad2c733fd1b9fc250216275775d2", 0xf5}, {&(0x7f0000000280)="e408ccd2d3b392fbaf11c1e88d891c52859bb0e640e76856e72041cc9ac957f01335750f1e6cd6355efef40849e77b9c45622f94842560bb7dde75bb4245529483956518c358f947e0587fab4a64ded47486ee6390480b7ad64bc1a0009821ae339d804e77702f9374e4d83ce5c6fe33c1cad340337030e18937204b4ba3f49f3a3b67814a61ade798c433c52ebfb5ed50e6fa25d16dfbb56ec4da5e0ae345f6a5100e7959fb2415ddadda7de142046d979a274972fd29283315dd88cac4a65ead28cb6b1865242fd223b58a49dd13b72a8c793aa96674f786237d43c0ece5c459d09defc1afa49c5313d3597d9c2413198f9b46df29f0c839a1e4d9a9", 0xfd}, {&(0x7f0000000380)="80afdfa81888e8e20767e400297d0d36361203a337dca6145ded49c7d394e8f1372209ded00e5624be947f5c00ed4955042fe49dde0be48b8f27016b71e1af58bd5f9dcfc8a5ee0643c9583b1dab8f256fbda941fee9d3ce92fb9e1f90029ef9839f2d0d9f463e41a05c3ef6", 0x6c}, {&(0x7f0000000400)="d5e32b9a3f4d8472025d2e756d3593cf4302169d794517a1f1c42f0784c20be419899d86393711a2400b133f3cf4019dcc2431ef17cb5ca8e69a138cf1caae571f45b3052299c1bc7f03d84b7d0a8de64653c6c6ca8fec1eac590f1b9c37be6db1048e8d176c3dfb3ce3d74dee36f892782f08e863e4e7d46cb985d7e873320cf6d49a640deb46887cf8aa4ba21be753ac9d7b8183d0d65fb89e6cc5d1194ae2f3edd54dab0b", 0xa6}], 0x4, &(0x7f0000000500), 0x0, 0xc040}, {0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000540)="bf27a801828e0b6d0e5df8e81d8254c2a99e83ac2b", 0x15}, {&(0x7f00000005c0)="17613e5333809be88fdbccfd3056cceea8052d9b3f2b6afda8732d3c907df591e582e054e42ca9ac54249433866df4089c2562e128d8c09aa8ba0b593ab8ac23b9d0015236be54b03015a532aa229fa5d21ed039ea49c914a068afefb64991315882988abf89a0", 0x67}, {&(0x7f0000000640)="5313948060d7d77e315bb48d8aec5d8abcc6", 0x12}, {&(0x7f0000000680)="c9553164dc14314408c0a8102607f93bbfcea7e4795b673f2c5da7ed6b0fd8781a249300169c7caeebe6e35f2a2dbad0e09c423094e4e1ccb829b207e313be09105c6529d3272ce52054eb46c4c5f481f9fe93cd7bf58f96bfa98f1cb84065102f9565cc12fe3e5f3f3cf13054f4b55690b541558f33f3aa02da18f745f0433eaf096271cb429b1e79d6c32d1ef20a070f3050", 0x93}, {&(0x7f0000000740)="dd047c540f8aaba548deb4d0af6d129c68a87733de8631dfc7599ca542702a1bb7c0929e8c469e12567b4a2c5a", 0x2d}], 0x5, 0x0, 0x0, 0x404c090}], 0x2, 0x4000c90)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r3, r2, 0x0, 0x100000002)
sendmsg$AUDIT_GET(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x400, 0x70bd2b, 0x25dfdbfb, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x90}, 0x64000004)

[ 3128.698654][T17067] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3128.734198][T17068] IPVS: ftp: loaded support on port[0] = 21
13:12:54 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x14, 0x54}}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:12:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x70}}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3128.850015][T17067] device ipvlan1485 entered promiscuous mode
[ 3128.871037][   T29] audit: type=1804 audit(1596805974.543:2996): pid=17074 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir737268182/syzkaller.QFVM5g/36/cgroup.controllers" dev="sda1" ino=15932 res=1
13:12:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x14, 0x54}}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3128.978910][   T29] audit: type=1804 audit(1596805974.573:2997): pid=17080 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir327749771/syzkaller.if7ufm/1374/cgroup.controllers" dev="sda1" ino=15935 res=1
13:12:54 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x14, 0x70}}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3129.086559][T17068] lo speed is unknown, defaulting to 1000
[ 3129.093854][T17089] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:12:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x14, 0x70}}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3129.237329][   T29] audit: type=1800 audit(1596805974.623:2998): pid=17067 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15934 res=0
[ 3129.261891][T17089] device ipvlan1486 entered promiscuous mode
13:12:55 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x2, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3129.306891][   T29] audit: type=1804 audit(1596805974.723:2999): pid=17067 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1499/cgroup.controllers" dev="sda1" ino=15934 res=1
[ 3129.600380][   T29] audit: type=1804 audit(1596805975.273:3000): pid=17090 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir327749771/syzkaller.if7ufm/1374/cgroup.controllers" dev="sda1" ino=15935 res=1
[ 3129.612273][T17073] device geneve4 entered promiscuous mode
[ 3129.764231][T17073] IPVS: ftp: loaded support on port[0] = 21
[ 3129.962097][   T29] audit: type=1804 audit(1596805975.633:3001): pid=17079 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir737268182/syzkaller.QFVM5g/36/cgroup.controllers" dev="sda1" ino=15932 res=1
[ 3130.015252][   T29] audit: type=1804 audit(1596805975.643:3002): pid=17112 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir737268182/syzkaller.QFVM5g/36/cgroup.controllers" dev="sda1" ino=15932 res=1
13:12:55 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000467000/0x2000)=nil, 0x2000, 0xa, 0x31, r2, 0x6000)
write$tun(r2, &(0x7f0000000140)={@val={0x2}, @val={0x3, 0xe53ba6995284e6ec, 0x800, 0xfdff, 0x7fff, 0x5}, @arp=@generic={0x321, 0x88ca, 0x6, 0x7, 0xa, @random="95d29a3ce019", "f17ab16d9d0789", @broadcast}}, 0x29)

13:12:55 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d334}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3131.118913][   T29] audit: type=1800 audit(1596805976.793:3003): pid=17135 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15943 res=0
[ 3131.232384][   T29] audit: type=1804 audit(1596805976.893:3004): pid=17135 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1500/cgroup.controllers" dev="sda1" ino=15943 res=1
[ 3131.336473][T17131] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3131.371445][T17131] device ipvlan1487 entered promiscuous mode
[ 3131.606014][T17140] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3131.633915][T17140] device ipvlan1488 entered promiscuous mode
[ 3131.670423][   T29] audit: type=1800 audit(1596805977.343:3005): pid=17136 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="cgroup.controllers" dev="sda1" ino=15942 res=0
13:13:00 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:00 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x2, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:00 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x5d335}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:00 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r5, r4, 0x0, 0x100000002)
bind$unix(r4, &(0x7f0000000380)=@abs={0x1, 0x0, 0x4e20}, 0x6e)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000507000000001000000000000040", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="740000002400070500"/20, @ANYRES32=r8, @ANYBLOB="00000000ffffffff0000000008000100716671"], 0x74}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newtfilter={0x48, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@filter_kind_options=@f_rsvp6={{0xa, 0x1, 'rsvp6\x00'}, {0x18, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @local}]}}]}, 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newtfilter={0x34, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@filter_kind_options=@f_rsvp6={{0xa, 0x1, 'rsvp6\x00'}, {0x4}}]}, 0x34}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newtfilter={0x48, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@filter_kind_options=@f_rsvp6={{0xa, 0x1, 'rsvp6\x00'}, {0x18, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}]}}]}, 0x48}}, 0x0)

13:13:00 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r1, 0x0)
getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000140)={'broute\x00'}, &(0x7f00000001c0)=0x78)
r2 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f0000000040)={@void, @val={0x1, 0x4, 0x7, 0x78d6, 0xf801, 0x40}, @eth={@random="9f84bb57964b", @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x200}, {}, {}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4}}}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x70)

13:13:00 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600000000000084ffcf8a63ed", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=ANY=[@ANYBLOB="400000001000010400000000ae89e1b95e6eb5c149f9232320ed6def000000000000000085ba14d36587c5f56a8a7bf0cb305c5ac8e259377e4c791b448bed78e815cc270ddaad9fea0342594865492418f7ed2aa85d053091fc09abc25a90c762de135ae87bb3b10b54a8d115ba108aa444e4fd5dbb085b7dd2d4ec35ce042484c29e94774a8a40363dc101d6fbea345a2beaa75fb92b611c0d871a941135a33ac51a49", @ANYRES32=0x0, @ANYBLOB="0000000000000000180012800e0001007769726567756172740000000400028008000a0000f4e6ffee009c3ca017258ad76815156ca2a40f1e2abe73876699f1002d005f0f52bedc822b91b81adf6c6aaeb5b0e9b3908ff2be64a3f5ab652cec32dbfbcf062b0a1f8ab5da0f96dddc2d17fa454f6f9c4a7c42a8967eea16949a60cce4fa9bfde43cf44f6ef5aab35f26c4a02832eb623a44bbc304e525de454c607f80fe9b0f968a28139c1ba62c8aef8bf6998221b8a05458345a160d8bdbe45cb6420d908f13145e312cc811fc1e2b63083a5494530b0804b6e16767cab74e1ff0f2fd45e1456c6fc0fd48ce1108deb4bcc47e9f6bd788021e6c7947d1e6176595a5175548c7c0530a27b1457162a81f5b65f0fa41fedebda3b4cdcddf99a8", @ANYRES32=r2, @ANYBLOB], 0x40}}, 0x0)
r4 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r4, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
getpeername(r4, &(0x7f00000006c0)=@pppol2tpin6={0x18, 0x1, {0x0, <r5=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, &(0x7f0000000740)=0x80)
r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000008fc0)='IPVS\x00')
setsockopt(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000300)="c9bfd0f85fc4673779ccd5171e4cfa03947d754bb7be7995ee80841311449166da7f1d0dd6a6adf723e1d47b76f1158e", 0x30)
sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x2c, r6, 0x0, 0x0, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffff8}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x76}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_NEW_SERVICE(r5, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="00012abd000000000000000901000900"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x40048c0)
ioctl$SIOCX25GCAUSEDIAG(r5, 0x89e6, &(0x7f0000000780)={0x9})

[ 3134.902057][T17183] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
13:13:00 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x5, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3134.982926][T17191] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3134.993997][T17190] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3135.069737][T17199] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3135.078008][T17188] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3135.131556][T17199] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3135.169542][T17188] device ipvlan1489 entered promiscuous mode
13:13:00 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:00 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x5, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:00 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x6, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3135.210544][T17198] netlink: 'syz-executor.4': attribute type 2 has an invalid length.
[ 3135.278243][   T29] audit: type=1800 audit(1596805980.954:3006): pid=17188 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15910 res=0
13:13:00 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x6, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3135.333578][T17249] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
13:13:01 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0xb, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:01 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x8, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3135.386389][T17249] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3135.441700][T17191] netlink: 'syz-executor.4': attribute type 2 has an invalid length.
[ 3135.450169][T17190] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3135.467231][T17213] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.0'.
13:13:01 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x7ffffff2}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:01 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x5, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3135.953735][T17191] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3135.968330][T17183] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3135.978237][T17198] netlink: 'syz-executor.4': attribute type 2 has an invalid length.
[ 3135.988045][T17261] netlink: 'syz-executor.4': attribute type 2 has an invalid length.
[ 3135.997683][T17260] netlink: 'syz-executor.4': attribute type 2 has an invalid length.
[ 3136.021569][T17267] device ipvlan1490 entered promiscuous mode
13:13:01 executing program 4:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3136.111940][   T29] audit: type=1800 audit(1596805981.784:3007): pid=17266 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15932 res=0
[ 3136.155164][T17267] device ipvlan1491 entered promiscuous mode
[ 3136.182917][   T29] audit: type=1804 audit(1596805981.854:3008): pid=17266 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1502/cgroup.controllers" dev="sda1" ino=15932 res=1
13:13:05 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xa010101, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:13:05 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0xc, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:05 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0xb, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:05 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0xb, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:05 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x7ffffff8}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:05 executing program 4:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3139.661243][T17290] device ipvlan1492 entered promiscuous mode
13:13:05 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0xc, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3139.704033][   T29] audit: type=1800 audit(1596805985.374:3009): pid=17290 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15809 res=0
13:13:05 executing program 4:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:05 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x1000, &(0x7f00000002c0)=0x2)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', <r3=>0x0})
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
recvfrom(0xffffffffffffffff, &(0x7f0000000140)=""/26, 0x1a, 0x3, &(0x7f00000003c0)=@xdp={0x2c, 0x5, r6, 0x2e}, 0x80)
sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000010400000000ec00000000000000", @ANYRES32=r6, @ANYBLOB="00000000000000001c0012000b00010062726964676500000c0002000500070005000000"], 0x3c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB="9b3b6f0dffff000000000000a37b3ee294461d0af4dcafda48d52ae870643e03e100"/49], 0x28}}, 0x0)

[ 3139.834351][T17296] device ipvlan1493 entered promiscuous mode
[ 3139.852896][   T29] audit: type=1804 audit(1596805985.464:3010): pid=17290 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1503/cgroup.controllers" dev="sda1" ino=15809 res=1
13:13:05 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x12, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:05 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:05 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x12, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3140.056846][T17314] bridge20: port 1(bond0) entered blocking state
[ 3140.064003][T17314] bridge20: port 1(bond0) entered disabled state
[ 3140.089984][T17314] device bond_slave_0 entered promiscuous mode
[ 3140.096280][T17314] device bond_slave_1 entered promiscuous mode
[ 3140.102604][T17314] device bridge7 entered promiscuous mode
[ 3140.108718][T17314] device bridge8 entered promiscuous mode
[ 3140.114547][T17314] device bridge9 entered promiscuous mode
13:13:09 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="020000009f84bb57964baaaaaaaaaaaa0806000000790000000000119078ac1414bbac1414bb0430880b0000000000000800000086dd00002a3b4292d6f725083b854a98cbd1d4565e8b6c9fcb088ae19b4a0000000000080088be00000000100000000100000000000000080022eb0000000020000000060000000000000000000000080065580000000058637a78985d042d2dffe850c03a8a9a93e4c3c9f2d461964256b6b3eb2a05cc06453b30cc3e34f8e6ea976c5fe7edc97c2e0d03e01500a5c2655594911497b57b2fb79691189aa87488a3ce0000000000000000fb071bae65f2aeb8339b59933ebc0848cb42c1eacd5f396b4752a836f50f361d0e1b569e806507789ab4ea644b59be126d42001f11abf5ea66d3b148733ba3a83488f125fa93d8a6b92f52531ed0453b62f285a243cc550dc5ff1400d9bd65"], 0x8b)

13:13:09 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x7ffffff9}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:09 executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)

13:13:09 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3143.766371][T17339] validate_nla: 4 callbacks suppressed
[ 3143.766379][T17339] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3143.831743][T17339] device ipvlan1494 entered promiscuous mode
13:13:09 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x2, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:09 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x1000, &(0x7f00000002c0)=0x2)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', <r3=>0x0})
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
recvfrom(0xffffffffffffffff, &(0x7f0000000140)=""/26, 0x1a, 0x3, &(0x7f00000003c0)=@xdp={0x2c, 0x5, r6, 0x2e}, 0x80)
sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000010400000000ec00000000000000", @ANYRES32=r6, @ANYBLOB="00000000000000001c0012000b00010062726964676500000c0002000500070005000000"], 0x3c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB="9b3b6f0dffff000000000000a37b3ee294461d0af4dcafda48d52ae870643e03e100"/49], 0x28}}, 0x0)

13:13:09 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x3, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3143.971824][T17352] device bond_slave_0 left promiscuous mode
[ 3143.977801][T17352] device bond_slave_1 left promiscuous mode
[ 3143.983987][T17352] device bridge7 left promiscuous mode
[ 3143.989778][T17352] device bridge8 left promiscuous mode
[ 3143.995547][T17352] device bridge9 left promiscuous mode
[ 3144.007741][   T29] audit: type=1800 audit(1596805989.644:3011): pid=17341 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15869 res=0
13:13:09 executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)

13:13:09 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x2, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:09 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x4, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3144.070603][T17352] bridge20: port 1(bond0) entered disabled state
[ 3144.133176][   T29] audit: type=1804 audit(1596805989.784:3012): pid=17339 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1504/cgroup.controllers" dev="sda1" ino=15869 res=1
13:13:09 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x5, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:10 executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)

[ 3144.477369][T17352] bridge22: port 1(bond0) entered blocking state
[ 3144.484518][T17352] bridge22: port 1(bond0) entered disabled state
[ 3144.493680][T17352] device bond_slave_0 entered promiscuous mode
[ 3144.499960][T17352] device bond_slave_1 entered promiscuous mode
[ 3144.506209][T17352] device bridge7 entered promiscuous mode
[ 3144.511953][T17352] device bridge8 entered promiscuous mode
[ 3144.517767][T17352] device bridge9 entered promiscuous mode
[ 3144.537305][T17341] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3144.641094][T17341] device ipvlan1495 entered promiscuous mode
13:13:13 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r2 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@rc, &(0x7f0000000140)=0x80, 0x800)
socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000340)={<r3=>0x0, 0x0})
close(r3)
r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280)='devlink\x00')
sendmsg$DEVLINK_CMD_PORT_SET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x44, r4, 0xef8c987201b6e653, 0x0, 0x0, {0x3a}, [{{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0xfffffffffffffffa}}]}, 0x44}}, 0x0)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xf0, r4, 0x200, 0x70bd26, 0x25dfdbff, {}, [{{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x9}}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x1}}}]}, 0xf0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:13:13 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x3, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:13 executing program 4:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:13 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x6, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:13 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x5, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:13 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x7ffffffb}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:13 executing program 4:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:13 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x4, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:13 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x4, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:13 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x7, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:13 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x5, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:13 executing program 4:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3148.007634][T17405] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3148.162109][T17405] device ipvlan1496 entered promiscuous mode
[ 3148.371294][   T29] audit: type=1800 audit(1596805994.045:3013): pid=17399 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15997 res=0
[ 3148.495131][   T29] audit: type=1804 audit(1596805994.145:3014): pid=17399 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1505/cgroup.controllers" dev="sda1" ino=15997 res=1
[ 3149.269719][T17417] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3149.288462][T17417] device ipvlan1497 entered promiscuous mode
13:13:18 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00')
sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)={0x54, r4, 0x5, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "2cdae66f91dac475aab512aac5d7e6bcd9f5f438"}}]}]}, 0x54}}, 0x0)
sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0x178, r4, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}]}, @TIPC_NLA_BEARER={0x64, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x6, @dev={0xfe, 0x80, [], 0x19}, 0x3}}, {0x14, 0x2, @in={0x2, 0x4e23, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x400}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x101}]}, @TIPC_NLA_BEARER={0x3c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x0, @mcast2, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e21, @remote}}}}]}, @TIPC_NLA_NODE={0x9c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x49, 0x4, {'gcm(aes)\x00', 0x21, "1d5af01e9dac6757dc15dbb27e9f9e7a17e948780e43d4515989ad6f4bad9df3d6"}}, @TIPC_NLA_NODE_KEY={0x49, 0x4, {'gcm(aes)\x00', 0x21, "5468bce9a0073f22aa5edf41dd39aa114cb89ef6f0783595ddccba9050e837cf67"}}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x20008054}, 0x4000090)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="020000009f84bb57964baaaaaaaaaaaa08df450000580000000000119078ac1414bbac1414bb0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb00000000200000000600000000000000000000000800655800000000"], 0x6a)

13:13:18 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0xb, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:18 executing program 0:
r0 = socket(0x10, 0x80002, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(0xffffffffffffffff, r2, 0x0, 0x100000100000002)
ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f0000000100)=0x51e)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r4, r3, 0x0, 0x100000002)
setsockopt$inet_dccp_int(r3, 0x21, 0x11, &(0x7f0000000000)=0x8, 0x4)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r5, 0xffffe000)
setsockopt$bt_l2cap_L2CAP_CONNINFO(r5, 0x6, 0x2, &(0x7f0000000180)={0xff, "8ebad9"}, 0x6)
write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f00002dc000/0x2000)=nil, 0x2000, 0x3, 0x28011, r1, 0x0)
setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000040)={{0xa, 0x4e24, 0x3, @ipv4={[], [], @empty}, 0x8000}, {0xa, 0x4e24, 0x3, @private0={0xfc, 0x0, [], 0x10}, 0x40}, 0x0, [0xd9ba, 0x3, 0xf0, 0x3ff, 0x8000, 0x2, 0x40, 0x3]}, 0x5c)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x2c, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff4ed0e5742000000000000000", @ANYRES32, @ANYBLOB="000000000000006b93001e0012800b00010062726964676500000c00fc7f05ff1500000032ab"], 0x3c}}, 0x0)

13:13:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x6, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:18 executing program 4:
syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}]}}}}}}}, 0x0)

13:13:18 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x7ffffffc}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x7, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:18 executing program 4:
syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}]}}}}}}}, 0x0)

13:13:18 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0xf, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3152.852668][T17444] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3152.861875][   T29] audit: type=1804 audit(1596805998.535:3015): pid=17443 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1717/cgroup.controllers" dev="sda1" ino=16033 res=1
[ 3152.978555][T17444] device ipvlan1498 entered promiscuous mode
[ 3152.992345][   T29] audit: type=1804 audit(1596805998.575:3016): pid=17443 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1717/cgroup.controllers" dev="sda1" ino=16033 res=1
13:13:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0xb, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:18 executing program 4:
syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}]}}}}}}}, 0x0)

13:13:18 executing program 0:
r0 = socket(0x10, 0x80002, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(0xffffffffffffffff, r2, 0x0, 0x100000100000002)
ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f0000000100)=0x51e)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r4, r3, 0x0, 0x100000002)
setsockopt$inet_dccp_int(r3, 0x21, 0x11, &(0x7f0000000000)=0x8, 0x4)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r5, 0xffffe000)
setsockopt$bt_l2cap_L2CAP_CONNINFO(r5, 0x6, 0x2, &(0x7f0000000180)={0xff, "8ebad9"}, 0x6)
write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f00002dc000/0x2000)=nil, 0x2000, 0x3, 0x28011, r1, 0x0)
setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000040)={{0xa, 0x4e24, 0x3, @ipv4={[], [], @empty}, 0x8000}, {0xa, 0x4e24, 0x3, @private0={0xfc, 0x0, [], 0x10}, 0x40}, 0x0, [0xd9ba, 0x3, 0xf0, 0x3ff, 0x8000, 0x2, 0x40, 0x3]}, 0x5c)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x2c, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff4ed0e5742000000000000000", @ANYRES32, @ANYBLOB="000000000000006b93001e0012800b00010062726964676500000c00fc7f05ff1500000032ab"], 0x3c}}, 0x0)

[ 3153.125760][T17448] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3153.127389][   T29] audit: type=1804 audit(1596805998.575:3017): pid=17443 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1717/cgroup.controllers" dev="sda1" ino=16033 res=1
[ 3153.183571][T17448] device ipvlan1499 entered promiscuous mode
[ 3153.306240][   T29] audit: type=1800 audit(1596805998.805:3018): pid=17444 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15901 res=0
[ 3153.328292][   T29] audit: type=1804 audit(1596805998.965:3019): pid=17472 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1718/cgroup.controllers" dev="sda1" ino=16029 res=1
[ 3153.427383][   T29] audit: type=1804 audit(1596805998.995:3020): pid=17472 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1718/cgroup.controllers" dev="sda1" ino=16029 res=1
[ 3153.453664][   T29] audit: type=1804 audit(1596805999.005:3021): pid=17472 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1718/cgroup.controllers" dev="sda1" ino=16029 res=1
13:13:22 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0x6}]}}}}}}}, 0x0)

13:13:22 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x5c, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:22 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0xf, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:22 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffffff1f}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:22 executing program 0:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0xfffffffffffffd40, 0x2004010)
r1 = socket$inet6(0xa, 0x2, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r2=>0x0}, &(0x7f0000000040)=0x8)
setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00000001c0)={r2, 0x8}, 0x14)
setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={r2, 0x5}, 0x8)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c)
socket$inet_udp(0x2, 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
recvmmsg(r1, &(0x7f0000000200), 0x38c, 0x0, 0x0)
connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c)
sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0)
ppoll(&(0x7f0000000040)=[{r1, 0x2, 0x3000300}], 0x1, 0x0, 0x0, 0x0)
sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f000000ab80)={0x0, 0x0, 0x0}, 0xc0)
write$binfmt_script(r0, &(0x7f0000000140)=ANY=[@ANYRES16, @ANYRESOCT=0x0, @ANYRESDEC], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700)
sendfile(r4, r3, 0x0, 0x100000001)

[ 3157.221537][T17489] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:22 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x5c, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:22 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x70, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:23 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0x6}]}}}}}}}, 0x0)

[ 3157.332279][T17489] device ipvlan1500 entered promiscuous mode
[ 3157.389633][T17494] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3157.390004][   T29] audit: type=1800 audit(1596806003.066:3022): pid=17489 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16008 res=0
13:13:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0xfc, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3157.488528][T17494] device ipvlan1501 entered promiscuous mode
13:13:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x70, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3157.515501][   T29] audit: type=1804 audit(1596806003.156:3023): pid=17506 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1507/cgroup.controllers" dev="sda1" ino=16008 res=1
13:13:23 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$AUDIT_TRIM(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x3f6, 0x4, 0x70bd2b, 0x25dfdbfe, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x11)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="00000000000000002800120009000100766574800000000018000200140001000000000001afe11fbf9831b1e73c4bdd3a7ef7687654299b280726fc15daba606fb231d6aa207b0aa8f9b55290e2e537e814d6bb9828d69e8c268bd10900a76ca457530756b4c0", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="38000001240007050000004007a2a3000500000098f6d59af3ac306b26127aa0c2e3a45df013b30bfcb559b8fae224", @ANYRES32=r4, @ANYBLOB="00000000ffffffff0099b2b1677e13f97d6673630000000008000208000b382793556bc1103f1f878a71a8df1f6eea02eb8f7ef19e5854d6ad58c921d994f7b3188941a319e08626b7ca4aa919941862656571f9ee8c295d4b86a39f0d7229a9cc61abe7bcaa2e0908a5bc742976eb999d00000000000000000000000083ead4bf0cbad0ff1d242d54a2931f2175682f19ee64ecb3bcb576c19bc7058cc3e0eacc3e12a6a54dcf67f871fbaff1d94743e8b04095b40029e03f9a660364b1e67238d1bb3d70a5615e556ea1e162924e8d62b43c960272cc3838a5f935d7377f354376e7348dfe6b05e705fc532a51a45d29ffe869a0c50123cacf666f76af01e06e3c72c177bfb61ca0574e1cde681f54f6e4d5642279a678fd22a2a0c0ca77d1d30c9313991fb11a38"], 0x38}, 0x1, 0x0, 0x0, 0x24000805}, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@initdev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f0000000980)=0xe8)
setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@mcast1, @in6=@dev={0xfe, 0x80, [], 0x2c}, 0x4e20, 0xfff, 0x4e24, 0x1, 0x2, 0x20, 0xa0, 0x3c, r4, r5}, {0x1, 0x1ff, 0x7f6, 0x3, 0x1000, 0x4, 0xfa3d}, {0x6, 0x5, 0x9, 0xffffffff}, 0x0, 0x6e6bb8, 0x2, 0x1}, {{@in6=@loopback, 0x4d2, 0xab}, 0xa, @in=@multicast1, 0x0, 0x1, 0x3, 0x4, 0x9, 0x10001}}, 0xe8)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r6, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r6, 0x0)
getsockname$packet(r6, &(0x7f0000000280)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000002c0)=0x14)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f0000000300)=@allocspi={0x208, 0x16, 0x200, 0x70bd2d, 0x25dfdbfe, {{{@in=@remote, @in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4e24, 0x3ff, 0x4e22, 0x2daa, 0xa, 0x80, 0xc0, 0x3a}, {@in=@multicast2, 0x4d3, 0x32}, @in6=@remote, {0x3, 0x800, 0x66, 0x0, 0x6, 0x7, 0x9b8000, 0x9}, {0x7, 0x6, 0x9, 0xffffffffa1a74d2c}, {0x7, 0x20, 0x1}, 0x70bd25, 0x3507, 0x2, 0x3, 0x6, 0x68}, 0x5}, [@sa={0xe4, 0x6, {{@in6=@mcast1, @in6=@dev={0xfe, 0x80, [], 0x1b}, 0x4e23, 0x0, 0x4e23, 0x1, 0x0, 0x20, 0x20, 0x84, 0x0, r5}, {@in6=@remote, 0x4d4, 0x5f}, @in=@empty, {0x5, 0x2aaf, 0x6, 0x7, 0xbd7, 0x7, 0x9, 0x2}, {0x4, 0x7860, 0x1ff, 0x6}, {0xfffffffc, 0x3, 0x8}, 0x70bd29, 0x0, 0x2, 0x0, 0x46, 0x80}}, @etimer_thresh={0x8, 0xc, 0x7}, @replay_val={0x10, 0xa, {0x70bd2d, 0x70bd25, 0x1}}, @policy_type={0xa, 0x10, {0x1}}, @XFRMA_IF_ID={0x8, 0x1f, r7}]}, 0x208}, 0x1, 0x0, 0x0, 0x44}, 0x20000845)
write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="020000009f84bb57964baaaaaaaaaaaa0800450000580000000000119078ac1414bbac1414bb0420880b0000000000000800000086dd082088be00000000100000000100000000000000080022eb00000000200000000600000000000001000000000800655800000000"], 0x6a)

13:13:23 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0x6}]}}}}}}}, 0x0)

13:13:23 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffff888056b83420}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3157.785173][   T29] audit: type=1804 audit(1596806003.406:3024): pid=17513 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir803875459/syzkaller.uzOVaj/1719/cgroup.controllers" dev="sda1" ino=16002 res=1
13:13:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0xff, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0xfc, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c02, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3158.094803][T17533] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3158.122771][T17533] device ipvlan1502 entered promiscuous mode
[ 3158.168675][   T29] audit: type=1800 audit(1596806003.846:3025): pid=17526 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15762 res=0
13:13:23 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x200000000000011, 0x3, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', <r3=>0x0})
bind$packet(r1, &(0x7f0000000240)={0x11, 0x0, r3}, 0x14)
socket$netlink(0x10, 0x3, 0x7)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r5, r4, 0x0, 0x100000002)
r6 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r6, &(0x7f0000000040)={0x11, 0x0, <r7=>0x0}, &(0x7f00000000c0)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="3444170000000000000000008859ecab7a7ae0a7", @ANYRES32=r7, @ANYBLOB="000000000000000014001680100001800c000c000400000000000000"], 0x34}}, 0x0)

13:13:23 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0x8, 0x0, [{0x0, 0x2}]}]}}}}}}}, 0x0)

13:13:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0xff, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c03, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3158.329643][   T29] audit: type=1804 audit(1596806004.006:3026): pid=17533 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1508/cgroup.controllers" dev="sda1" ino=15762 res=1
13:13:24 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c02, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3159.287362][T17534] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3159.371259][T17534] device ipvlan1503 entered promiscuous mode
13:13:26 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x12)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:13:26 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0x8, 0x0, [{0x0, 0x2}]}]}}}}}}}, 0x0)

13:13:26 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c04, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:26 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c03, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:26 executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @fixed}, &(0x7f0000000040)=0xe, 0x80000)
r1 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
getsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, 0x0, &(0x7f0000000080)=0x2)

13:13:26 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffff888056b83990}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3161.343269][T17571] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3161.357821][T17574] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3161.388410][T17574] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3161.407392][T17571] device ipvlan1504 entered promiscuous mode
[ 3161.409667][T17580] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3161.452166][   T29] audit: type=1800 audit(1596806007.126:3027): pid=17577 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16034 res=0
13:13:27 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c04, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:27 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0x8, 0x0, [{0x0, 0x2}]}]}}}}}}}, 0x0)

13:13:27 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c05, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:27 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c05, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3161.526743][T17580] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3161.544334][T17577] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3161.636780][   T29] audit: type=1804 audit(1596806007.316:3028): pid=17571 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1509/cgroup.controllers" dev="sda1" ino=16034 res=1
13:13:27 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xb, 0x0, [{0x0, 0x5, "eccdb5"}]}]}}}}}}}, 0x0)

[ 3161.679050][T17577] device ipvlan1505 entered promiscuous mode
[ 3161.687974][T17574] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3161.696908][T17580] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3161.718735][T17580] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
13:13:27 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffff888057d99040}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3161.732938][T17574] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3162.713568][T17604] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3162.762953][T17604] device ipvlan1506 entered promiscuous mode
[ 3162.770221][   T29] audit: type=1800 audit(1596806008.446:3029): pid=17603 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16010 res=0
[ 3162.953025][T17604] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3162.983313][T17604] device ipvlan1507 entered promiscuous mode
13:13:32 executing program 3:
r0 = accept$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @default}, [@remote, @netrom, @null, @default, @rose, @bcast, @bcast, @bcast]}, &(0x7f0000000140)=0x48)
getpeername$netrom(r0, &(0x7f0000000240)={{0x3, @default}, [@default, @bcast, @netrom, @default, @bcast, @remote, @netrom]}, &(0x7f0000000180)=0x48)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r2 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r1, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:13:32 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c06, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:32 executing program 0:
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
sendmmsg$inet6(r0, &(0x7f0000003d40)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x0, @remote}, 0x1c, 0x0}}, {{&(0x7f00000002c0)={0xa, 0x4e22, 0x0, @dev}, 0x1c, 0x0, 0x0, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0xfffffffc}}], 0x18}}], 0x2, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
r3 = openat$cgroup_ro(r1, &(0x7f0000000140)='cpu.stat\x00', 0x0, 0x0)
sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r3, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)={0x160, 0x3, 0x1, 0x3, 0x0, 0x0, {0xa, 0x0, 0xa}, [@CTA_SEQ_ADJ_ORIG={0x34, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x800}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x10001}, @CTA_SEQADJ_OFFSET_AFTER={0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x3}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x1ff}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0xa, 0x1, 'Q.931\x00'}}, @CTA_NAT_DST={0xe8, 0xd, 0x0, 0x1, [@CTA_NAT_PROTO={0x1c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x5}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e24}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @private1}, @CTA_NAT_V6_MINIP={0x14, 0x4, @remote}, @CTA_NAT_PROTO={0x2c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}, @CTA_NAT_V4_MINIP={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x16}}, @CTA_NAT_V4_MINIP={0x8, 0x1, @local}, @CTA_NAT_V6_MINIP={0x14, 0x4, @mcast2}, @CTA_NAT_PROTO={0x3c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}]}]}, @CTA_PROTOINFO={0x18, 0x4, 0x0, 0x1, @CTA_PROTOINFO_SCTP={0x14, 0x3, 0x0, 0x1, [@CTA_PROTOINFO_SCTP_VTAG_REPLY={0x8, 0x3, 0x1, 0x0, 0xffffa9d8}, @CTA_PROTOINFO_SCTP_VTAG_REPLY={0x8, 0x3, 0x1, 0x0, 0x4b}]}}]}, 0x160}, 0x1, 0x0, 0x0, 0x40000}, 0x4)
r4 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r4, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000200)=<r5=>0x0, &(0x7f0000000240)=0x4)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'veth1_vlan\x00', r5})

13:13:32 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xb, 0x0, [{0x0, 0x5, "eccdb5"}]}]}}}}}}}, 0x0)

13:13:32 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c06, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:32 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffff888057d99128}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3167.218028][T17626] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3167.226376][T17626] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3167.242947][T17629] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[ 3167.252582][T17629] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.0'.
13:13:32 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xb, 0x0, [{0x0, 0x5, "eccdb5"}]}]}}}}}}}, 0x0)

[ 3167.264956][T17628] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:33 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c07, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:33 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c07, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:33 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c0b, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3167.416933][T17628] device ipvlan1508 entered promiscuous mode
13:13:33 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r0, &(0x7f0000002ec0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000280)="5708cd682e9d2ddcb1e6685ac1f58e3b1753abf5d6fa9db7d3539b0afcf0f39bc8ce34c0b65be8838ddce31c4e50337da801c5719e137655", 0x38}, {&(0x7f0000000340)="cbf8633c705ba9f44506a52b3d85cda9a3b07f265b4c6cd646167a36aeec2e58de7a3b3070f97cbdac013c789dee5ec9de5eeee349ca87153a91701482bc3e602d562f6f35ea843203616cfe81a6e436461af490b767373bedd93c4a0fe7093d4d3f", 0x62}, {&(0x7f0000000500)="9044b6f8ebf015bde118ca6ac255077435f1350f9a653d67a12bc65f80a48e14ea3498ba90d3c59e8ada57a4f387fc0431e4169c4cddd3c1344c22be3df947d628d511ea957cfa1f15263cc1ab1a3ffbce4377d925c11c1141a7f5abb538b162a0fd8df2f1e2a17b0ce8be83f1dc72317b3ce12428b162391d591370978577c946190e53bff09c8a7c3bccc9a7c85a113af0", 0x92}, {&(0x7f00000003c0)="66477bb6ae4c8bb6722bec28", 0xc}, {&(0x7f00000005c0)="fe7de654200fbfffd39c5563ab6249a5cf46831e597b4e1a9299db768ec2284d83943d9a28f695e6cbd577e292a03e71c9b86988a8da1c883050bc3f960a0262d1374a307108be91926b9c5d89dfc727dd925b422d84e359f4ffa0a460e31ed1c24811fc3f770d182bff805bb8104ae8babf44d420210efeb9d9eb78ee90c8a1a1b7054ff966dd4ed13307a062f1ce9a34d4fd60eeb3bafaaab36b7a7168379482ede32b73f74c39f3c83c0d025ea1256611dff0504e5eb68e6386d89a11bec6d5cd7b6ac743f5db631ffe83142a541e1bc816841af8da6bbe67286429213f78547357402c1fe59fe876e8a3430de725ba", 0xf1}, {&(0x7f0000000400)="c7ad7d0bdee1cc4168dd5f", 0xb}], 0x6}}, {{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000007c0)="24f9d4ef3b6bd3b2ad5610d1ccfdca34b1448bf7bc5acc51b8568c157bcfc0091bb9200c95d7bcc9cf20582c13341c968ea27580f133e9b7ade4e4f1e167a15f719ccef2bb", 0x45}, {&(0x7f0000000840)="40be8b5528358c8c4edd2399304d107955f77ca2b4590332046e28251edd9a85e0b6853aaa6edf2ef53dcc71ad50e0099c50c56f66ab8bc06e132bd6f80950e94d9df329a4353f8f19", 0x49}], 0x2}}, {{0x0, 0x0, &(0x7f0000002e00)=[{&(0x7f0000000b00)="f136852dec326c01da02a75b246739cccd149982e2f65455e2cf0beeca7b0bb53941841f9104ba4a948b0e1d143da4dde51e40d17f9e03e0f67b10a670f7ba88dc9343845a50bd5709307ef101df05c9114ee1f4d598c91dccfaf1ef899be8c642a98d83d9e1", 0x66}, {&(0x7f0000000b80)="1dae0ecb17eb827749f3f08817a859", 0xf}, {&(0x7f0000000bc0)="b72ad0b64f4b0f9187794fee5c83ec31e98a1890a50d7603885ac7647f8e46a28f08c5a790da5e42adc40bb0c7926368bf46cc9cd39f87d2aac5c59851931f59e912ef43ab4df5284a372168cc8eff58a67330b41b1a9c0c72b13d98514b318ea3831f70a0fc0be12276e4f2eb8a66c1f91a401635ec39d9ca23", 0x7a}, {&(0x7f0000000c40)="c0ebfe1afba5775979562af4bc51597b518879dfeb9d16f10b277615461ea00187c41eb333b2de29b179dce63c709faf87b37c3c707ee866ca66342ad1a8b2974fe581ec7961b7c33a82cb337b5345572929026af794ecced903bc", 0x5b}, {&(0x7f0000000cc0)="0aea0c9b1a2d2b868ccd52a66dd6b654bb26e80afc0b067121ee54fdae9cd34b1241aeebd66f1133b47dde5ef4be3d733e487354044ca3e6a378b2c093b9b0f73dc3ed64b8e8b90830e988d7b346ca2437eff7a5597f2ca9d5f3eb2a4e24c4de7eabc0a02ab451b78eac0402b5551ea23a41da25b4356f5a08fd9a8f4b7d64a469ea2ac4dc1a2647712d546e45904b390e84268981fdbdfe7eff21a1b433b331e07e9781dd6d3cc1cc68ea0170fcedf46374ccf14f0979b51105df641dae8e9624ec79adbbeb08b18e7d72f08ad68afe3a847fb1f246a731fa9007a1eb52af02dc29d6fbee06cd6bc0b35f6693b9e6bcbc4db46043d69d627362616ed009601facc48020c8028ec0fadd055f31a9d34f4de4edb3f63f9565525ae2ec284fcd0aaa9df6f4f9c78711275a2fd91c40a08d96a7ccbd09eaacb610999b1e30745c415335c483fb75445d6f7f0bf645ed0a6d4f46f36b56bac7bfd242376acb89df944203e9e895e21a1570189d79ae280648e38dc86eaff6cc3d3906f5f8f33d6dc7fcf05254dddf0526aa530c2b17c5cc5200ecd75cad6632b7ed7ea458f7a057b0b99ccac81989c2658f585e644f793f63f973e2ff41", 0x1b5}], 0x5, &(0x7f0000002f80)=ANY=[], 0x18}}], 0x3, 0x4008000)

13:13:33 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c0b, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3167.629342][   T29] audit: type=1800 audit(1596806013.307:3030): pid=17628 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16063 res=0
[ 3168.582940][T17657] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3168.618540][T17657] device ipvlan1509 entered promiscuous mode
13:13:37 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c0f, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:37 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xc, 0x0, [{0x0, 0x6, "eccdb50d"}]}]}}}}}}}, 0x0)

13:13:37 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c0f, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:37 executing program 0:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket(0x11, 0x800000003, 0x0)
bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r1, &(0x7f0000000240)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x10)
sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB='L\x00\x00\x00(\x00\'\r\x00'/20, @ANYRES32=r2, @ANYBLOB="0000ffff00000000000000000b00010063ff0100007000001c0002"], 0x4c}}, 0x0)

13:13:37 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffff888057d992f8}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:37 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c5c, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3171.743274][T17679] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:37 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xc, 0x0, [{0x0, 0x6, "eccdb50d"}]}]}}}}}}}, 0x0)

13:13:37 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c5c, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3171.798781][T16172] tipc: TX() has been purged, node left!
[ 3171.809935][T16172] tipc: TX() has been purged, node left!
[ 3171.859121][T17679] device ipvlan1510 entered promiscuous mode
13:13:37 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c70, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3171.988193][   T29] audit: type=1800 audit(1596806017.667:3031): pid=17679 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15727 res=0
[ 3171.997292][T17694] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:37 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c70, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:37 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xc, 0x0, [{0x0, 0x6, "eccdb50d"}]}]}}}}}}}, 0x0)

13:13:37 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2cfc, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3172.099779][T17694] device ipvlan1511 entered promiscuous mode
13:13:37 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2cfc, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:37 executing program 3:
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r0, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000100)='SEG6\x00')
sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x30, r4, 0x5, 0x0, 0x0, {}, [@SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_SECRETLEN={0x5}, @SEG6_ATTR_ALGID={0x5}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x5}]}, 0x30}, 0x1, 0x6c}, 0x0)
sendmsg$SEG6_CMD_GET_TUNSRC(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8040000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, r4, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x1}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @local}}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1ff}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x24000000)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0)='nl80211\x00')
sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x18, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40010}, 0x804)
write$tun(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="020000009f84bb57964baaaaaaaaaaaa0800450000580000000000119078ac1414bbac1414bb0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb00000022e2f1c84a4aab85b169be5f8f8f5800200000000600000000000000000000000800655800000000"], 0x6a)

13:13:37 executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000500)=0x2000000000000001, 0x4)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10)
connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10)

13:13:38 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffff888057d99868}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3172.416367][T17718] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:38 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:38 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:38 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:38 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x6, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}}, 0x0)

13:13:38 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3172.508890][T17718] device ipvlan1512 entered promiscuous mode
13:13:38 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:38 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}}, 0x0)

13:13:38 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3172.645437][   T29] audit: type=1800 audit(1596806018.327:3032): pid=17725 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16245 res=0
[ 3172.679957][T17725] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:38 executing program 3:
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r0, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="020000009f84bb57964baaaaaaaaaaaa0800450000580000000000119078ac1414bbac1414bb0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb0000000020000000060000000000006ce5481483ec78a379950013830000000000080065580000000060cd"], 0x6a)
sendmsg$AUDIT_TTY_GET(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x10, 0x3f8, 0x2, 0x70bd2d, 0x25dfdbfe, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x80}, 0x20000000)

13:13:38 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:38 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3172.773637][T17725] device ipvlan1513 entered promiscuous mode
[ 3172.782759][   T29] audit: type=1804 audit(1596806018.407:3033): pid=17718 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1513/cgroup.controllers" dev="sda1" ino=16245 res=1
13:13:38 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x6, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x58}}, 0x0)

13:13:38 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:38 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffff888058308dd8}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:38 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:38 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:38 executing program 0:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'syz_tun\x00', <r2=>0x0})
bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14)
syz_emit_ethernet(0x1a, &(0x7f0000000180)={@local, @link_local, @val={@void}, {@llc_tr={0x11, {@snap={0x0, 0x0, 'p', "258b87"}}}}}, 0x0)

13:13:38 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3173.201655][T17763] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3173.251911][T17763] device ipvlan1514 entered promiscuous mode
13:13:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:39 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3173.386793][   T29] audit: type=1800 audit(1596806019.067:3034): pid=17769 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16213 res=0
[ 3173.412692][T17769] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3173.475021][T17769] device ipvlan1515 entered promiscuous mode
[ 3173.502605][   T29] audit: type=1804 audit(1596806019.137:3035): pid=17763 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1514/cgroup.controllers" dev="sda1" ino=16213 res=1
13:13:39 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:39 executing program 4:
syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:39 executing program 4:
syz_emit_ethernet(0x6a, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:39 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffff88809675d128}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:39 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRESDEC, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20040}, 0xc, &(0x7f00000008c0)={&(0x7f00000007c0)={0xf0, 0x0, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={[], [], @private=0xa010102}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, [], 0x1}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7e}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x8000}, 0x48080)
write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="020000009f84bb46964baaaaaaaaaaaa0800450000580000000000119078ac1414bbac1414bb04200800000086dd080088be00000000100000001400000000000000080022eb00000000200000000600000000000000000000000800655800"/106], 0x6a)

[ 3173.897152][T17791] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:39 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3174.014037][T17791] device ipvlan1516 entered promiscuous mode
[ 3174.122330][   T29] audit: type=1800 audit(1596806019.757:3036): pid=17798 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16044 res=0
[ 3174.193370][   T29] audit: type=1804 audit(1596806019.807:3037): pid=17798 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1515/cgroup.controllers" dev="sda1" ino=16044 res=1
[ 3174.241582][T17799] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
13:13:40 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000440)={0x0, 0x1c, &(0x7f0000000400)=[@in6={0xa, 0x0, 0x0, @ipv4={[], [], @local}}]}, &(0x7f0000000480)=0x10)
getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f0000000000)=""/218, &(0x7f0000000100)=0xda)

13:13:40 executing program 4:
syz_emit_ethernet(0x6a, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:40 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:40 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:40 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffff88809675d210}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:40 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:40 executing program 4:
syz_emit_ethernet(0x6a, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3175.973793][T17827] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3176.018902][   T29] audit: type=1800 audit(1596806021.698:3038): pid=17822 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16267 res=0
[ 3176.044910][T17827] device ipvlan1517 entered promiscuous mode
[ 3176.095138][T17832] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3176.131143][T17832] device ipvlan1518 entered promiscuous mode
[ 3176.142816][   T29] audit: type=1804 audit(1596806021.828:3039): pid=17822 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1516/cgroup.controllers" dev="sda1" ino=16267 res=1
13:13:47 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0x4}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:47 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:47 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:47 executing program 0:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000004000)={0x0, 0x10, &(0x7f0000003fc0)=[@in={0x2, 0x0, @dev}]}, &(0x7f0000004040)=0x10)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000080)=ANY=[@ANYBLOB="5b25911d", @ANYRES32=<r1=>0x0], &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x72, &(0x7f0000000180)={r1}, &(0x7f0000000300)=0x14)

13:13:47 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0xffffc90000000000}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:47 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_proto_private(r2, 0x89e5, &(0x7f0000000040)="66f32c3b4b60b606d68052ac244793ee322cc8d32bef5cf2a4a6571ddcc84d5d858998f1832c5885a952d504f15387ad27a65fd85460876a7105024cfdf949547957d76e106650c180")
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r3, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r3, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000c80)={'syztnl0\x00', &(0x7f0000000c00)={'syztnl2\x00', <r4=>0x0, 0x4, 0x3, 0x81, 0x4f, 0x16, @loopback, @remote, 0x10, 0x80, 0x4, 0x5c9f}})
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="c40000002c00230e00"/20, @ANYRES32=r5, @ANYBLOB="00001000000000000300070009000100666c6f770000000014000200080001002f4900000800020001000000"], 0x44}}, 0x0)
sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x1d, r5}, 0x10, &(0x7f0000000240)={&(0x7f00000001c0)={0x7, 0x0, 0x45, {}, {}, {0x2, 0x1, 0x0, 0x1}, 0x1, @canfd={{0x2, 0x1, 0x0, 0x1}, 0x36, 0x2, 0x0, 0x0, "662f12eda888f70f3e2a62bc7eda96d52875ab8e59bc98dd745126055f1e04b3cdd3a86bad105f062dccca7542a240f6b9e29f7f20f3c2e0412c8945fb7acde0"}}, 0x80}, 0x1, 0x0, 0x0, 0x40000}, 0x4801)
bind$can_j1939(0xffffffffffffffff, &(0x7f0000000cc0)={0x1d, r4, 0x1, {0x2, 0xf0, 0x7}, 0x1}, 0x18)
write$tun(r0, &(0x7f00000002c0)={@void, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0xd8, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast2, @remote}, {{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [0x3ef]}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0xa421, 0x1ff]}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x7}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0xff}, 0x6, {0x8000}}}, {0x8, 0x6558, 0x0, "d51ffcb3a038b526b03f0280286e18c0c7c2a85e43e3d8d1424537a210c99b6690f1b558d6a5d74ed20748e4fec4dab3ba91263b8499e68ec8f07f6cf9a6c9597dfdadca728d9ac3f2e73ebec20f6cb644b9ad7c01eb14522c4e0e8dbb51679e1a41dcb3aaab8c6637a9f84b979ad6b4c0179898c4276bb7b392"}}}}}}}, 0xe6)
pipe(&(0x7f0000000140)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
write$tun(r6, &(0x7f0000002500)={@void, @val={0x1, 0x0, 0x6, 0x800, 0x5e, 0x1}, @ipv4=@gre={{0x2b, 0x4, 0x2, 0x2b, 0x127d, 0x68, 0x0, 0x8, 0x2f, 0x0, @empty, @loopback, {[@lsrr={0x83, 0x1b, 0x4c, [@broadcast, @broadcast, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x19}, @rand_addr=0x64010101, @remote]}, @timestamp_prespec={0x44, 0x44, 0xe7, 0x3, 0x7, [{@rand_addr=0x64010101, 0x4}, {@loopback, 0x908}, {@empty}, {@multicast1, 0x1}, {@local, 0x71}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}, {@loopback, 0x6}, {@empty, 0x5}]}, @ssrr={0x89, 0xf, 0x88, [@empty, @rand_addr=0x64010102, @empty]}, @ra={0x94, 0x4}, @timestamp={0x44, 0x18, 0xf2, 0x0, 0x6, [0x5, 0x0, 0x1cf, 0x2, 0x5]}, @timestamp_prespec={0x44, 0xc, 0xfc, 0x3, 0x3, [{@rand_addr=0x64010101, 0x100}]}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0xab, 0x2, [0x1], "fe3b10509951b3937492daa3841e5648c761c3dbbd8f86daa3ba6622e85fac51fed88c7fc7f615084948a49f5246186da84d78fa34e7ec9fb5b934469de09931e1835015cad97e3d081e995e4fe1627f61692d3d927a12160f6a0f6ac80fd2699a4e000ecfb0817039615acb7cd32626434976161c1ddd31ab57b1ad1497fd7075f213823ea03fbc960700000037246b1308fa4da5b0a5475fcfd073ebd0cae45b8a5b38810cdbc6553523"}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [], "d266c8908f3ebb65e9f9df47298ff53276ea8a16e8080fd8cb838b3344df456028a96afa36748de45036078a6d50c5f4403d1ee782fb52d245934a41478a684ed0"}, {0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [], "5a44c005f5b5e6b14a6f18854c6df177d2652470368e7c26200c15bbd123cd0ed45c1ab28a7931d08f99faf8f4f8bea4f809dca620e46928799b5c5b1b5f61471b79c0db92261ecb33ae1a1f5b0e7bba8476de96be9db14499d55b9478d8474b543cbcef1074d2b14619f8fd01e5425328789af510f15b1ed162ca14225c3f897f034aa3f5e1c8ec89e4d7c8787fd0f660c2789cdd3994131727a7d60c4ed843fd0835e62b998035f3069624e86459aa793d10d586a537bd4a349fe20158535ac3c4339f09409c2da41f5386561a0eb79023a89d3ca5a7b0452f70487b7fa4b68d07c5027b23854744e6d9793762e4349395856d3e76e194a47518842f7d3d8d0303fff2a861ada9c3c6fda7feefc218e3432a2a81f2788b8ec0ed7e772208507c0cc64e42a15b377a52571e898a8b90665a60a13328d22602bde31b60d89a0dccf1d47c20020ff8a90f1e5c06199a7197b5ca736f06b8f96fb7cd716723703f954106657162581767823508e676b0d3ca1c32d1f75abc7751995f516aaa2fbb4d5d608794c5aa8f656f43634603df909f49ddc8e1fe00614bd8c53a48dae8fe33f33c8bb2eca3a37edf367a3fa79dd952cdb9b65665fadb0170d9bc4a2baed0c0965aed0632fde86a5fcb9d53774b66dc0264735b9f908c2ec75677f16a22080435d44de49b74772431ff3b2dd70affee0e13a1c8d058a8c3d64e82fb602aba03ae268f5999f73b28abb6ebebf70dcdccbf68e8ec88a8d738b9f974928906ab21f21cf6ae0d25bc6bd3201528e21c3ec409f117844a2bc9874047985ba8720d8cb92da5357d691ab16a0cb39e86cde9c6688b2ebdac4b9af8033c8fa13985f4b558bbc02956b80268873c19de589a43a4bab23cf3ed8879247d3d062bb3858530e5cfbc4b292a4c104b925449284e27c42904806bfeee242ac2ca5ec3a74afb0a5f256fee00c9331066f72148c3956c751289fb2964313d79d974ae5287f2f1150ebcca2a291641f4fa6ddba18d7fd7485b8b6bde6250ce4b3473eef99301ca6926a55a54238c1a710690cff7c26182ca7cd2b28778af8c9fcc070c89051a070824f53f3a49064cae59fb37e6540aa3f71384ad359156426fc78eb8433e52d191005e722989b54df78c3f4f8ea04097cfc98f589b55be6aecdc1b9b95cc98aa46890c6d3a0a9170af61b97efb40dc05a211266b1c16110e8fcaee3b30dc14d0ecc65b33906b550f61f6aa3b7e64526938df833cb2a1e246c25506b43be6a917506b08f5de4e2403cb7c9bc790b744ebe0908602e51d502d09f466f22de4351b1899a624837bf79733491ed1785d18e2b0d5d39576a7fa39eaddd75f45b8022bae7b77fa5d817c98bfaee15a25035bbd0e48e0b424e7a167da544bd785d148cc34a8e2203189f1b53e8e98b9f2d923a01447ef87595585d8f23640d9aae0c094760608849f2b1c2d6bd54647b327de6dd4c2da4ca4342408bc881646639424cb3a52018adf327ac1a13b64e1308ea52ed3f673b912b915e4144d0430bab0a945cca31674f310cde29beb1748729fcc87b95a2ad53e93b35446fee3b5de25fbdfb4c9a18005135239ba46b5d9333ea9e08f55ae47bb38438ec85a6a3dc4850f735b54d53149d75e4d19e36b2f9758256d2141828d3f0a18ac431214f76f02c4d0a50d36bb804f37019715a70578facdfc84a3c863d1cf16ef9a70d8bf0afd52ce3b6c95fdeb2eaa62c127f6b5b8dffca7e561b86ae8e6faa016fcb40d0eaa898ba3dd042bde4f33b2b36ca89400d4f80df638294e1e1fad1c7709ed5b603dd42dff39b6de882388953eea58899c3f4d36a7000231e8d0689507e08499cea618f47c918c0575bb7519022964b8d3e26b6c26c6bde0ec3001c6f5152a5e7531580f557951c8dd9fd386eaa51dfbf31b3373c29e559deda39c6dafa3f7a14e8da6d5abae99651e44df62ae4236c909e8c9f2f33876d6125c55c20148fff818850f3be1eec7d7d071853a1b07aaf8de051cde3cebac718707424a2a357f01fc30026cf72dafbc98d07ac80dfd910f384c0866e2cc7952d2915dc6cb8651d8e18ccbbac2dfd758cf27de77e645ab57235c668aaebea8489ecd756db8c7dc319c61f74c12ee5696b90de9c61cb2c445c552966a1b2ae0ea482e7c3da6195ed57835f011a79c5dadca15b6e16695da65b9791f8502d3ce2d85825c7372154a9d429f6afbb11ffa5fb264692843e93aa99d2964273c5c45b0ec1622506d4d01ea891cafa01508e6ef69dee540548ece1c3799d16d564401aa1d6277c6bd2b7ec7dbb4b0a97aca23f4c809d00842f5eaabc82dfb7b9786fa3e99434d9beac4889a5e2db40345f4c356098c1df7fd662a2f87beb3e33154a8da91e6559a881f3864a9874be982535fa08255eade36417ef2a0c9b7bcc62203ed4f4b25c0c6f1b26f34332cbd30844c7f6625cb170d806084168a6d5b107126939012b5a7d1508370dc33d0c2de84f0f220fd1b8e5024f7738ac1cf188e947c95a0d1b92dd931aa334789233b7852e6603a7f3014524d1ed7d0463274b46f002f7ce00551513e55e4630c475af198d0ba5c2fe51d9a69cb027d3e474f5d6989e345ad057f25f8f7485426b40804418724ff1fc8d5bc16e201bf822aa6d93f57050e17fb5c4942ea2f590cc7d1a60d2289cda6f7b6b116b51b0628ea57aa7cfb0bc5319fd8e9c68fb852e121770c248b70f90f5c4fc44f7c5c7dc99adaca03d4b0860b52130c27c49f60e0cd095c831d8579656d4040a51a2b7fddfb0d87d8f14d431fc299812ee2cc80479e636b608721322eadd302fdbabc58fe261ff6a75b5edbbce7cd600c79780925c54e49d848f704164cd0ae7b496176f8110dae8bf578f9624845c4d025f3a48d2dc6463d5014661b99c72a6a40e27f50f00507f1a5b8f29846fc9aa42500649b01f5538cc7cf565b57ec96fc957941ca97f6199ae06f87d19d9ee5779a6764748a593eb30043f02f732231e93dbc9bea91d032e52bd0527c5c6eef1bec5a37af93d14237ec211bc5f861f223a7a3a87991caa4753aa80b29196acbfbb3f7bb70249b76a4dbae702e59e2c123702ce2b7085dd352d478871c5fca9cc63906782c6ab0e3b0f23e8f6c4ba7a2db44fc39314d244e5d2d3be8f02c2a6bbf6df6df2f8775d7abcdba561427058f6bdaabf97bc236e9659e21657fc998988b9719e90c026b14bafd64ebf9b3e4338b3c0037bd08f7a3f2b2dadd5ab1d5f0e7e0f3e9c1e194600e2b78cee4407e8642c2c6bd5b49f4e8492aa05f8bdc60b8ddda7515ac0d208a54700bddbdb0547dfa293b8ad2f711667a1f58e20c02293c196d72ac118c767a098c006da260edc2dcea2429338c18edba49a115aa5c4d53db1c8545be260923184566508390afbc0ef3bca1692348404366680120164aa048080ab0f0d48362752f97d8f146b3d397fd313602c082050088215c76ae7fdbb86cc45397bf0d9e5b76d4984ff21ce07fc7f888a3d343ef3bb601568bc994e98c0a9e080002f33271e7fbe1e0a6dd4120da731fc98631f2d3b692ebf5ec11cc1f242c8c1af2cf5a75d69831c1ce8ee815e714e284e7cc6fe86a84703e0cc00cf72b9ce005c7657ac0772b404a9af27a0b125fd0e4ce696c525b6e97907ec2ac690e420d5bbeb454706b5cce0d5fde5d739932733ccb03c7e5b34cc7c58a1061f6733261502140e9ae71246f2fddb0a5867be36bbe1e3a0170828663b5e724bde8d08fb157f9d3553eceb0bcae7287b794be9cd536c42efbc8d137fe977f2a54e20e5758a25e77d40813bcc3580cad4636c149d447e7ed1e43e5b768758f2b2a6eff62a5c05cfe3505437950d098e068197508afe467f2f2ca2cc950f5bee137ccd9fea81b74167bdb5cd1c64fecbbb89130b3179acaa7696c19f224fa4a72d8f51896e44465fdd6ce8227c045d8ad343c4b06e39478c6212eed5db4918b6b54211b60414d35cb7d6127faf0bce6af9b51f464ce2d2915c2a7fc601c6c7505b1e701f28e575aa614390cb182bf960d2d861408bdcf91a81af391d0db98a6f76af58c833f76a7dfbdc54a9f457baabd9b9df7aaf06a47c5339c894e7e2004cd98857a65a44d527f492de8506ba4336e6680ae8debfb4be21c80de2e3b980f2a64910ad448e3564e836cd3aff5aeebfc247d1d992a4fb4c4f1f460f5c8c58249c6b4a86d5b61bd61f7aa445259c86352081593289532d949b97fa65823ac1decbc859ebbc6d5ee8b0a37307c4ce1a47bf02a897b67cb64b559e1445df2dd998d03c09be0a4eb1d2c1c9904f2e46bae1d0ad6264e98a5c66afd5eefdf9d6fc4b366a1009e9da3a11721980385ada6ad6cea1c1aa4031491240633637d85b950cf3ba5effc64d1215b86a9a2dd40c34ab6268c5b21bc15884c7acbcbf8a76fd0622c52b3a123b09fec1df08cc292aa278e0c51096f08274217c8284abadd523bb6b5c73ad8afb7cfc286abc8c99918137fd8aae44a4a72b6bed1a49b7fe1e966e0d775c2bbe9a9b0a05288dcad3b9a776d9efec47e1014e71e3436b89b747fbf4df397b07eea4c909e736218cf25a67627d04297142b7a9cbed27931a80741ec213bd8a545808e052f88872f62079533d4817a2274f18b04e953dc6f2f14cc0bf95dfe82e11ec64238bd6c9e08b6ff8adfc3c50970278bd93c7002506c687397d98c0938cb0ef5a4fb6f41d740af364f2dcddca9af83059594e14e61547a6c88e538c41ac2c0772a0c00630529cc727509616c5907962e798bc8a09cc7d78b3623ac3e22406521135e1afdf38c3e7f1c059f785897369b76c01b0b4e40541d167caf28b14bbc3df3bf78ef233a76c301d708a92b0906d9cd926a820be5360e1ec467da9d73a2a419cbf7de551e3f77f79467ec7e7f8b7b52ca94e358b846e192e1622b8204f4b8f4a4e47ed6fd171e3d5beaea42a1e93211c33afdb196f029730fac4aa73b617df9e5ebbaca9c4c3baf53a1e9669040cc7122af67b56bfa17c098668b4e6b5848da8755278b64ddffc830767a98ad30d28a342c1d6267ce394951946c3265d2e5edd0e6b454aa34cbc6a0ef1f32cefde83e5d7b159afaeccc230bb26c9770857190a0cb12caae351fe7780fc13f828e242c83ee45c1f70665ff79c9fc4cfdf3b45b9624cc93813385a840f9d28cbbe52b8b10bd0adc91fb023383a7a017f63ad7b298581e90fbe7018a0098caccb45f4e62faf2dc6da8f4c7933c7df7a68fdb2834543c0d5f4ba880c54551c2fb59892bf19397c3d7fc8e0fda23e71a8da12f2a676fbb20a6ea636d6f9e326c9a8b2b36cfbccd2e39b44f52d5f32225c3f159b8f4976e03c74aaf03a84bb99095f2ae183ccb89873aab85b31b87c863a54f3af06dc3aa8c14f10672845f972a0a5f7f3f670ebe0dc200e39d4dbcc826f982f9c171fe9644ed870d456019932b805edf6ea3bf4a175c5ceb21ed01799464b25d0317c7e5ab78a29020a1a485d4e089fc895be47c3b42de7a4118447792a35d48d05ceaf08c4d78f69045c23ed36d7489ccf0cb987539fbf5ca5f354a329e9bb08927fb51944a8bc84b30006051509bfcd06c94e6ba730b6770e6c3c5b28c8c2c8a5a635ef705391b6ad0f4a9d6ff3dbe54b3fdf4d9d437d6dfa471837302607b9c8a0b908a50157cab14799c3fb1c33da6eb827a0a61fa0879ea1fc6e4b757c81ff548acf069b0785129dd9d4d2fc9ca264a5e197ae8fd59cec8102557043796c8e434aadfa67a237c48837346e331ca8cbb01a702445bd29853e78a192efe1773e44b"}, {0x8, 0x88be, 0x1, {{0x1, 0x1, 0x1f, 0x0, 0x0, 0x0, 0x6, 0x4}}}, {0x8, 0x22eb, 0x2, {{0x9, 0x2, 0x80, 0x2, 0x0, 0x3, 0x4, 0x3}, 0x2, {0x29dc, 0x8, 0x0, 0x0, 0x0, 0x0, 0x2}}}, {0x8, 0x6558, 0x2, "1ae49af1f5d4f2f119ead8ca875a07bc7f209d44102fe88b07ac47166d1b4c18af2ebb1ab336ec9bf03e44a10b0549fc927a82e9929817a62b19e82419995e780b8ea6d543dd0af1ff7a876b79c6917e1f1319d220b08d62875b7bf881dc3489fda02f9d01e8135b32fc77224eeda8c94237865325a45a35e730b179c7495b2cf4151b5d69fc219ba8a2f3afc2928be259cc0e9df92d16fa18a5de17b5c039"}}}}, 0x1287)

13:13:47 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3182.051915][T17857] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:47 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0x4}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3182.100237][T17857] device ipvlan1519 entered promiscuous mode
13:13:47 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3182.137322][   T29] audit: type=1800 audit(1596806027.818:3040): pid=17866 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15971 res=0
13:13:47 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0x4}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3182.272451][   T29] audit: type=1804 audit(1596806027.958:3041): pid=17857 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1517/cgroup.controllers" dev="sda1" ino=15971 res=1
13:13:48 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:48 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3182.326872][T17871] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:48 executing program 4:
syz_emit_ethernet(0x62, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3182.447015][T17871] device ipvlan1520 entered promiscuous mode
13:13:48 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:48 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:48 executing program 0:
r0 = socket$phonet_pipe(0x23, 0x5, 0x2)
getsockopt$PNPIPE_INITSTATE(r0, 0x113, 0x4, &(0x7f0000000e00), &(0x7f0000000e40)=0x4)

13:13:48 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x2}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3183.240996][T17905] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3183.287039][T17905] device ipvlan1521 entered promiscuous mode
[ 3183.390546][   T29] audit: type=1800 audit(1596806029.068:3042): pid=17903 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15883 res=0
[ 3183.517319][T17910] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3183.540695][T17910] device ipvlan1522 entered promiscuous mode
[ 3183.564892][   T29] audit: type=1804 audit(1596806029.248:3043): pid=17903 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1518/cgroup.controllers" dev="sda1" ino=15883 res=1
13:13:51 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:51 executing program 4:
syz_emit_ethernet(0x62, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:51 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:51 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x20, &(0x7f0000000000)=[@in={0x2, 0x4e22, @rand_addr=0x64010102}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xf}}]}, &(0x7f00000000c0)=0x10)

13:13:51 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x3}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3185.847214][T17926] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3185.886487][T17926] device ipvlan1523 entered promiscuous mode
13:13:51 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:51 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:51 executing program 4:
syz_emit_ethernet(0x62, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3185.973630][   T29] audit: type=1800 audit(1596806031.659:3044): pid=17931 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16114 res=0
[ 3185.999660][T17931] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:51 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x581e82, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = getuid()
sendfile(r2, r1, 0x0, 0xffff)
ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000380)=0x6)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
ioctl$FITHAW(r5, 0xc0045878)
r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
ioctl$FS_IOC_GETFSLABEL(r6, 0x400452c8, &(0x7f0000000100))
getpeername(r6, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, &(0x7f0000000080)=0x80)
r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100)='NLBL_MGMT\x00')
sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4080}, 0xffffffffffffff20, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYRES64, @ANYRES16=r3, @ANYRESOCT, @ANYRES16, @ANYRESDEC, @ANYRES32, @ANYRESHEX, @ANYRES64], 0x28}, 0x1, 0x0, 0x0, 0x850}, 0x0)
sendmsg$NLBL_MGMT_C_ADD(r4, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000a82a7fbb92b6039ee77e026dc73d710f84b12803acb567196b5dbf87eca92b9d0b16d47f227b81d038a4f22a6f1454cb0f1713f7c622c10235deab95d5b32515d82e157ad46859b9cf32b6834ac84728f7bee238253ce2c286942df1cf0cda2b67fa0508bbcfdb292acaeff1e70bb5dd32a897abbcf9533e6dc9b2547b2a8cfa1e52127dba518abd76b82c9e2ff530fc43e44cedb57aff7413e68468fa", @ANYRES16=r7, @ANYBLOB="20002abd7000fbdbdf2501000000080008000a010102"], 0x1c}, 0x1, 0x0, 0x0, 0x8005}, 0x8010)
recvfrom$netrom(r1, &(0x7f0000000140)=""/68, 0x44, 0x40000021, 0x0, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="02964baaaaaaee2f5a7a1feb3caaaaaa08004500002355ff00000011cdb35dca14bbac1414bb0420880b000000e2bb000800000086dd080069be0000000010000000010000000000000008002205000000002000000006000000000000000000000008006558000000005481a6e8067a43193c1607dfdec276a45411669c39c1f7ff169bb1894224b9c0e69a3bbcd270220cc560f79dca3130628ba54447dcc5ec6ca61680654430364b314a66ba8cd0092441e9b1526221833380ab367b98713811f50e17b018e44f"], 0x6a)

[ 3186.033743][T17931] device ipvlan1524 entered promiscuous mode
[ 3186.049340][   T29] audit: type=1804 audit(1596806031.729:3045): pid=17926 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1519/cgroup.controllers" dev="sda1" ino=16114 res=1
13:13:51 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x4}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:51 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:51 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:51 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3186.209183][T17945] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3186.238283][T17950] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3186.251160][T17945] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
13:13:51 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:52 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3186.309925][T17950] device ipvlan1525 entered promiscuous mode
[ 3186.369928][T17945] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3186.381794][   T29] audit: type=1800 audit(1596806032.069:3046): pid=17954 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15827 res=0
[ 3186.477286][T17945] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3186.545518][   T29] audit: type=1804 audit(1596806032.149:3047): pid=17954 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1520/cgroup.controllers" dev="sda1" ino=15827 res=1
13:13:52 executing program 0:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_mreqsrc(r0, 0x0, 0x41, 0x0, &(0x7f0000000040)=0xff9a)

13:13:52 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:52 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:52 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:52 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:52 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="020000009f84bb57964baae0030000aa0800450000580000000000119078ac1414bbac1414bb0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb000000002000000006000000000000000000000008006558000000002a03a51ded23458b61e474cd0a3131a6717af370f4ccfa5ed8397d8620138198ff9e442b59caa8b94dc09cf96d901c905c33db624e0edc6432503335d693c59aa473a6b2399a923ddcb8c4acb68841e65cd5e840cc"], 0x6a)

[ 3186.733617][T17978] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:52 executing program 0:
r0 = socket(0xa, 0x2, 0x0)
getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0xfffffed5)

[ 3186.832407][T17978] device ipvlan1526 entered promiscuous mode
13:13:52 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:52 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3186.905477][   T29] audit: type=1800 audit(1596806032.549:3048): pid=17988 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16210 res=0
[ 3186.917626][T17988] device ipvlan1527 entered promiscuous mode
13:13:52 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:52 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3187.007078][   T29] audit: type=1804 audit(1596806032.679:3049): pid=17978 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1521/cgroup.controllers" dev="sda1" ino=16210 res=1
13:13:52 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:52 executing program 0:
pipe(&(0x7f00000005c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0)
socket$inet(0x2, 0x200000003, 0x87)
bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
connect$inet(r2, &(0x7f0000001280)={0x2, 0x0, @multicast1}, 0x10)
splice(r0, 0x0, r2, 0x0, 0x19404, 0xe)

13:13:52 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:52 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x6}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:52 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:53 executing program 4:
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0x4}, @ra={0x94, 0x4}, @cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3188.224124][   T29] audit: type=1800 audit(1596806033.909:3050): pid=18021 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16242 res=0
[ 3188.410469][   T29] audit: type=1804 audit(1596806034.069:3051): pid=18021 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1522/cgroup.controllers" dev="sda1" ino=16242 res=1
[ 3188.841100][T18017] validate_nla: 1 callbacks suppressed
[ 3188.841109][T18017] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3188.906996][T18017] device ipvlan1528 entered promiscuous mode
[ 3188.923094][T18025] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3188.944400][T18025] device ipvlan1529 entered promiscuous mode
13:13:55 executing program 3:
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'bridge_slave_1\x00', 0xa732})
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r0, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="020000009f84bb57964baaaaaaaaaaaa0800450000580000000000119078829138c5ac742c4a202705ac1414bbac1414bb0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb00000000200000000600000000000000000000000800655800000000576d1e9ee03b2d4b3db1b665494d1bb1a3c1cae789b4ebbe7f42ad60b18f3901c3e4a16f491bb5d13fa3e4eab8ce9bdb1a57b2a4e9bf375162042158024d4ed5357fbe090408a71c3ab42df1ad9c65a04dc01759c7355e70224ec347a6d2fa9c612011f841eebdd7e3a9d607da0d5acddb12d8d3a5886c57358c66de0c0dad71feebcede29485223105cc8e5f6e94ff9"], 0x6a)

13:13:55 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:55 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:55 executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$bt_hci(r0, 0x0, 0x1, 0x0, &(0x7f0000000000))

13:13:55 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
getsockname$unix(r0, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e)

13:13:55 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x7}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3190.076027][T18051] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:55 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:55 executing program 4:
r0 = socket$nl_crypto(0x10, 0x3, 0x15)
getsockopt$netlink(r0, 0x10e, 0x3, 0x0, &(0x7f00000000c0))

13:13:55 executing program 0:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
getsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, 0x0, &(0x7f0000000000))

13:13:55 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3190.256895][T18051] device ipvlan1530 entered promiscuous mode
13:13:55 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3190.308181][T18055] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:13:56 executing program 4:
r0 = socket(0x22, 0x2, 0x2)
getsockopt$MISDN_TIME_STAMP(r0, 0x0, 0x1, 0x0, 0xffffffffffffffff)

13:13:56 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f0000000040)={@val={0x2}, @val={0x2, 0x1, 0xfffe, 0x5, 0x505, 0x9}, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x74)
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000140)='vlan1\x00', 0x10)

13:13:56 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3190.405828][T18055] device ipvlan1531 entered promiscuous mode
13:13:56 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:56 executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_int(r0, 0x1, 0x2a, 0x0, &(0x7f0000001400))

13:13:56 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x8}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:13:56 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:13:56 executing program 4:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
getsockopt$sock_buf(r0, 0x1, 0x3d, 0x0, &(0x7f00000009c0))

13:13:56 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3191.607161][   T29] audit: type=1800 audit(1596806037.289:3052): pid=18098 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15795 res=0
[ 3191.744330][   T29] audit: type=1804 audit(1596806037.429:3053): pid=18098 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1524/cgroup.controllers" dev="sda1" ino=15795 res=1
[ 3191.938483][T18096] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3191.958364][T18096] device ipvlan1532 entered promiscuous mode
[ 3192.366172][T18107] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3192.386166][T18107] device ipvlan1533 entered promiscuous mode
13:14:07 executing program 0:
clock_gettime(0x0, &(0x7f0000000100))

13:14:07 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:07 executing program 4:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_buf(r0, 0x0, 0x31, 0x0, &(0x7f0000000000))

13:14:07 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:07 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x9}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:07 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r3, r2, 0x0, 0x100000002)
sendmsg$IPSET_CMD_PROTOCOL(r3, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, 0x1, 0x6, 0x401, 0x0, 0x0, {0xc, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x840}, 0x20000000)
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:14:07 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:07 executing program 0:
r0 = socket$nl_crypto(0x10, 0x3, 0x15)
getsockopt$netlink(r0, 0x10e, 0x0, 0x0, 0x0)

13:14:07 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:07 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_pktinfo(r0, 0x0, 0x18, 0x0, &(0x7f0000000180))

[ 3201.765737][T18129] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3201.873778][T18129] device ipvlan1534 entered promiscuous mode
13:14:07 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3202.012860][   T29] audit: type=1800 audit(1596806047.700:3054): pid=18129 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16092 res=0
13:14:07 executing program 0:
r0 = socket$nl_crypto(0x10, 0x3, 0x15)
getsockopt$netlink(r0, 0x10e, 0x3, 0x0, &(0x7f00000000c0)=0x3c)

13:14:07 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3202.141750][   T29] audit: type=1804 audit(1596806047.790:3055): pid=18129 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1525/cgroup.controllers" dev="sda1" ino=16092 res=1
13:14:07 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:07 executing program 4:
socket$inet6_udp(0x2, 0x3, 0x0)

13:14:07 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3202.741562][T18140] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3202.830624][T18140] device ipvlan1535 entered promiscuous mode
13:14:08 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0xe}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3202.961940][T18178] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3202.999405][T18178] device ipvlan1536 entered promiscuous mode
[ 3203.095719][   T29] audit: type=1800 audit(1596806048.780:3056): pid=18178 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16092 res=0
[ 3203.118395][T18181] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3203.151814][T18181] device ipvlan1537 entered promiscuous mode
[ 3203.174821][   T29] audit: type=1804 audit(1596806048.860:3057): pid=18178 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1526/cgroup.controllers" dev="sda1" ino=16092 res=1
13:14:11 executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_pktinfo(r0, 0x0, 0x14, 0x0, &(0x7f0000000180))

13:14:11 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:11 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:11 executing program 4:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
recvmmsg(r0, &(0x7f0000004480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2013, 0x0)

13:14:11 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x30}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:11 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
getsockname$tipc(0xffffffffffffffff, &(0x7f00000015c0)=@name, &(0x7f0000001600)=0x10)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
socketpair(0x10, 0xa, 0x10000, &(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000340)={<r2=>0x0, 0x0})
close(r2)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280)='devlink\x00')
sendmsg$DEVLINK_CMD_PORT_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000001640)=ANY=[@ANYBLOB="4c010000", @ANYRES16=r3, @ANYBLOB="010029bd7000ffdbdf25050000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300020000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300000000006d0000000f0002006e657464657673696d30000008000300030000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030001000000080001007063690011000200303030303a30303a31302e300000000008000300010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300030000000e0001006e657464657673696d0000000f0002006e657464656773696d3000000800030002000000080001007063690011040200453030303a30303a31302e3000000000080003000100"/326], 0x14c}, 0x1, 0x0, 0x0, 0x70}, 0x4000000)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r5, r4, 0x0, 0x100000002)
sendmsg$nl_route_sched(r4, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)=@deltaction={0xc8, 0x31, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@TCA_ACT_TAB={0x44, 0x1, [{0x14, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x66}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @TCA_ACT_TAB={0x30, 0x1, [{0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1ff}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0x14, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}, @TCA_ACT_TAB={0x24, 0x1, [{0x14, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffff7}}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x800}, 0x1)
r6 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="020000009f84bb57964baaaaaaaaaaaa0800450000580000000000119078ac1414bbac1414bb0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb00000000200000000600000000000000000800655800000000000000"], 0x6a)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r7, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r7, 0x0)
recvfrom$rose(r7, &(0x7f0000000580)=""/4096, 0x1000, 0x40002122, &(0x7f0000001580)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}, 0x40)

13:14:11 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3205.829490][T18195] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:11 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000140)=0x10)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x0, @private=0xa010100}]}, &(0x7f00000001c0)=0x10)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000200)={0x2, [0x0, 0x0]}, &(0x7f0000000080)=0xc)

13:14:11 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_pktinfo(r0, 0x0, 0x31, 0x0, &(0x7f0000000180))

[ 3205.982307][T18195] device ipvlan1538 entered promiscuous mode
13:14:11 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:11 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:11 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:11 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_tcp_int(r0, 0x6, 0x2, 0x0, &(0x7f0000000040))

13:14:11 executing program 4:
r0 = socket$inet_sctp(0x2, 0x3, 0x84)
getsockopt(r0, 0x0, 0xcb, 0x0, 0x0)

[ 3206.157615][   T29] audit: type=1800 audit(1596806051.840:3058): pid=18195 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16103 res=0
[ 3206.179000][T18195] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3206.241917][T18195] device ipvlan1539 entered promiscuous mode
[ 3206.306812][   T29] audit: type=1804 audit(1596806051.910:3059): pid=18201 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1527/cgroup.controllers" dev="sda1" ino=16103 res=1
13:14:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:12 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x48}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3207.293759][T18241] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3207.317397][T18241] device ipvlan1540 entered promiscuous mode
[ 3207.400064][   T29] audit: type=1800 audit(1596806053.091:3060): pid=18240 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16074 res=0
[ 3207.422675][T18241] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3207.444434][T18241] device ipvlan1541 entered promiscuous mode
[ 3207.464224][   T29] audit: type=1804 audit(1596806053.151:3061): pid=18240 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1528/cgroup.controllers" dev="sda1" ino=16074 res=1
13:14:18 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f0000000040)={@val={0x2}, @val={0x0, 0x0, 0x5, 0x2, 0x9, 0x1f}, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x74)

[ 3212.855956][T18264] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3212.894632][T18264] device ipvlan1542 entered promiscuous mode
13:14:18 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:18 executing program 4:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
getsockopt$sock_buf(r0, 0x1, 0x26, 0x0, &(0x7f00000009c0))

13:14:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:18 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet6_opts(r0, 0x29, 0x37, 0x0, &(0x7f0000000680))

13:14:18 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x4c}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:18 executing program 0:
r0 = socket(0x11, 0xa, 0x0)
getsockname(r0, 0x0, &(0x7f0000000080))

13:14:18 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3212.960605][   T29] audit: type=1800 audit(1596806058.651:3062): pid=18272 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15969 res=0
[ 3212.967484][T18273] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:18 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt(r0, 0x6, 0x9, 0x0, &(0x7f00000000c0))

13:14:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3213.132797][   T29] audit: type=1804 audit(1596806058.701:3063): pid=18264 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1529/cgroup.controllers" dev="sda1" ino=15969 res=1
13:14:18 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3213.271714][T18273] device ipvlan1543 entered promiscuous mode
13:14:18 executing program 4:
r0 = socket(0x22, 0x2, 0x2)
accept4$tipc(r0, 0x0, 0x0, 0x0)

13:14:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xb00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:23 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
ioctl$SIOCX25SFACILITIES(r1, 0x89e3, &(0x7f0000000040)={0x6f, 0x10000, 0xc, 0xb, 0x2})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:14:23 executing program 4:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_mreqsrc(r0, 0x0, 0x53, 0x0, &(0x7f0000000040)=0x84)

13:14:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:23 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x60}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:23 executing program 0:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000004000)={0x0, 0x10, &(0x7f0000003fc0)=[@in={0x2, 0x0, @dev}]}, &(0x7f0000004040)=0x10)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000200)={0x0, 0x390, "0294d60bc32e418932ded4f9859a6900d06b9c9637055b598842c437883611ec72f39781d40bd14e786390355b576fced398f3f73334ff5342af88666d46796b4dbd23f7dd90d3fdfbdda969274982a8cf98ff3a0e3b6b1609db9329c0621f036ce547fcbbab29ae80294eebce40bbe3f7c7ad6bbb06a44c49fe4ea55de219451cab7f777a198c06f30e704d5da37b08a58d3317cb7f4232773c9d42a96cb26841d7466e1797e03eb043718a5868f5b46360d516b63be5a94a3dae51e89976d4292d8bb166d2a81775842b769c16476a86c31642b5c28f430c1bf236e16d456a95de9a64c363413de70ed8c61bd82837a346457ccde02d1a199fbaca1a2ffcd6682eb920c209eab7a406d0c3adbe635415b19135cd7d698605dc58ffb942256dee924403cc3b5c69ad125c2f3b8c5d300e558983048d01e5b08ccf9d28135822d27439dfc60f37af00114d9cb1656ee353b9f9f3fa53a039335044d81d776f35e8bfa10641eb2cbad2e4345926b3bb13f23de30fa159644d27d57f66853a538b3c15b33808eee4c2a8a574dc1f87d2f9cce5a7eb127b82ff9c933386242fdb56a5409ccff401aed37dde329b63154a41fc499fd838c2a8883c40b860a4c595b4f90356054e8950a7f9c516bf0e0b0f0893c1350212721df799edf9b48505983671b2d3f56a94190c6d926196e3764e483a1ce5cc8426d43bfcda478e48dec373a2ac5d0fd16034a47a88990d06527584816c3c676758c1c950366c3a50bf0fd2df68dceec5a6b995e6dae831ae6de698b122d94d49929a4a05b04698829fa550c143f054ab5e03d481541a97615907db76c1d833dfad01c67cc3b9ae7a67ef71772ac4bd223cddd317084aca73867740a18556d80c9c45b4fd961bbd8f379f2e0789beb71a73a7dcb0b80bdabdf4082723300ce76c08422671300be12298f220b7efdd857ce6787ddd45fd5acfa6d7aaeea47baa0b5f17b8ae1107f3fe8219b72643465b84627028b28b2b87a160a98c7ca76f120cf3d699a6486a74a128512bb41239af1c9e7810060a3a5757000d3ec4a4ca9e74adc790490ad50b0295df9020808afd646464857f6e649ff73d9227d377c2134bb6097fe229d982a67d269fb20c1da3390f6f374d7cac085198299696f5ab91b154eac5b1d911c99ff3d77b774c869cb18bd08158dd766271aad7489707bfbd34d9781d743c1f34c65d2f6f092fe19a3dc964a6cc4c86666cddbb0422095f913b8cc2e2af7008030c98f366d2e58823136905f3c75ac6574aed67ae"}, &(0x7f0000001240)=0x398)

[ 3217.813463][T18315] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:23 executing program 4:
r0 = socket$tipc(0x1e, 0x2, 0x0)
getsockopt$TIPC_SOCK_RECVQ_DEPTH(r0, 0x10f, 0x84, &(0x7f0000001540), &(0x7f0000001580)=0x4)

13:14:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xb00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3217.877828][T18315] device ipvlan1544 entered promiscuous mode
[ 3217.934312][   T29] audit: type=1800 audit(1596806063.622:3064): pid=18315 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16149 res=0
13:14:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:23 executing program 4:
socket(0x3, 0x0, 0x7fffffff)

13:14:23 executing program 4:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
getsockname(r0, 0x0, &(0x7f0000000280))

13:14:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x224e, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3218.067968][T18329] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3218.076280][   T29] audit: type=1804 audit(1596806063.762:3065): pid=18315 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1530/cgroup.controllers" dev="sda1" ino=16149 res=1
[ 3218.168996][T18329] device ipvlan1545 entered promiscuous mode
13:14:27 executing program 4:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000009c0)={'icmp6\x00'}, &(0x7f0000000a00)=0x1e)

13:14:27 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:27 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:27 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x68}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:27 executing program 3:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r1, r0, 0x0, 0x100000002)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000040)={0x0, @dev, @broadcast}, &(0x7f0000000080)=0xc)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r2, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@empty, @random="85958286ac3e", @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:14:27 executing program 0:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockopt$inet6_int(r0, 0x29, 0x46, 0x0, &(0x7f0000000040))

13:14:27 executing program 4:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, &(0x7f0000000300))

[ 3221.398865][T18373] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3221.437395][T18373] device ipvlan1546 entered promiscuous mode
13:14:27 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:27 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:27 executing program 0:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, 0x0, &(0x7f00000002c0))

13:14:27 executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
getsockopt$sock_buf(r0, 0x1, 0x2c, 0x0, &(0x7f00000009c0))

[ 3221.641638][   T29] audit: type=1800 audit(1596806067.322:3066): pid=18373 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16141 res=0
13:14:27 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_pktinfo(r0, 0x0, 0x19, 0x0, &(0x7f0000000180))

13:14:27 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3221.849297][   T29] audit: type=1804 audit(1596806067.372:3067): pid=18373 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1531/cgroup.controllers" dev="sda1" ino=16141 res=1
13:14:27 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x5c00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:27 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x5c00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3221.901373][T18380] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3222.036155][T18380] device ipvlan1547 entered promiscuous mode
13:14:27 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x6c}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3222.747469][T18414] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3222.872693][T18414] device ipvlan1548 entered promiscuous mode
[ 3222.909401][T18414] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3222.914035][   T29] audit: type=1800 audit(1596806068.592:3068): pid=18413 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16168 res=0
[ 3222.959603][T18414] device ipvlan1549 entered promiscuous mode
[ 3222.997748][   T29] audit: type=1804 audit(1596806068.632:3069): pid=18413 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1532/cgroup.controllers" dev="sda1" ino=16168 res=1
13:14:32 executing program 4:
socket$inet_smc(0x2b, 0x1, 0x0)

13:14:32 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000000)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f00000001c0)=0x10)

13:14:32 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x7000, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:32 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x7000, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:32 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x74}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:32 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x101b83, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x10)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xb, 0x4, 0x1, 0x8000, 0xd0, 0xffffffffffffffff, 0x7, [], 0x0, 0xffffffffffffffff, 0x40000004, 0x2, 0x4}, 0x40)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r3, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r3, 0x0)
r4 = accept4$llc(r3, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000140)=0x10, 0x80800)
r5 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)}, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000880)={0xffffffffffffffff, 0xc0, &(0x7f0000000a40)={0x0, <r6=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0xfffffffffffffe06)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080)={r6}, 0xc)
r7 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000180)={r6}, 0xc)
r8 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r8, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
clock_gettime(0x0, &(0x7f00000002c0)={<r9=>0x0, <r10=>0x0})
ppoll(&(0x7f0000000240)=[{0xffffffffffffffff, 0x3080}, {r2}, {r4, 0x8}, {r0, 0x8000}, {r0, 0x480}, {r5, 0x6a6bc10aaa53a9e3}, {r1, 0xc428}, {r7, 0x659e3f5c55fc39bc}, {r0, 0x40}, {r8, 0x1404}], 0xa, &(0x7f0000000300)={r9, r10+10000000}, &(0x7f0000000340)={[0x640c]}, 0x8)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="9f80bb57964baaaa7ae4c76e9484a832a5881686b17a63aaaaaaaa0000000011907813a9b33cac1414bb040200000000000000000800940000000888be0000444aa53ff1aef7cc00eb00000000200000ed0600000000000000000000000800655810000000000000a57476c5037b00000000000000"], 0x66)

[ 3226.438172][T18437] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3226.583305][T18437] device ipvlan1550 entered promiscuous mode
13:14:32 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x7f00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:32 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x7f00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:32 executing program 4:
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @loopback}]}, 0x0)
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x82, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8)

13:14:32 executing program 0:
getsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x2)
r0 = socket(0x11, 0x2, 0x0)
getsockopt$packet_buf(r0, 0x107, 0xb, &(0x7f0000000040)=""/160, &(0x7f0000000100)=0xa0)

13:14:32 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x80fe, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3226.665521][   T29] audit: type=1800 audit(1596806072.342:3070): pid=18439 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16169 res=0
[ 3226.691052][T18438] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
13:14:32 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x80fe, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:32 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x25, 0x0, &(0x7f00000002c0))

13:14:32 executing program 0:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000000000)=[@in={0x2, 0x0, @remote}, @in={0x11, 0x0, @loopback}]}, &(0x7f0000000080)=0x10)

[ 3226.823543][T18438] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3226.826093][   T29] audit: type=1804 audit(1596806072.502:3071): pid=18437 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1533/cgroup.controllers" dev="sda1" ino=16169 res=1
13:14:32 executing program 4:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000004000)={0x0, 0x10, &(0x7f0000003fc0)=[@in={0x2, 0x0, @dev}]}, &(0x7f0000004040)=0x10)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000080)=ANY=[@ANYBLOB="5b25911d", @ANYRES32=<r1=>0x0], &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000180)={r1}, &(0x7f0000000300)=0x14)

[ 3226.978961][T18445] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:32 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3227.069354][T18445] device ipvlan1551 entered promiscuous mode
13:14:33 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x7a}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3228.505463][   T29] audit: type=1800 audit(1596806074.183:3072): pid=18487 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16172 res=0
[ 3228.646804][   T29] audit: type=1804 audit(1596806074.323:3073): pid=18487 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1534/cgroup.controllers" dev="sda1" ino=16172 res=1
[ 3229.207981][T18485] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3229.243350][T18485] device ipvlan1552 entered promiscuous mode
[ 3229.260076][T18490] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3229.280177][T18490] device ipvlan1553 entered promiscuous mode
13:14:36 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r3, r2, 0x0, 0x100000002)
getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @initdev}, &(0x7f0000000080)=0xc)
write$tun(r0, &(0x7f0000000240)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x8e, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}, {0x8, 0x6558, 0x0, "eb553ee411fb9b37af09000000956e499fe9576dd54d57a341e0e4a5cf859db099e94124ed545b50d6007f35a60396546e56087059c5"}}}}}}}, 0xa0)

[ 3231.187244][T18511] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3231.310466][T18511] device ipvlan1554 entered promiscuous mode
13:14:36 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:36 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0xa, 0x0, &(0x7f00000002c0))

13:14:36 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xfc00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:36 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getpeername$l2tp(r0, 0x0, 0x0)

13:14:36 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0xf0}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:36 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xfe80, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:36 executing program 4:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
r1 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000004000)={0x0, 0x10, &(0x7f0000003fc0)=[@in={0x2, 0x0, @dev}]}, &(0x7f0000004040)=0x10)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000080)={0x1, [<r2=>0x0]}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2}, &(0x7f0000000100)=0x20)

13:14:36 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xfc00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:36 executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_buf(r0, 0x29, 0x6, 0x0, &(0x7f0000000180))

[ 3231.379089][   T29] audit: type=1800 audit(1596806077.063:3074): pid=18511 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16325 res=0
[ 3231.379130][T18516] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:37 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:37 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xfe80, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3231.587042][T18516] device ipvlan1555 entered promiscuous mode
13:14:42 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r3, r2, 0x0, 0x100000002)
r4 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000a80)=@newtaction={0x104, 0x30, 0x53b, 0x0, 0x0, {}, [{0xf0, 0x1, [@m_skbmod={0xec, 0x1b, 0x0, 0x0, {{0xb, 0x1, 'skbmod\x00'}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_DMAC={0xa, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @multicast}, @TCA_SKBMOD_SMAC={0xa}]}, {0xb4, 0x6, "cf0a58e0aad87173849f5e74d134cc2978f19d6bf9c8c04a42d9a7f6566051e0483fe0844ddd43172a626f520b3b5bced0589736668e45cd3967f6475a6f2ae95df3cfb8349c23511da0f862fd711af4380c937507ae5bda3111616a514a645568f94e31062c103d6fc32df2d8768e55427454e253b65c718de2cb2b2b56f59a7d858fda9a8499730cb6c5f3e76a357d2ad15780cedeaa046177f9d29320fbc5a2ed9c54cfe31acb3eb77819ecc6f71e"}}}]}]}, 0x104}}, 0x48001)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r6, r5, 0x0, 0x100000002)
getsockopt$bt_BT_POWER(r5, 0x112, 0x9, &(0x7f0000000280)=0x9, &(0x7f00000002c0)=0x1)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00')
sendmsg$NL80211_CMD_REQ_SET_REG(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, r8, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NL80211_CMD_GET_STATION(r4, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x8c, r8, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@NL80211_ATTR_STA_FLAGS={0x8, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_MFP={0x4}]}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x758}, @NL80211_ATTR_STA_WME={0x4c, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x81}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x2}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x80}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0xff}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x80}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x5}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x8f}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x6}]}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x100, 0xffffffff}}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x2b}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x1)
sendmsg$NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x48, r8, 0x800, 0x70bd29, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0xffffffffffffffff}, @NL80211_ATTR_REG_RULES={0x2c, 0x22, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x401}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x7}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x1f32}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x5}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xe04}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000004)

13:14:42 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$inet6_sctp(0xa, 0x0, 0x84)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x15, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, @in6={{0xa, 0x3f00, 0x0, @ipv4={[], [], @private}}}}, &(0x7f0000000140)=0x98)

13:14:42 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x300}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:42 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:42 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:42 executing program 4:
r0 = socket$inet_dccp(0x2, 0x6, 0x0)
accept4(r0, 0x0, 0x0, 0x0)

[ 3237.117402][T18565] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3237.141711][T18565] device ipvlan1556 entered promiscuous mode
[ 3237.183783][   T29] audit: type=1800 audit(1596806082.863:3075): pid=18565 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16331 res=0
13:14:42 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:42 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_tcp_int(r0, 0x6, 0x12, 0x0, &(0x7f0000001ec0))

13:14:42 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:43 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000001900)={@remote, @broadcast}, &(0x7f0000001940)=0x8)

13:14:43 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3237.425735][   T29] audit: type=1804 audit(1596806083.073:3076): pid=18575 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1536/cgroup.controllers" dev="sda1" ino=16331 res=1
13:14:43 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000980), &(0x7f00000009c0)=0x30)

13:14:44 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
pipe(&(0x7f0000000040))
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'vlan0\x00', {0x7, 0x4e23, @loopback}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:14:44 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x3e7}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:44 executing program 4:
r0 = socket$xdp(0x2c, 0x3, 0x0)
getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000000))

13:14:44 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:44 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:44 executing program 0:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
clock_gettime(0x0, &(0x7f0000001140))
recvmmsg(r0, &(0x7f0000001000)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000240)=""/191, 0xbf}], 0x1}}], 0x2, 0x0, 0x0)

13:14:44 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:44 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3239.183338][T18619] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:44 executing program 4:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000080), &(0x7f00000000c0)=0x8)

13:14:44 executing program 0:
r0 = socket$nl_crypto(0x10, 0x3, 0x15)
recvmmsg(r0, 0x0, 0x0, 0x2001, 0x0)

13:14:45 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3239.255915][T18619] device ipvlan1557 entered promiscuous mode
13:14:45 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3239.311235][   T29] audit: type=1800 audit(1596806084.994:3077): pid=18625 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16381 res=0
[ 3239.347727][T18625] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3239.490093][T18625] device ipvlan1558 entered promiscuous mode
13:14:48 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:48 executing program 4:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000004000)={0x0, 0x10, &(0x7f0000003fc0)=[@in={0x2, 0x0, @dev}]}, &(0x7f0000004040)=0x10)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000080)={0x1, [<r2=>0x0]}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000100)={<r3=>r2}, &(0x7f0000000140)=0x10)
getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x6c, &(0x7f0000000200)={r3}, &(0x7f0000000240)=0x18)

13:14:48 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000240), 0x0)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, @in6={{0xa, 0x3f00, 0x0, @ipv4={[], [], @private}}}}, &(0x7f0000000140)=0x98)

13:14:48 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:48 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x500}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:48 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r2, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001180)={0x5c, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}]}, 0x5c}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x28, r4, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'nr0\x00'}]}, 0x28}}, 0x84)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r6, r5, 0x0, 0x100000002)
sendmsg$IPSET_CMD_TEST(r6, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x60, 0xb, 0x6, 0x101, 0x0, 0x0, {0xd, 0x0, 0x7}, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x200}, @IPSET_ATTR_ADT={0x44, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x101}}, {0x18, 0x7, 0x0, 0x1, @IPSET_ATTR_IFACE={0x14, 0x17, 'veth1_vlan\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0x3}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x24000001}, 0x4881)
r7 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r7, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000003c0)={'vxcan0\x00', <r8=>0x0})
ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000400)=r8)
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

[ 3242.631680][T18670] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:48 executing program 0:
r0 = socket$packet(0x11, 0x2, 0x300)
getsockopt$packet_int(r0, 0x107, 0x0, 0x0, 0xfffffffffffffffd)

13:14:48 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3242.679814][T18670] device ipvlan1559 entered promiscuous mode
13:14:48 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3242.776681][   T29] audit: type=1800 audit(1596806088.464:3078): pid=18679 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16034 res=0
13:14:48 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:48 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3242.898085][   T29] audit: type=1804 audit(1596806088.584:3079): pid=18690 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir327749771/syzkaller.if7ufm/1401/cgroup.controllers" dev="sda1" ino=16049 res=1
[ 3242.927010][T18690] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
13:14:48 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000002280)={0x0, 0x2c, &(0x7f00000021c0)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x2}}, @in6={0xa, 0x4e21, 0x0, @local, 0x7}]}, &(0x7f00000022c0)=0x10)

[ 3242.944275][T18690] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3242.958848][T18687] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3242.966523][   T29] audit: type=1804 audit(1596806088.614:3080): pid=18670 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1538/cgroup.controllers" dev="sda1" ino=16034 res=1
[ 3243.036625][T18687] device ipvlan1560 entered promiscuous mode
13:14:48 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:49 executing program 4:
r0 = socket(0x25, 0x1, 0x0)
recvmsg$kcm(r0, &(0x7f0000000b40)={0x0, 0x0, 0x0}, 0x0)

13:14:49 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:49 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x600}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:49 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3243.890291][T18723] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3243.909530][T18723] device ipvlan1561 entered promiscuous mode
[ 3244.007305][T18723] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3244.019151][   T29] audit: type=1800 audit(1596806089.694:3081): pid=18717 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15954 res=0
[ 3244.036833][T18723] device ipvlan1562 entered promiscuous mode
[ 3244.085752][   T29] audit: type=1804 audit(1596806089.754:3082): pid=18717 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1539/cgroup.controllers" dev="sda1" ino=15954 res=1
13:14:53 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:53 executing program 0:
r0 = socket$packet(0x11, 0x2, 0x300)
recvmmsg(r0, &(0x7f0000006400)=[{{0x0, 0x0, 0x0}, 0xed1}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x3, 0x10000, 0x0)

13:14:53 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:53 executing program 4:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
r2 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000004000)={0x0, 0x10, &(0x7f0000003fc0)=[@in={0x2, 0x0, @dev}]}, &(0x7f0000004040)=0x10)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000080)={0x1, [<r3=>0x0]}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>r3}, &(0x7f0000000040)=0x20)
getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000080)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0x0, @private}}}}, &(0x7f0000000140)=0xb0)

13:14:53 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x700}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:53 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
ioctl$sock_ifreq(r2, 0x8915, &(0x7f0000000040)={'team0\x00', @ifru_map={0x9d41, 0xb555, 0x1, 0x9, 0x2, 0xa9}})
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:14:53 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3247.556538][T18743] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:53 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:53 executing program 0:
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
recvmsg(r0, &(0x7f0000001840)={0x0, 0x0, 0x0}, 0x0)

[ 3247.666390][T18753] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3247.676236][T18753] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3247.679138][T18743] device ipvlan1563 entered promiscuous mode
13:14:53 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:53 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x70, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3247.965711][T18750] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:53 executing program 0:
r0 = socket(0x11, 0x2, 0x0)
getsockopt$packet_int(r0, 0x107, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0x4)

[ 3248.032679][T18750] device ipvlan1564 entered promiscuous mode
13:14:53 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x70, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:53 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:53 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:54 executing program 4:
r0 = socket$kcm(0x29, 0x5, 0x0)
accept(r0, 0x0, 0x0)

13:14:54 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x900}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3248.919924][T18791] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3248.956994][T18791] device ipvlan1565 entered promiscuous mode
[ 3248.993954][   T29] audit: type=1800 audit(1596806094.675:3083): pid=18790 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16018 res=0
[ 3249.016015][T18791] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3249.063873][   T29] audit: type=1804 audit(1596806094.745:3084): pid=18790 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1541/cgroup.controllers" dev="sda1" ino=16018 res=1
[ 3249.128304][T18791] device ipvlan1566 entered promiscuous mode
13:14:59 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:59 executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$sock_int(r0, 0x1, 0x2d, 0x0, &(0x7f0000000040))

13:14:59 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:59 executing program 4:
syz_genetlink_get_family_id$netlbl_calipso(0x0)
sendmsg$NLBL_CALIPSO_C_LIST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0)
sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$inet6(0xa, 0x3, 0x7)
connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2={0xfc, 0x2, [], 0x1}, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7f}, {}, 0x0, 0x0, 0x1}, {{@in=@remote, 0x0, 0x33}, 0x0, @in, 0x0, 0x0, 0x0, 0x6, 0xfffffffe}}, 0xe8)
sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0x0)

13:14:59 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0xd5f}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:14:59 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f0000000280)={0x0, 0x1, [], [@ra={0x5, 0x2, 0x1}, @ra={0x5, 0x2, 0x4}, @enc_lim={0x4, 0x1, 0x80}]}, 0x18)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c8, &(0x7f0000000100))
getpeername(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, <r4=>0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, &(0x7f0000000080)=0x80)
r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100)='NLBL_MGMT\x00')
sendmsg$NLBL_MGMT_C_ADD(r4, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4080}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="28000000d3a827eed4a72a9f5e16245d257c0c15f9233f9c6802b2c98161b5bff64efce7c32674b75b51d2519c2391c2", @ANYRES16=r5, @ANYBLOB="040029bd7000fbdbdf250100000014000500ff010000000000000000000000000001"], 0x28}, 0x1, 0x0, 0x0, 0x850}, 0x8000c40)
sendmsg$NLBL_MGMT_C_LISTALL(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x30, r5, 0x8, 0x70bd2d, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1={0xfc, 0x1, [], 0x1}}]}, 0x30}, 0x1, 0x0, 0x0, 0x5}, 0x24000040)
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

[ 3253.900104][T18809] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3253.975723][T18809] device ipvlan1567 entered promiscuous mode
13:14:59 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:59 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:59 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x4b, 0x0, &(0x7f0000001b00))

[ 3254.094088][   T29] audit: type=1800 audit(1596806099.775:3085): pid=18815 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16369 res=0
[ 3254.267600][   T29] audit: type=1804 audit(1596806099.955:3086): pid=18809 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1542/cgroup.controllers" dev="sda1" ino=16369 res=1
[ 3254.305242][T18830] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:14:59 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:14:59 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:00 executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_pktinfo(r0, 0x0, 0x21, 0x0, &(0x7f0000000180))

13:15:00 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3254.365839][T18830] device ipvlan1568 entered promiscuous mode
13:15:00 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:00 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0xe00}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:00 executing program 4:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
getsockname(r0, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, &(0x7f0000000080)=0x80)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x76, &(0x7f0000000000)=@assoc_value={<r2=>0x0}, &(0x7f0000000040)=0x8)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000100)={r2}, &(0x7f0000000140)=0x10)

13:15:00 executing program 0:
r0 = socket$packet(0x11, 0x2, 0x300)
recvmmsg(r0, &(0x7f0000003280)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20, 0x0)

[ 3255.294522][T18852] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3255.327113][T18852] device ipvlan1569 entered promiscuous mode
[ 3255.403730][   T29] audit: type=1800 audit(1596806101.085:3087): pid=18852 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16366 res=0
[ 3255.425767][T18852] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3255.458214][T18852] device ipvlan1570 entered promiscuous mode
[ 3255.475005][   T29] audit: type=1804 audit(1596806101.155:3088): pid=18850 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1543/cgroup.controllers" dev="sda1" ino=16366 res=1
[ 3259.283264][    T0] NOHZ: local_softirq_pending 08
13:15:06 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xb00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:06 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xb00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:06 executing program 4:
r0 = socket$inet_dccp(0x2, 0x6, 0x0)
getsockopt$EBT_SO_GET_INFO(r0, 0x10d, 0xf, &(0x7f0000000140)={'broute\x00'}, &(0x7f0000000040)=0x27)

13:15:06 executing program 0:
r0 = socket$inet_sctp(0x2, 0x3, 0x84)
recvmsg(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000002c0)={0x0, 0x10, &(0x7f0000000200)=[@in={0x2, 0x0, @loopback}]}, &(0x7f0000000300)=0x10)
recvmsg$can_raw(r0, &(0x7f0000001780)={0x0, 0x0, 0x0}, 0x0)

13:15:06 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x2000}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:06 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xf00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3260.562721][T18880] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:06 executing program 4:
r0 = socket$inet_dccp(0x2, 0x6, 0x0)
getsockopt$EBT_SO_GET_INFO(r0, 0x10d, 0xe, &(0x7f0000000140)={'broute\x00'}, &(0x7f0000000040)=0x27)

[ 3260.648623][T18880] device ipvlan1571 entered promiscuous mode
[ 3260.779596][   T29] audit: type=1800 audit(1596806106.466:3089): pid=18882 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16368 res=0
[ 3260.817312][T18882] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:06 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r1, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00000000000000002800120009000100766574800000000018000200140001000000000001afe11fbf9831b1e73c4bdd3a7ef7687654299b280726fc15daba606fb231d6aa207b0aa8f9b55290e2e537e814d6bb9828d69e8c268bd10900a76ca457530756b4c0", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000001140)=ANY=[@ANYBLOB="38000001240007050000004007a2a3000500000098f6d59af3ac306b26127aa0c2e3a45df013b30bfcb559b8fae224", @ANYRES32=r2, @ANYBLOB="00000000ffffffff0099b2b1677e13f97d66736300000000080002080001382793556bc1103f1f878a71a8df1f6eea02eb8f7ef19e5854d6ad58c921d994f7b3188941a319e08626b7ca4aa919941862656571f9ee8c295d4b86a39f0d7229a9cc61abe7bcaa2e0908a5bc742976eb999d00000000000000000000000083ead4bf0cbad0ff1d242d54a2931f2175682f19ee64ecb3bcb576c19bc7058cc3e0eacc3e12a6a54dcf67f871fbaff1d94743e8b04095b40029e03f9a3c307f85375350b5bb3d70a5615e556ea1e162924e8d62b43c960272cc3838a5f935d7377f354376e7348dfe6b05e705fc532a51a45d29ffe869a0c50123cacf666f76af01e06e3c72c177bfb61ca0574e1cde"], 0x38}, 0x1, 0x0, 0x0, 0x24000805}, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@initdev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f0000000980)=0xe8)
setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@mcast1, @in6=@dev={0xfe, 0x80, [], 0x2c}, 0x4e20, 0xfff, 0x4e24, 0x1, 0x2, 0x20, 0xa0, 0x3c, r2, r3}, {0x1, 0x1ff, 0x7f6, 0x3, 0x1000, 0x4, 0xfa3d}, {0x6, 0x5, 0x9, 0xffffffff}, 0x0, 0x6e6bb8, 0x2, 0x1}, {{@in6=@loopback, 0x4d2, 0xab}, 0xa, @in=@multicast1, 0x0, 0x1, 0x3, 0x4, 0x9, 0x10001}}, 0xe8)
ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f0000000040)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r3})
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r4 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:15:06 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xf00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3260.889035][T18882] device ipvlan1572 entered promiscuous mode
[ 3260.902930][   T29] audit: type=1804 audit(1596806106.556:3090): pid=18880 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1544/cgroup.controllers" dev="sda1" ino=16368 res=1
13:15:06 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:06 executing program 4:
socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000100)=""/70, &(0x7f0000000400)=0x46)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000440), &(0x7f00000004c0)=0x68)

13:15:06 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x224e, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:06 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x3000}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:06 executing program 4:
socket(0x22, 0x0, 0x8)

13:15:06 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:07 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000000)=""/68, &(0x7f0000000080)=0x44)
getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f00000000c0)=""/212, &(0x7f00000001c0)=0xd4)

13:15:07 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:07 executing program 4:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @ipv4={[], [], @local}}]}, &(0x7f00000000c0)=0x10)
getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000300)={0x0, 0x1c, "a30e40251c113e08fcd621cb5d259cfb07123194d7adb3ecd9c724a1"}, &(0x7f0000000100)=0x24)

13:15:07 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x5c00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3261.640158][T18932] IPVS: length: 68 != 24
[ 3261.659377][T18932] IPVS: length: 212 != 24
[ 3261.686818][T18932] IPVS: length: 68 != 24
[ 3261.705258][T18933] IPVS: length: 212 != 24
[ 3262.077841][   T29] audit: type=1800 audit(1596806107.766:3091): pid=18923 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16382 res=0
[ 3262.141743][   T29] audit: type=1804 audit(1596806107.826:3092): pid=18923 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1545/cgroup.controllers" dev="sda1" ino=16382 res=1
[ 3262.259862][T18915] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3262.278101][T18915] device ipvlan1573 entered promiscuous mode
[ 3262.296361][T18936] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3262.334292][T18936] device ipvlan1574 entered promiscuous mode
13:15:12 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88602, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r2, 0x0)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000040)=0x1, 0x4)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f00000001c0)={@val={0x2}, @void, @eth={@random="9f84bb57964b", @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @remote}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x6}}}}}}}}, 0x6a)

13:15:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x7000, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:12 executing program 0:

13:15:12 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x3f00}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:12 executing program 4:

13:15:12 executing program 0:

13:15:12 executing program 4:

[ 3266.461817][T18953] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x7f00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3266.564589][T18953] device ipvlan1575 entered promiscuous mode
13:15:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x4e22, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3266.653830][   T29] audit: type=1800 audit(1596806112.346:3093): pid=18958 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16383 res=0
13:15:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:12 executing program 0:

[ 3266.707755][T18970] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3266.936436][T18970] device ipvlan1576 entered promiscuous mode
13:15:15 executing program 3:

13:15:15 executing program 4:

13:15:15 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x5c00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:15 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:15 executing program 0:

13:15:15 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x4000}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:15 executing program 3:

13:15:15 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x7000, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:15 executing program 4:

[ 3270.202759][T19003] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:15 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:15 executing program 0:

13:15:16 executing program 3:

13:15:16 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x7f00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:16 executing program 4:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000002280)={0x0, 0x1c, &(0x7f00000021c0)=[@in6={0xa, 0x0, 0x0, @local={0xfe, 0x0}}]}, &(0x7f00000022c0)=0x10)

13:15:16 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3270.451612][T19003] device ipvlan1577 entered promiscuous mode
[ 3270.491270][T19006] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3270.508020][   T29] audit: type=1800 audit(1596806116.197:3094): pid=19003 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16370 res=0
13:15:16 executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
r1 = socket$inet6(0xa, 0x3, 0x7)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@remote, 0x0, 0x33}, 0x0, @in, 0x0, 0x0, 0x0, 0x6}}, 0xe8)
sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0)

13:15:16 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x11, @rand_addr, 0x0, 0x0, 'none\x00', 0x0, 0x1}, 0x2c)

[ 3270.548896][T19006] device ipvlan1578 entered promiscuous mode
[ 3270.590861][   T29] audit: type=1804 audit(1596806116.247:3095): pid=19003 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1547/cgroup.controllers" dev="sda1" ino=16370 res=1
13:15:16 executing program 3:

13:15:16 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:16 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x4088}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:16 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:16 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:16 executing program 3:

[ 3271.009454][T19038] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:16 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3271.124022][T19038] device ipvlan1579 entered promiscuous mode
13:15:16 executing program 3:

[ 3271.349949][   T29] audit: type=1800 audit(1596806117.037:3096): pid=19037 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16376 res=0
[ 3271.372856][T19038] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3271.422618][   T29] audit: type=1804 audit(1596806117.107:3097): pid=19037 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1548/cgroup.controllers" dev="sda1" ino=16376 res=1
[ 3271.503715][T19038] device ipvlan1580 entered promiscuous mode
13:15:17 executing program 4:

13:15:17 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:17 executing program 0:

13:15:17 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:17 executing program 3:

13:15:17 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x4800}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

[ 3271.816172][T19066] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:17 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:17 executing program 4:

13:15:17 executing program 3:

13:15:17 executing program 0:

13:15:17 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3271.942693][T19066] device ipvlan1581 entered promiscuous mode
13:15:17 executing program 4:

13:15:17 executing program 3:

13:15:17 executing program 0:

13:15:17 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3272.093439][   T29] audit: type=1800 audit(1596806117.747:3098): pid=19071 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16369 res=0
[ 3272.120596][T19079] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:17 executing program 4:

[ 3272.263167][   T29] audit: type=1804 audit(1596806117.857:3099): pid=19066 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1549/cgroup.controllers" dev="sda1" ino=16369 res=1
[ 3272.305974][T19079] device ipvlan1582 entered promiscuous mode
13:15:17 executing program 0:

13:15:18 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x4c00}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:18 executing program 3:

13:15:18 executing program 4:

13:15:18 executing program 0:

13:15:18 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3272.654082][T19098] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:18 executing program 3:

13:15:18 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newlink={0x20, 0x11, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, r3}}, 0x20}}, 0x0)

13:15:18 executing program 4:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x7f00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:18 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3272.754398][T19098] device ipvlan1583 entered promiscuous mode
13:15:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3273.016435][   T29] audit: type=1800 audit(1596806118.707:3100): pid=19098 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16374 res=0
[ 3273.038496][T19100] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3273.120398][T19100] device ipvlan1584 entered promiscuous mode
[ 3273.135377][   T29] audit: type=1804 audit(1596806118.787:3101): pid=19098 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1550/cgroup.controllers" dev="sda1" ino=16374 res=1
[ 3273.176539][T19110] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
13:15:19 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5f0d}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:19 executing program 3:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:19 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:19 executing program 4:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:19 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:19 executing program 3:

13:15:19 executing program 4:

13:15:19 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3273.565162][T19136] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3273.637109][T19136] device ipvlan1585 entered promiscuous mode
[ 3273.673747][   T29] audit: type=1800 audit(1596806119.367:3102): pid=19135 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16033 res=0
[ 3273.675450][T19136] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3273.777133][   T29] audit: type=1804 audit(1596806119.427:3103): pid=19135 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1551/cgroup.controllers" dev="sda1" ino=16033 res=1
[ 3273.793012][T19136] device ipvlan1586 entered promiscuous mode
13:15:22 executing program 0:

13:15:22 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:22 executing program 3:

13:15:22 executing program 4:

13:15:22 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:22 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x6000}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:22 executing program 4:

[ 3276.526845][T19167] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:22 executing program 3:

13:15:22 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:22 executing program 0:
poll(&(0x7f0000000040)=[{}], 0x2f, 0x0)

13:15:22 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3276.745421][T19167] device ipvlan1587 entered promiscuous mode
13:15:22 executing program 4:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=ANY=[], 0x80}}, 0x0)
sendmmsg(r0, &(0x7f0000000180), 0x400000000000282, 0x0)

[ 3276.901480][   T29] audit: type=1800 audit(1596806122.587:3104): pid=19168 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15735 res=0
13:15:22 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
sendmmsg$inet(r0, &(0x7f0000003000)=[{{&(0x7f0000000240)={0x2, 0x4e20, @remote}, 0x10, 0x0, 0x0, &(0x7f0000001400)=[@ip_retopts={{0xc}}], 0xc}}], 0x1, 0x0)

13:15:22 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:22 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@ipv6_newroute={0x28, 0x18, 0xb03, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_MULTIPATH={0xc, 0x9, {0x8}}]}, 0x28}}, 0x0)

[ 3277.080736][   T29] audit: type=1804 audit(1596806122.657:3105): pid=19167 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1552/cgroup.controllers" dev="sda1" ino=15735 res=1
13:15:22 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:22 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x6800}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:23 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
recvmmsg(r0, &(0x7f0000005540)=[{{0x0, 0x28000000, &(0x7f0000000240)=[{&(0x7f0000001340)=""/4067, 0x20002323}], 0x1, 0x0, 0x983af3f8, 0x103}}], 0x1, 0x0, 0x0)
sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967480a41ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x170)

13:15:23 executing program 0:
r0 = socket$inet(0x10, 0x3, 0xc)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0)

[ 3277.400339][T19193] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3277.590258][T19193] device ipvlan1588 entered promiscuous mode
[ 3277.602543][T19206] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'.
13:15:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3277.734634][   T29] audit: type=1800 audit(1596806123.427:3106): pid=19197 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16381 res=0
[ 3277.756763][T19199] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:23 executing program 0:
r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r0, &(0x7f0000000000)={{0x6, @rose={0xbb, 0xbb, 0xbb, 0x2, 0x0}}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose, @null, @null, @default, @rose, @rose, @bcast]}, 0x48)

[ 3277.888999][T19199] device ipvlan1589 entered promiscuous mode
13:15:24 executing program 4:
r0 = socket$kcm(0x29, 0x2, 0x0)
r1 = socket$kcm(0x2, 0x200000000000001, 0x0)
sendmsg$inet(r1, &(0x7f0000000fc0)={&(0x7f00000002c0)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x24000844)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000600)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36bb3019c13bd2321af3cf1a54f26fb0b71d0e6adfefcf1d8f7faf75e0f226bd917487960717142fa9ea4318123751c0a0e168c1886d050194777d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ceb9fbfbf9b0a4def23d410f6296b32a83438810720a159cda903634e369a9e152ddcc7b1b85f3caeaccd3641110bec4e9027a0c80539bfc3a96d2e8910c2c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd963218ce740068725837074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa000000000000000000000000000000000000000000000000020000000000000000000000000000b27cf3d1848a74d7132b388b3d56b2e9b5d429d22ce1ffb0adf9deab29ea3323aa9fdf19efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f03020000000000001cf41ab11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b540500a30b23bcee46762c2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec309baed0495f06d058a73651d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d971f7a2591dbe4a912ffaf6fefd92239eafce5c1d5f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73755539280b064bda144910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06dddeb61799257ab55ff413c86ba9affb12ec757c7234c270246c878d01160ebf6cf8809c3a0d462357b22515567230ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972ea3b77641467c89fa0f82e8440105051e5510a33dcda5e143fbf221fff161c12ca389cbe4c51b3fa00675cc175067d2a214f8c9d9b2ecf63b66c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e378a9b15bc22449e298727340e87cdefb40e56e9cfad973347d0de7ba4754ff231a1b933d8f04000000000000003f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2af79b8d4c2bf0f7a2cb032dad13007b82e6044f643fc8cd47ae636a5dbe9864a117d27326850a7c3b570863f532c7005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991af603e3856a346cf7f9fe0bc9f2a1a7506d35e5eb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29ab0f1a342c9eed00000000ab6648a9dea00000753f8b349b12ed9c640bdce268f41bde6f3dddd45f5397d3dd1b24d80d5219724b771b8051b9d2a3bf9379605a81e91cbdebd7fb413c452be3454a61c20d6d3a5000"/1215], &(0x7f0000000140)='GPL\x00'}, 0x48)
ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000003c0)={r1, r2})
ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000100)={r1})
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)

13:15:24 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:24 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:24 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x6c00}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:24 executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x4, 0x5, 0x8}, 0x40)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000240)={r0, &(0x7f00000003c0), 0x0}, 0x20)

13:15:24 executing program 3:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
connect$bt_sco(r0, &(0x7f0000000000)={0x1f, @fixed={[], 0x10}}, 0x8)

[ 3279.252512][T19234] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:25 executing program 0:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000000c0)=0xb4, 0x4)
bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10)
sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[], 0x150}}, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='highspeed\x00', 0xa)
recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f0000000380)=""/46, 0x2e}, {&(0x7f0000001600)=""/188, 0xbc}], 0x2}, 0x0)
sendto$inet(r0, &(0x7f00000012c0)='\f', 0x1, 0x0, 0x0, 0x0)

13:15:25 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3279.431269][T19234] device ipvlan1590 entered promiscuous mode
13:15:25 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3279.578355][   T29] audit: type=1800 audit(1596806125.267:3107): pid=19238 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16372 res=0
[ 3279.601459][T19240] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:25 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3279.718438][T19240] device ipvlan1591 entered promiscuous mode
13:15:25 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:25 executing program 4:
r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r0, &(0x7f0000000000)={{0x2, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose, @null, @null, @default, @rose, @rose, @bcast]}, 0x48)

13:15:25 executing program 0:

13:15:25 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x7400}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:25 executing program 3:

13:15:25 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:25 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:26 executing program 0:

[ 3280.253163][T19267] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:26 executing program 4:

[ 3280.487351][T19267] device ipvlan1592 entered promiscuous mode
13:15:26 executing program 3:

13:15:26 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:26 executing program 0:

13:15:26 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3280.689390][   T29] audit: type=1800 audit(1596806126.378:3108): pid=19269 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16382 res=0
[ 3280.712341][T19271] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:26 executing program 4:

13:15:26 executing program 3:

[ 3280.900037][T19271] device ipvlan1593 entered promiscuous mode
13:15:26 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x7a00}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:26 executing program 0:

13:15:26 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:26 executing program 4:

13:15:26 executing program 3:

13:15:26 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:27 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:27 executing program 4:

[ 3281.417389][T19301] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:27 executing program 0:
r0 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c)

13:15:27 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7113})
ioctl$TUNSETVNETLE(r0, 0x800454d2, 0x0)

13:15:27 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3281.662857][T19301] device ipvlan1594 entered promiscuous mode
13:15:27 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x17, &(0x7f0000000000)=0x2, 0x4)
shutdown(r0, 0x1)
socket$netlink(0x10, 0x3, 0xf)
writev(r0, &(0x7f00000000c0)=[{0x0}], 0x1)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(0x0)
sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, 0x0, 0x0)
sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x59)
bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty}, 0x1c)
ioctl$SIOCAX25DELUID(0xffffffffffffffff, 0x89e2, 0x0)
recvmsg(0xffffffffffffffff, 0x0, 0x0)
setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x0, 0x0, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4)
sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000009, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c)

[ 3281.874965][   T29] audit: type=1800 audit(1596806127.568:3109): pid=19302 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15735 res=0
[ 3281.987229][   T29] audit: type=1804 audit(1596806127.638:3110): pid=19301 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1556/cgroup.controllers" dev="sda1" ino=15735 res=1
[ 3287.173374][T19303] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3287.208475][T19303] device ipvlan1595 entered promiscuous mode
13:15:32 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0xe703}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:32 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:32 executing program 0:
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="7c00000024007165980900000000000000001fe3", @ANYRES32, @ANYBLOB="00000000ffffffff000000800900010067726564"], 0x7c}}, 0x0)
r0 = socket(0x10, 0x80002, 0x0)
sendmmsg$alg(r0, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0x5, &(0x7f0000000100)}], 0x492492492492642, 0x0)

13:15:32 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:32 executing program 4:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448e3, 0x0)

13:15:33 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:33 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3287.465294][T19345] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:33 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendto$packet(r4, 0x0, 0x0, 0x0, 0x0, 0x0)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700000066a1310b5531ef8e55", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14)
sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001000050700000000000000004ac3a896c5d56d6cff00000000", @ANYRES32=r7, @ANYBLOB="002d000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x3, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8, 0x1, 'hsr\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r5}, @IFLA_HSR_SLAVE2={0x8, 0x2, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x48}}, 0x0)

[ 3287.636773][T19345] device ipvlan1596 entered promiscuous mode
[ 3287.727734][T19344] netlink: 76 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3287.752141][   T29] audit: type=1800 audit(1596806133.448:3111): pid=19346 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16370 res=0
13:15:33 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3287.800125][T19346] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3287.909771][   T29] audit: type=1804 audit(1596806133.538:3112): pid=19345 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1557/cgroup.controllers" dev="sda1" ino=16370 res=1
[ 3287.949490][T19346] device ipvlan1597 entered promiscuous mode
[ 3288.019692][T19358] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3288.122937][T19344] netlink: 76 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 3288.158025][T19355] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3288.184551][T19359] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
13:15:36 executing program 3:

13:15:36 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:36 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:36 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0xf000}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:36 executing program 0:

13:15:36 executing program 0:

[ 3290.897088][T19383] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:36 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:36 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5c00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:36 executing program 3:

[ 3291.053214][T19383] device ipvlan1598 entered promiscuous mode
[ 3291.164825][   T29] audit: type=1800 audit(1596806136.859:3113): pid=19387 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16308 res=0
13:15:36 executing program 0:

[ 3291.221815][T19387] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3291.347853][   T29] audit: type=1804 audit(1596806136.959:3114): pid=19383 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1558/cgroup.controllers" dev="sda1" ino=16308 res=1
[ 3291.380316][T19387] device ipvlan1599 entered promiscuous mode
13:15:37 executing program 4:

13:15:37 executing program 3:

13:15:37 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x224e, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:37 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7000, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:37 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x20000}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:37 executing program 0:

13:15:38 executing program 3:

13:15:38 executing program 0:

[ 3292.337759][T19418] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:38 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7f00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:38 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:38 executing program 4:

[ 3292.569936][T19418] device ipvlan1600 entered promiscuous mode
13:15:38 executing program 0:

13:15:38 executing program 3:

13:15:38 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3292.723795][   T29] audit: type=1800 audit(1596806138.419:3115): pid=19419 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16308 res=0
13:15:38 executing program 4:

13:15:38 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3292.837566][T19419] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3292.909633][   T29] audit: type=1804 audit(1596806138.579:3116): pid=19418 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1559/cgroup.controllers" dev="sda1" ino=16308 res=1
[ 3292.991103][T19419] device ipvlan1601 entered promiscuous mode
13:15:38 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x36000}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:38 executing program 3:

13:15:38 executing program 0:

13:15:38 executing program 4:

13:15:38 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4e22, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:38 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:39 executing program 0 (fault-call:0 fault-nth:0):
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:39 executing program 4:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r1, r0, 0x0, 0x100000002)
r2 = openat$cgroup_ro(r0, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f0000000300)=ANY=[], 0x208e24b)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'ip6tnl0\x00', r5, 0x29, 0x72, 0x0, 0x6, 0x13, @loopback, @private2={0xfc, 0x2, [], 0x1}, 0x700, 0x8000, 0xfff, 0x1}})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r2, 0x0)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000000706010341d43a59a4df00000000e9000500010007"], 0x1}}, 0x0)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r7, r6, 0x0, 0x100000001)

13:15:39 executing program 3:
setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(0xffffffffffffffff, 0x111, 0x4, 0x1, 0x4)
unshare(0x40000000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, 0xffffffffffffffff, 0x0)
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
close(r2)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732})
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x18, 0x0, 0x0)
getsockopt$SO_BINDTODEVICE(r5, 0x1, 0x1c, &(0x7f0000000000), 0x20a154cc)
r6 = accept$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000180)=0x1c)
recvfrom$l2tp6(r6, &(0x7f00000001c0)=""/42, 0x2a, 0x40012043, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x20)
ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}})
pipe(0x0)
write$tun(0xffffffffffffffff, &(0x7f0000000240)={@void, @void, @eth={@broadcast, @local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0x33, 0x0, @remote, @empty}, "0832726087d5be5da36ea02244b2d3921dbfee91b2f2afb5fa90a40e1a0d3a20fb6b9a62ba51f1564ddd5b40b4f4001ff37efd7075fdc4ece9e89aa7a578d53d04a8edd122764a8ce1be074d04db036d3c456736e052cbaf93e6e9bac55386650b5526c8119289b22ee568986a4f886a89a2a6beecacbfa3c6"}}}}}, 0x9b)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8)
splice(r0, 0x0, r2, 0x0, 0x10005, 0x0)

13:15:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:39 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5c00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3293.621290][T19451] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3293.774052][T19459] FAULT_INJECTION: forcing a failure.
[ 3293.774052][T19459] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 3293.850526][T19451] device ipvlan1602 entered promiscuous mode
[ 3293.875204][T19461] IPVS: ftp: loaded support on port[0] = 21
[ 3293.948857][T19459] CPU: 1 PID: 19459 Comm: syz-executor.0 Not tainted 5.8.0-syzkaller #0
[ 3293.957211][T19459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3293.967261][T19459] Call Trace:
[ 3293.970550][T19459]  dump_stack+0x18f/0x20d
[ 3293.974886][T19459]  should_fail.cold+0x5/0x14
[ 3293.979485][T19459]  __alloc_pages_nodemask+0x1a3/0x930
[ 3293.984862][T19459]  ? __alloc_pages_slowpath.constprop.0+0x27a0/0x27a0
[ 3293.991623][T19459]  ? lock_acquire+0x1f1/0xad0
[ 3293.996302][T19459]  ? tun_build_skb+0x1d2/0xf30
[ 3294.001074][T19459]  alloc_pages_current+0x187/0x280
[ 3294.006191][T19459]  skb_page_frag_refill+0x281/0x590
[ 3294.011387][T19459]  tun_build_skb+0x24b/0xf30
[ 3294.015999][T19459]  ? tun_net_xmit+0x16b0/0x16b0
[ 3294.020850][T19459]  ? __lock_acquire+0xbb5/0x5640
[ 3294.025796][T19459]  tun_get_user+0x7fa/0x35b0
[ 3294.030413][T19459]  ? lock_acquire+0x1f1/0xad0
[ 3294.035088][T19459]  ? tun_build_skb+0xf30/0xf30
[ 3294.039850][T19459]  ? tun_get+0x160/0x280
[ 3294.044099][T19459]  ? lock_downgrade+0x830/0x830
[ 3294.048947][T19459]  ? aa_file_perm+0x5e2/0x1100
[ 3294.053721][T19459]  tun_chr_write_iter+0xba/0x151
[ 3294.058758][T19459]  new_sync_write+0x422/0x650
[ 3294.063432][T19459]  ? new_sync_read+0x6e0/0x6e0
[ 3294.068193][T19459]  ? lock_downgrade+0x830/0x830
[ 3294.073037][T19459]  ? vfs_write+0x397/0x6b0
[ 3294.077630][T19459]  ? apparmor_file_permission+0x26e/0x4e0
[ 3294.083362][T19459]  vfs_write+0x59d/0x6b0
[ 3294.087606][T19459]  ksys_write+0x12d/0x250
[ 3294.091934][T19459]  ? __ia32_sys_read+0xb0/0xb0
[ 3294.096694][T19459]  ? trace_hardirqs_on+0x5f/0x220
[ 3294.101714][T19459]  ? lockdep_hardirqs_on+0x76/0xf0
[ 3294.106827][T19459]  do_syscall_64+0x2d/0x70
[ 3294.111239][T19459]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 3294.117325][T19459] RIP: 0033:0x416731
[ 3294.121216][T19459] Code: 75 14 b8 01 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 c4 1b 00 00 c3 48 83 ec 08 e8 ca fc ff ff 48 89 04 24 b8 01 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 13 fd ff ff 48 89 d0 48 83 c4 08 48 3d 01
[ 3294.140810][T19459] RSP: 002b:00007f4b5f3acc60 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 3294.149213][T19459] RAX: ffffffffffffffda RBX: 000000000078bf00 RCX: 0000000000416731
[ 3294.157178][T19459] RDX: 000000000000007e RSI: 0000000020000000 RDI: 00000000000000f0
[ 3294.165227][T19459] RBP: 00007f4b5f3acca0 R08: 0000000000000000 R09: 0000000000000000
[ 3294.173199][T19459] R10: 0000000000000064 R11: 0000000000000293 R12: 0000000000000000
[ 3294.181179][T19459] R13: 00007fff9775b99f R14: 00007f4b5f3ad9c0 R15: 000000000078bf0c
13:15:39 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3294.236734][T19466] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3294.271832][   T29] audit: type=1800 audit(1596806139.969:3117): pid=19456 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16373 res=0
[ 3294.387862][T19456] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3294.435492][   T29] audit: type=1804 audit(1596806140.089:3118): pid=19451 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1560/cgroup.controllers" dev="sda1" ino=16373 res=1
[ 3294.526833][T19456] device ipvlan1603 entered promiscuous mode
[ 3294.684081][T19461] lo speed is unknown, defaulting to 1000
13:15:40 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2bd}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:40 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7000, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:40 executing program 4:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000180)=0x401, 0x4)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, 0xffffffffffffffff, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$SO_BINDTODEVICE_wg(r1, 0x1, 0x19, &(0x7f00000000c0)='wg2\x00', 0x4)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, 0x1c)
sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0)
accept4(r1, 0x0, 0x0, 0x0)
r2 = accept(r1, 0x0, &(0x7f0000000200))
r3 = syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f0000001340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001380)=ANY=[@ANYBLOB="7c0e0000", @ANYRES16=r3, @ANYBLOB="100027bd7000fddbdf2507000000680e06804a00040067636d286165732900000000000000000000000000000000000000000000000022000000a74766b6af2f32235521715152a135021788dc755814ad04eace5b53e208ccce2e360000040e0300a8009dbf66d5b75ea13698d2dc4add100b3638fab9e8abd068365b9e43870c87351fb0a824387955d37ce84418b7464918a7a9810ed05a7b6df69f6ccdd038508c287fdd40f6d23c5b932360f193c6d7d8bfbccdfedbb178d640ebdd5d812efe69811bbe5d19e7b6e5db5009c2ad6b7d711bbadd9f871530b001b901df4d8cc26064814d5df9b4c2fe1785cba43d638e6f3fb336f3afe4635ea323d14ff13d6ac4a0de3ee0aea4d7ba7967089c847bf0b7bd0689bbc46f2a18a0b7b7af7c0ebdd0a711091e518699ca96a7daef5c1a219ced839feee904e6ad708d3bdf6f57f117cfaf8cf9b25ea8d346b894d65d7024411f97f26547453191e205dd06449650975926391ff8192bdb7be37f72986c77a743aaf3694c5094d104c522a075cb031011cfc6dfea4da46e621f69d429cc66035d755b587b058be29eb7de8525297cbc1a7fa5b1d6a44b391299eac577b410ce5dc118f812ac49c417179ff9dcdcfe6f2e97401b568b2b3dc08472ba6feef37e740a59531dfcf7592b4ae6bcf3b57ae484327f402e265e7e627b8bbf2b4516716ab4585193d746a713ce2ca058c196c01fbba41a1e01b1fa152822bf65a0a8f7d3688ab86106c872703bfbe2f9bc95855607807165208a6e9b68ec9371d29c9ff5a50412b918a59fa834ec61311ecd8621192e5686886d04d78ff813521b5631094c1aed6dca86a5644a20db7c9612021866db85e7e9d7a46ee27fd4aa5bc0a1014c191ce534627ef7861d87d1652ec8c7647a76c51b0992200d437f72e5313f9cdd59cca0e2f5ebd418ce98064c228875aec8fd8e7d1d13bf140ff33229134a186e62ad7ea4d38214a4597903af5d106b1c27edaf704e7f5ceaf3ea23188a12672505cf0feefcf87f75cbd6ece835a8285028c626f362995ec7fac6f723122e1d2f92cd72d0734270639d033ccd228d0641509aa993551ecf495bf77cd23ff147f54e23cf33d9ca73c0bf662f99557decb97fcc97d7f2e5f386a4ed6309291391c5a4a018eca3c379fea84e772db04034a6088696d08b289c473a20333301204202fdc77b16bd2574d82ac5bf8e0d39570cdd3aeae61027a8deea50bddff70f482dc9924584ff0d6ce7a4576d4ed009a1229ff51201775b2591fce3672b67b30b6a6ba37ffff925d1767aa2f2021b4b6653637babc87a205bedb2d664fc01ef28d70c2b49b63ba469ef2c082b8d421f68140f43bf0eff189c1b538a83c16c70528e5ac7a97f4e659316f1e57b56a0bb5e86733e444152447f8a68b5d9fdfa046e083b766b9455810332f1c72cfb80878a76aa9758546f2a21f688c77ff9e7a132b817f4e5e2a6ef0994c010084a2f001e4007fa6d944af06a6c9d9c649fc7edbe080f0af7d4987658adf592e0e27e336ce5e2a0977217eea936f15ec85bb1e2c074d42ee5143306b45b737f37a49db5789495d50d23298c511431eb5b80aec8de722bdfece4fc384a67438af8b4b35f9a018fcf5ab7f53b084fe160ecf2a5d7891287c07f809cdf47b902cf7f07210cb71d2483481fa72d1133a799707923357abdd9ebe8b09f09186e3fcd2d95064e0a1645d7b1ee1a86c5446bc21b2ea5a8fbedfbf81a647ce19870c5af4b24c2b98a6e738f292777d5831be85713431d0536d44b8f48d6615f88fffc4de7199ad75e3ba81e6c57696e509c393de9b5702f50870528b46b1383391528b2daca115503e036bcc768f74b4883986f6d19b64c28f7ef7748edf134e354428a849947f03de7ce35fe596ef63e5373ecb6f2109b63feb255710ab48851473a2e2beae8b823100e7ec23a3202500f53f0517695e5aac7b86508e6ed9d4c117a6184b1fe9a825d3fc3b7dfcaefbeee55a79422b637c844253fa1a7bbfe7a6f39b19d588d9c33d97d91991d900ba9392782d936028128640fb5e59f9a06441c063cf867277db37b4257f8c3d1f9d848e702bffcad24a54e7bd4a88a5bb1fc876e699cd911eb3747ca9be30dfa92c0a27395532ddbb2d7cd24f511f28e234d484cfdbeda5a2f8e84589950f758c2f6bd4d3ad4614ae809c3af6b66f1d4a8fcd25d7ca564cb2bd4d8435fcac437b484b09f8d9fac73463b63e45da7e03c16ce8b623a6913c60ed414d29c3534b99b3170be4c0a1c887e9eb6f8795e3aca54db71282f1aa0e7367a9b110e960baae035d57ed90eba27138c1b703b04f46068293c9710205b3a81779e25b1c225fa52d75709eaaddf004b9ebda3926836974f55229db48135891255352a08e03819d3ec23a62b0f66b43f7ff34d52bf7e31c4125d949a0111daa036a1f8a58af2c2c4929630372754e8d54591ee6e37e4a8ce3123b02b8cb8b1608440500aa3024151ed05d74fca88cbb6c3c159525b628e9671085c7564d335fcbf8feb48795a1236505f7cf4962e547e650841328438a7f8cb0f2b8c0802f6513613d9f44217e0ef2fc117c93fc09371d3d0c63f58e529b4951d21653cead03600c6d157edd108b3ec51a74a917d57e4130be91d2b7e0b1bfbba6ebb9af1352256fdf1a197cb9133c32b0d626d03555866ca2316364b77be646feaa78be88538698ffba6f7cb5c58b34fbf30808d74f1cd9f9515290b12eb87bbac4c743179483cdca472c867900645947611a137289aaeb934dd5e5143cd5b3d6ae0593b519cf7a2035cd082b964c7626de78a53877086e168b00b93d9b061dea7ab99ab06e770c8ef2d31eec372bdf01205d221da7aa5aa7ff1b25f00bbc027b675a85824fe8f4153f26fec6d38cf998a36ac67545d60ce44d0e813605653579b745cbeab07faa7603af656318040b311eb89b6279ca0b2e7817f9ec9dd779d2bb3a250accab89e6caa4d5277e95608b27592179da80324bbe34a7bf455fc384f6525ebace5686ca43a15834002d848f4431ce4da3fe5056857936c738d0520a8b2c6382e2a31aa2aeddb6efffc6f03fc8a53ff2fc09c4deda38733e22ae315ac2844469c49069f3bcb4ae2a6445c4507b669fcb018ff355603ac92bb6c786ec390b1896ea335c0c7cae8083179a3d916789b814eddb767de075031eae3a05f728d43c5d4fe0fac932bd505e6b0086ac8558b9af7a4a4145a5764c93e19955ba5933b5c3330afcfb25f2acb32ecde6652c6dc5c97a3f2dd931371a1b07f9564338b4786088bff5873cfc3abd7f2ec838fc2c94594f199e816981e9e2463a3f1de9ea33b16abddf0bd8b84c0efb6e24fedf53b6e07708b11f0c70cdbe9e9f1b27e1749c8145c37ef6c353d5cb245b4782de693796a12eeaa9f2972bc7b0c1104d4fd4513361152bffaaa6f745ca34f1ceae77359a902faf8e983d3042294199068397524352f866ea5db748fe6ce7c8a5f3ea59b2ab054f0bd664955fda1feca01a2a89f1f0615f0d6eece3ec57f9885d0319406e1d56e58d7fe1560c695e88e80a26120bab86db30ed5d3ad899d55608ff21bb7b7a29da5c2bc36e8f16d6bb5b73d8704e23381488622bff5cf84ad0b6c46cb64f6e2e9e3ac10b16d998e2a4947ac022ef88f46f53964952a0678e2034cbedfcef78f6d67087e629c5b38d1942f286dcf2c05b988164787e210e254b5f7b1c07eb5bb565ce16fea847cb0dd99c5954d5f6d96b1df0460b47a14b9827be92a7f9e26752a7cc054489eb3059c4fed89a53e8164ba4fe4957fa33dbcc023ef5eb36dafd6c33a407a483851d4407ad08c38202461a166a237d54aee799dcc06fb5112cd39544251f05668e5e307cbef852a5281931df82ad2ea8a57d6e9f30e1d8683de040c7d486a5a42cccba040389769c331137f9846b36c145c3599e519d4a190e056065b569508b5d86db30288d439b800bd42d9700c9fdc2c4db3736b203a371de268d74b33b47a6147f3719c1dcf39072ca2b1ad9419e2e63d6741c1e22e510cb0f724fd8a957f0ea7d754908f84b4cd063c0092de84494d64a39ae9bbc26474d01913df7b11c5fba63ef949320df3af648b08bc0b3b1d715b173060a2f1e5035f7445f2760265faa91db60730b1882925cd9e4b84ff2091a0892c12b6ce39301a4cd0e70333a407e0ad9fc29399ca188cc680c6c53a38ef33232e700bfb3f91b073912eaf12bf33df2c1ce44fc3656f0528c0778f4c09ae995b34b283ff9464703dbc229c8f669768dabef05430bc9431c30728b8deb7e51be88a28acf113c52c0c691c19b78ea975c6011e8ef8d6c067c4ab37ca25ef8455f813402e6f636855adff40ba629d7e2b18b41514bf593d32d23fc61a717afaf9cdc4a23124b10e768579afc3f4e078cfcbe8e32302e8097a6405fad1381f1d64076747ac473b566babfebcc9c676b6b9195ad770bfa598f619a0359e70e14aa9b1aa401496b6fa0d3665cede72aa759703d5994837196d79d5ab9ba45edd62d0ea744954ada987a008dddcad6a74e6ffa817968dd61dae215b586234b9557f86fb3fe9a263186ee544875b96a45082124e856ee9a7f0b149b6e8cccde9c3be6b68d6428f78f2e32a2778b65a154763edeada9981e915c02e000e4be949be57c280f81fbf2251a240cd22578cca1da4c1e093576b048171f02f8b2696b81760cd15746793aea0f264a6084742ccfd6fa1c50f14aa169b8e330ad38b21e8986a80f1f7854dd8d22a45b973671e27d19c979d5e4ab01ba9215c3d469a3a065c0cf455c58e0fcb2c1bd8511511b4e4bc85b3e33f0fd5ba9b0386118cd066903b806448f898441b0b5ba5f3c46a2c857b12a7dc8700ce65d3ea19d1283d1b4ec8104e9f30784af6cc3250601213dd66410bb3dc9b6c6e52383f06afafb4313df9f99accae539720b4a2f86ebffcfc1d7417e4fbcb59fc82de2934e0eac555dfd75d75c1b31077a5b22bcebb12fffd2d8bb4a46ec74a8881eef44825d1966c6145f8ec170fa838cd6d15e0bfa09877fb008d90f29b45efa725844647add0f64e5db66eda6d59d832c9bcaae063af5406c3129f5ec6e8f8c15eb3b197853463261cc0d510ca38d522a5e897e2a42ebfd36b97fee561344170746291dc224d260f7b02592cce2251d8d387d841592e2462b24d1fba81d1f72be5e4aa81c6dc13d373b45c744b03bb0d85c0f20b6685e4a7beabe4cc9da614000300e72c30c5d1182445a45e19bf3f329b6f0f847108a46d5ab899ef764fae785ffc0424b039cd121bff79fd223dec8cf3116a8781db875a3d98bd62a38406de64d8a7855068f4a399673da7d01b5132a378f7b574826431a53ed903992d6dd9a80b59aea973066f456a1e0b95a47f958784c78cc97f920d92f66b91fff5ffefa3149ffc3faed367c96fa6b9b23ff4b2ed65"], 0xe7c}, 0x1, 0x0, 0x0, 0x4}, 0x40)
sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000340)={0x160, r3, 0x100, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0xdc, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff7}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1200004}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xdd6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7ff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6f75}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7717}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA={0x10, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x4000811}, 0x10)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0x17810, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback}, 0x1c)
shutdown(r0, 0x1)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002c0000007a3be4aa2b6494"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={r4, 0xc0, &(0x7f00000004c0)={0x0, <r5=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000300)={r5}, 0xc)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r5}, 0xc)

13:15:40 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3295.102075][T19490] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:40 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:41 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7f00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3295.387583][T19490] device ipvlan1604 entered promiscuous mode
[ 3295.597793][   T29] audit: type=1800 audit(1596806141.289:3119): pid=19491 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16375 res=0
[ 3295.695501][T19491] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3295.812721][   T29] audit: type=1804 audit(1596806141.409:3120): pid=19490 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1561/cgroup.controllers" dev="sda1" ino=16375 res=1
[ 3295.897656][T19491] device ipvlan1605 entered promiscuous mode
13:15:42 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:42 executing program 4:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
recvmmsg(r0, &(0x7f0000001f00)=[{{&(0x7f0000000000)=@caif=@dgm, 0x80, &(0x7f0000001240)=[{&(0x7f0000000080)=""/41, 0x29}, {&(0x7f0000000180)=""/155, 0x9b}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/21, 0x15}], 0x5, &(0x7f00000012c0)=""/179, 0xb3}}, {{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000001580)=[{&(0x7f0000001400)}, {&(0x7f0000001440)=""/22, 0x16}, {&(0x7f0000001480)=""/34, 0x22}, {&(0x7f00000014c0)=""/163, 0xa3}], 0x4, &(0x7f00000015c0)=""/186, 0xba}, 0xfffffffe}, {{&(0x7f0000001680)=@in={0x2, 0x0, @initdev}, 0x80, &(0x7f0000001940)=[{&(0x7f0000001700)=""/44, 0x2c}, {&(0x7f0000001740)=""/26, 0x1a}, {&(0x7f0000001780)=""/64, 0x40}, {&(0x7f00000017c0)=""/92, 0x5c}, {&(0x7f0000001840)=""/59, 0x3b}, {&(0x7f0000001880)=""/143, 0x8f}], 0x6, &(0x7f00000019c0)=""/119, 0x77}, 0x10001}, {{0x0, 0x0, &(0x7f0000001cc0)=[{&(0x7f0000001a40)=""/228, 0xe4}, {&(0x7f0000001b40)=""/255, 0xff}, {&(0x7f0000001c40)=""/26, 0x1a}, {&(0x7f0000001c80)=""/50, 0x32}], 0x4, &(0x7f0000001d00)=""/107, 0x6b}, 0x61}, {{&(0x7f0000001d80)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000001e80)=[{&(0x7f0000001e00)=""/66, 0x42}], 0x1, &(0x7f0000001ec0)=""/58, 0x3a}, 0x4}], 0x5, 0x0, &(0x7f0000002040)={0x0, 0x989680})
socketpair(0x8000000000001e, 0x2, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r4, r3, 0x0, 0x100000002)
setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000002080)="c13c3575c3d311c1119571ea696eed3c395ad1c72533632aa13a3d97d0ec27f711417dbe379124641b174ca8c75d9f0671e1e4c8043758b0752d91f1156739d0d770ed70b48aca7d95e4822fba", 0xfee2)
sendmmsg$alg(r1, &(0x7f0000003240), 0x492492492492619, 0x0)
write$cgroup_int(0xffffffffffffffff, 0x0, 0x0)
close(r2)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000003800)={'bridge_slave_1\x00'})
sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f00000037c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000003780)={&(0x7f0000002100)=ANY=[@ANYBLOB="4c1600000d0a03000000000000000000000000002c160380580000800800034000000000340002802e000100dfcb0b865735903be18b035cb9d5c370b7ebee75cc72f319946d37c8e6daf0247b61926d35dfe2d1cb1d00000c00054000000000000000080c0004400000000000000f08580200800900090073797a31000000000c000540ffffffffffffff22e8000a8073000100c51cd58793e829edae74ef05de1326903e40580fd4441fd2dc7746d1e975c634462d3dab19aaf631f93b04eaa0bcdd9b6a8413096a5a9ccc6f41a6a6536ecd46b99cb45d97ffb48bf3bbe4d6c8823f54b0c8816295182761159590a8cb34ef68b3649bea726cba8ee376cafb1756d4006f0001001cd2a134978cde9084fba9df7d2b0ec67be3960357fe9738d23cd7ff937520096d2938806e7fb23da6c17a72b081577290c17cf2405fae3803ed93455b831616953fbfc802520b459441ccf04a1976cd10e7805ed8747eb66ea8697f91d835f51ab1325bd7b8efee55fc0a0050010a80f7000100686b00710194471b1e0f420dd1430ef9210a1dce96e2cda0ec1f900b34bac616e61172e433edb22370b334483b4707320ff55a1d0e3a88d898dedc4531bd7061217977c9e4af3e2613fd05d08e4810f35a4c5540588d1fe35cd47ec9bfc76b1e3651bec028e68947ee0f12c195c5ca90c045ce0d1054da98578b37a1167e4e49f5e052ee5309338ac1f9e0ae56f8319397ff25160d95fae4e4362ff0e462452cfdc9f9f2e8e518d7fdd6ebaf46c0ac923c2e08be63ce10d4f2df40ff4e9c9c85cc5a04c46080e392652076c81a2d686ef19f4d6a27631ccb7187cb20093c5ee6d43bff500bc1b61db976521b2c84534e8297fb004400028008000180fffffffe0900020073797a300000000008000180fffffffe08000180fffffffd08000180fffffffe08000180fffffffd0900020073797a3100000000100002800900020073797a320000000004000780901100800c00044000000000000057550b00064062752fbbed9344000c000440000000000000079c081101802c0002800900020073797a3200000000080001800000000508000180ffffffff0900020073797a3100000000ab00010087348147dea46bf012a891fc1b3454ddc08191a9034e3ed3fb5f2508eb806b9640ab849a756ffc8b77a202a4825bbe6d5d6e2c50736a0b07a214e32d4451014a6c77c41ccd04d2da04ab90f76486487495a4cf12dd368d596c54a1c83c775836a83088ecc5e33459e91e8483eb8654d4d3940d142a3899f6cc828b24d1c4d470f3985804a55e96e85a246872e5f5201ced37d2abc1899029db916759df8e6eeeda6ad2851d0a68000400010004100100e613cdb98279fd55d319c754284068416b4881cc574610de4c9dc50cfe329ca9904ecb30a115d514b5978b4179718edc1c17503c6c7332b8229883bfb4f71a38672cc40e1f7447773cc4c5c9f17a99d42844c849e1dcc8eeefe699aa358b3773a75adca93c7e5ab98556678994354ea07506d7cd0892c3cb433f3d3e2bbe2634cc898581bd203d6c9265c72acc7db149c5a7fea1ad1d21622c2325a3ef9d75ab4fdec7e58130fddd248e63ab5e812b9eb4f714667d3ece99cec605714a1f8e4860e99bcee4a0a9ca17c0198f1238a1a4e20709789845681f11f02bc998d0747ceb6ac5d55e03878cd76385438b4451549e1c4854b03317ef4e2d1b8ebff99b21ef3e935d83ec13b8ff9ec391af7551c38b12e061bba01d1cdc01c8407bd1c3b62d716f5ffe7e59479b6acc20fe755b471c8b38e6f9051ca95e8f4498bc01dc341a75ef5d42451bdf97ceebccfa7f05f80f06fd0baf9c8f70513bf0fbd5e08695a503f1371cdc35fc48fb73cbb29700662e95ee203b433ad039a9014335a4b179d122671645fa9e753d9010026cb103e345a660be812d2af23c0139338918ce5d343243a9ac2aabe6825f8ecc2a241ebc89f349b7f72ac2f9f858e2406cdf13d4a20335e761dd63d7854e329cb1f6a428becf01284686a34e4c727f87ec8164f1174c13101bad28966463f276351095904af03ca0d90a937ef15dabfad92f136432d5aaa2c004d4e02cc5855236ef8287e6d273ed46a27097a385f29765438366eec3abd72d3e2c41eda1d53934142ac75c8b0758b922e6cb2c918ae90e36470608a51b61c28b6d7588edfe327226d4615224deaeeca7f5370b2de8e77fb5dceb0bdcc08084adf163891990193c3e22f2de27d0487e2dba829a0e0871fe4e4191b5f9c68f361157f068c5eb7ab5c380ce90215fd48a77b2c00dc04fc5fa87e96b0f09b57f33c9a566b602cb2aad23edf7a1fc7b258574199bcd1c09c3586198c617659d863552e3475060e27776bb8089da7ad03d7a24a9a616c38d5d5bd82b70b14451a44783f336b3139c4c049dca299916eec02e3c0f55b98906e113abbbe56e11d5bed1d7e7b70d5409097c05cec85b463b28e08e9ea2a73237cf71c438e27182a1efa1f06c8857bd1404cf06e8656ef73c441c965d3d32196a6e0aa89015322260665b41afbe2fb2d5152d608ae62351f9cb94d97bbba2a47bbe2c0d47c3a0e581619aff5ff5d5cfbf985dd07967feec3e7b20a1c9ce65525a0beafff54f634d87cec7d77556ed662f07e759955d1cede0c09553bab680ac5da77c91f89b437f7fa219a6574a8ef98d4a44ff7ff8720c15651cc239f7a2a7fda00b33b993fa93349801bb71619640e7bc5b58c8c75c0686d9c970221cf151a3171b273451ab42911537189ae63726c5f90f5fbb70171202d2d272752f38ec462664d3fafe5cddbf9bebda2391b448563106326845d9b8c8cce893d0df10f09576e98fda70cb912e9c06446524f1d9cfe9c616edf7b158a9e8de313eb8fad644018634f800b2820757f1452cc1a1258fa07e9f38da056fc23a70efc0a01bdaacae4541c4bdbbcef4bad068baa78128f6b1aeae952e9613d3c7040b96037ac86624dce037672aaac36bba4ce3b66f3b8b8e2014c752db6ba641f1aea3a1e877503d3d2f5f9e02384fa24b02c843a37edfd0ce50f34abf212e6b490fdd637877e10cff20eb8ad5328c99120e26c31132c039df2d2597bacbdcb2c5bc3e0b709fb2e50a9cea7dc02295bdeb21608be2dccc58da9cf6c5730b171c8dead9a8a687ebbf80f8cacb7acc92359c78d92b310317f34952ca9cfbd70345100475f0aebe0bae939ef980aa773efe1ecbdb2140f2670b316919b5ea9ccea8c1afea7ce77e372bc1f1869e3b02fcf16bd168f2cb9723499e505e9217a1423694019ae54ba707a34c3a84a7ecdb2d941158a6cdf525e428b313092003f6f6d5496f0b61dab8f86776e79107b0386b61b77093edc08fcd362bc446a65e67eee002188a16d0daa99536b02af9743bd20182a16cd354bd8d7d9dc81583effc03e37cc6be6be71e3d0bde161493304083c96aa904b332370f3edd7888e97613aead3bdbdd8b166b3eab39d47d89e44299a48a3a132b729fa69a3fa0f9066ba1e22b10a5d7e0373f8448ead3373944f2ad31c2e43468a134d130bf00f13cd88f31aef8d66f7bd22fa4232702e5c5302f70040181660c31957b66075b6555863150086e41e8cc73e30a823365bbc4f77cb106c05b9522a2ac77468a7d619db13ed5cf63e100a0df12bd881c994fba6fd63d2e10b8934f2da1d90dd5b47f5e5fb5a71527e238b7be8a9bcdb78d83d5b13193fc19ae93fc3aa9a1be7d63de42605a204992f6288ec40590536b24c5f92866bee0262fd92b3b5f7a28356f8b3069377643f1424188ad006cd2bf6285d051e3b6d44c376e3f94ddd0ebba7444aaa7030887d401ac7f7c995ceb1e15dfb3933a7f68f91f924dc6a1f95ec0012758f48b838b522edcfba3c2dde4c99f3efc3eba442e2dd9e87b5f16105399de1df65b735ef640a047addf8240d051aa8ac66f652843bd1f9980ae936983514d99a0900ce235c13f8dd6abe47b8503f1d926781cee3b29cfcccaa93f3ce41f2a2b2ecf0e983ef099033ca98e6cf83e5548dc6a437471473c0d32a3f60606dae6364b92721c4d3286a9410e394f6cabcf352ad59eb3c6e1020478a92596cc37d0436e7180d954ab042b7a7a72d563af04021a455d4b8c1afae8f426e74e2ea4c9b6dc9b6a9c53e1c11524d34202c662ba16780b96cb889b981037ad92281fe6c88389c748b8ff43589849f88c4546d34b7cf4e31264c0f768ee6d0f49cf88b064bb3d1a821b8280833662277037300feafb9c94c68d052cbf0130b831407aacde222df9429ec0f4eb45d0999c22ef69ad714e37de3cc99f45547ae5efc01e49d99301da1d12641f9babb0ecec3fa258ced67ee229b16d70d46bff76527eba25fdf745c75a47ff217c3f5a232502a5707abf2bf92f92206b9bf26d47b6b8df61471a2d09bfab667b02771dcf9892dad789a056c81125bb5b25a62208c9cf775cb3a8ca32f3953aea22879aaf4126ce27f2b85fe011a1b3581b2caf6d1b9bc706e36f6ac8f38425b3d899ad0b741142c5ac50d87be218762db2acf36bd34fcec24960e0ad699e34ba5a44d1aed754d3f3994ac2a9b18edd4f035bf7b620f7b3729f9c3bac755ee3a4d86241b15aae71c1a1986ca09b1a64d40b0a7e486e47af312403ffdd32af7311b017eaf7632bd9ad6988dd64ad5819523f6610ca4bc5d01341dadf33288d273b5a860c83b1e87251e64bffa47f27ca0a65b5039b4dd00ec25337485963f936ff0b8974d8ca7c0e1b1b812105d54dbfe3807380fb6ad2e228b14b10d583f6018694dfb08ce1376673cacb6b7aa3603b735d38385d5c6f3ebf520fa447a2379dd84a61d0f1d49478b79998c8f45d21654983617834b27dcf5d93ebf6b429ed0cf7cc8d73ec7a4d3ebe0cea4a51fe3f1697cf25cb33b4b61f7c1519fca7b00ced15e1798df66f4bf9f4591598b1f0d80fb594aef0d6d951cf45c8fdfac7accbd43a9a8f76f29f141d9bc0ce40046352f94e402c4402c67e81b4c468fb26b71325fa9f93a51658a5f5425944eac860bb76bbc9af5b4290ad2365f2af5b28e0a23b2bb7ff5e79b9b9d419e3ca8b44ef66a7a956dc068fb9130fe288165aea9f1bbb91976be1c39d7e893f03cde4267c91f3799dcc7d601d9a16ab3d0aeacf7724849d1f4912c64fe4b8d1e9d094ea6985d11f98f9fe4b37912352b26d233a5022426524cba80dc85be5913e0d34a13fe8fff81f4943d2a0d99ea63fc0511f58cd43e289de859d3658ee4a1cbfe426474a59a7e939d52aa45aaf86d93af40afc64ba180fedf464c58f8da91d6be20dcd6c6813bc038157c5e6a7ad9d23488b472bc3323c2f5d31fca878c2fe27de0b695f24ef664afd918d661b010b2b9634898805d1e7ed37b81309442e059ce3dd3e2e41d8a793ff796527673ea239f253669576d0009b5e329764a0bcb0b5590db7bdf13e87aeb67e716c2b73b51e7601a2d20a800b988d603e2bd5b07af5b6f60504efc69c15b3500b4cafae4303ab16d5efa2a39088c4e18bf7487f341a6f97279076c40430135e8b1ff8f9acc803bd7790c02ba5a47cb033a9e3099eb211a3611b2ca81a2867f6ded71e39c88667989b76e70b8194220d4eaff4ba2761c6276c18b0c35609d9ef701980a0962d95681d48d0ee8799c6b7620ace795145b4976a38d81751484a51d3044fdfb8c1b384456b45b2758df555eb3d9e40456618a5adac744694b56310afcc050cadf5dc07f97556f07cda3677dfcc2527eb557c95739f20d5f7b321eb6f33855947014494ea2c43225134896ec45e1cc1543aebe32c764a0a7ef172388466aa68baaa7c05d98bf88ccefea155928e08eb42f623d9539b214bac4f9b53dfc0e09919761c6e092bff8f5a412b0bf5008f09f22dcb0bd14cab6c53eccb558eae5c3b2f8f434f3a62bc2dc462aacc175f38dbc4370df2241f391707ab3436c3428c6c20f99cb1be1dadc313fceb047567172107acade3298eef85d8fff53fa8645a31c411303d4bf1b5cf0c68d028d428ea69702b17feedee6769e885e4fe48855d80e6757f05b9ad9efce3fa55136c456364fcb85f962f8ae4dd0196857172f08ffe2419539a689e1721cb921c2352531d402a5105dad28e53ff61df5f79fa2db82fc2ec17e77bfcdca3c5290f1101523f0025d28b4f556c0bb9e49cc6320fefa8873adc236ee0fc28a89098b6e565fd7a5fd7cb902fbbae8f1317d92aac62596d0939e308af5c24efe536fc535b9c4a03a62359ba91325d3f3143e58132a0471cac07b11e62ba2e6b0df1899dfa0d2ca143dc7ae01b3943d3eef93a38afc52f9f45af950c726199f30761d7efa1b5aee449d8c64cf65125155b24b2c283d3cb31800e9de18037f1e48f4c34a957cdc1b5ba0020c75b47cd22963274e98f8fae1a0d0d643518a82c8ffb32f818e120e555b9254af033ebcbf25d135485fd685451e5f81ec6ad4523440b3ec7bef18923b4e507fe09c3b3e93eae4e60fb396c2242a4d9f10867e5a008a4441677cab1d24509770d3debebcadc946478ae557c4604b58d1b28768cf3ad511ffd4273df84363c3c9eedd23be509d69e6d9faf5bbceef7390d436ffbe1d67b69936e9e4c832f64bc5acf77e2e27e36e77a913e87df6d55daadc87ff04e1e946c2ec8aea9eb529b9d79e9a2c9659725b76e8f768506b970427dcf73a9422e16e51d148c4be77b4c944be8ec3342320c7d7d45f9ccb43e3e8b04d242f7e02e0889f0bd94cf7f38846cd9f26f2f942c141e9084e4ba8aef7a1caaeddfbb80a8e6ce3f670dafc9c621b8419af95a3498b0f4cfaad6ffcea969b5104e669b03ecfa0ac037af8c58da29e5ed5e6f12a055091d6f0409e23ff3c14ed726ddec9e52aed9665fe828d48b2a2abeef51ec4220ef19c41b317750cf2803cd20eaa48057c981c76b1b9ae0ab006decb1570171d1aee8a56fb4636e825b558f3956715306d469ba90f10378fd18483ee815fe4fe0375bc90d68cb04b3f151d3424b74bf864460f68c9290c7df932866fc1eecfb0803313260d89e51738c78c1e8c99ff10d28bd6d53f5730065903bd2ac8b21395646ef10c977e6b8f0b4309dfa451122276909d1d8e144d05b6198459505a0371271ed0b235ddbec2b2400028008000180fffffffe0900020073797a30000000000900020073797a320000000004000780080003400000000150000a804c0002800900020073797a320000000008000180fffffffe08000180fffffffe0900020073797a30000000000900020073797a310000000008000180fffffffe0900020073797a300000000004000780d0010080c0010a800c00028008000180fffffffd580002800900020073797a310000000008000180000000000900020073797a31000000000900020073797a320000000008000180fffffffd08000180fffffffb0900020073797a32000000000900020073797a3200000000020101008ebf2d155053eabc0f4b09d9957c6dae50dc8811994d280173a5405cd58eaf2a669424afa8c8ab955d1daeb161f79f9d7e42a86df7b4c0d95dae15fa151dac0f0015dd2890590ee49a0f60c1b125350e60c58554bfcc7ea0b6b9cc492e88c9b91f2d041236c1588c2d321097cacc1049c3706f6951a555bf36943a13b89ba3c19fb2e83ec55bb878cddd3d14c422a2860245ff80b9b8e8016961138ab34246c1b9369e298d0c4e31c1ac815cba12169dcff5efef53f603c489d0a5b85d649adb2a5931cb162c32239108a50ac037bf05c15a9c0fa391e92c56b6512c4a16ab917ca4ad97d04e9b7e7aaf7938cad9a261803c408b925edbbb944d1cd29f700000540002800900020073797a32000000000900020073797a3000000000080001800000000008000180fffffffe08000180fffffffc08000180fffffffb0900020073797a31000000000900020073797a31000000000900090073797a310000000018000080040007800900090073797a3000000000040007800900020073797a3200000000"], 0x164c}, 0x1, 0x0, 0x0, 0x40}, 0x4801)

[ 3296.808329][T19533] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3296.850281][T19533] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3297.595483][T19533] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3297.606649][T19533] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3301.919898][T20399] tipc: TX() has been purged, node left!
13:15:53 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
recvmmsg(r0, &(0x7f0000001f00)=[{{&(0x7f0000000000)=@caif=@dgm, 0x80, &(0x7f0000001240)=[{&(0x7f0000000080)=""/41, 0x29}, {&(0x7f0000000180)=""/155, 0x9b}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/21, 0x15}], 0x5, &(0x7f00000012c0)=""/179, 0xb3}}, {{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000001580)=[{&(0x7f0000001400)}, {&(0x7f0000001440)=""/22, 0x16}, {&(0x7f0000001480)=""/34, 0x22}, {&(0x7f00000014c0)=""/163, 0xa3}], 0x4, &(0x7f00000015c0)=""/186, 0xba}, 0xfffffffe}, {{&(0x7f0000001680)=@in={0x2, 0x0, @initdev}, 0x80, &(0x7f0000001940)=[{&(0x7f0000001700)=""/44, 0x2c}, {&(0x7f0000001740)=""/26, 0x1a}, {&(0x7f0000001780)=""/64, 0x40}, {&(0x7f00000017c0)=""/92, 0x5c}, {&(0x7f0000001840)=""/59, 0x3b}, {&(0x7f0000001880)=""/143, 0x8f}], 0x6, &(0x7f00000019c0)=""/119, 0x77}, 0x10001}, {{0x0, 0x0, &(0x7f0000001cc0)=[{&(0x7f0000001a40)=""/228, 0xe4}, {&(0x7f0000001b40)=""/255, 0xff}, {&(0x7f0000001c40)=""/26, 0x1a}, {&(0x7f0000001c80)=""/50, 0x32}], 0x4, &(0x7f0000001d00)=""/107, 0x6b}, 0x61}, {{&(0x7f0000001d80)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000001e80)=[{&(0x7f0000001e00)=""/66, 0x42}], 0x1, &(0x7f0000001ec0)=""/58, 0x3a}, 0x4}], 0x5, 0x0, &(0x7f0000002040)={0x0, 0x989680})
socketpair(0x8000000000001e, 0x2, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r4, r3, 0x0, 0x100000002)
setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000002080)="c13c3575c3d311c1119571ea696eed3c395ad1c72533632aa13a3d97d0ec27f711417dbe379124641b174ca8c75d9f0671e1e4c8043758b0752d91f1156739d0d770ed70b48aca7d95e4822fba", 0xfee2)
sendmmsg$alg(r1, &(0x7f0000003240), 0x492492492492619, 0x0)
write$cgroup_int(0xffffffffffffffff, 0x0, 0x0)
close(r2)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000003800)={'bridge_slave_1\x00'})
sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f00000037c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000003780)={&(0x7f0000002100)=ANY=[@ANYBLOB="4c1600000d0a03000000000000000000000000002c160380580000800800034000000000340002802e000100dfcb0b865735903be18b035cb9d5c370b7ebee75cc72f319946d37c8e6daf0247b61926d35dfe2d1cb1d00000c00054000000000000000080c0004400000000000000f08580200800900090073797a31000000000c000540ffffffffffffff22e8000a8073000100c51cd58793e829edae74ef05de1326903e40580fd4441fd2dc7746d1e975c634462d3dab19aaf631f93b04eaa0bcdd9b6a8413096a5a9ccc6f41a6a6536ecd46b99cb45d97ffb48bf3bbe4d6c8823f54b0c8816295182761159590a8cb34ef68b3649bea726cba8ee376cafb1756d4006f0001001cd2a134978cde9084fba9df7d2b0ec67be3960357fe9738d23cd7ff937520096d2938806e7fb23da6c17a72b081577290c17cf2405fae3803ed93455b831616953fbfc802520b459441ccf04a1976cd10e7805ed8747eb66ea8697f91d835f51ab1325bd7b8efee55fc0a0050010a80f7000100686b00710194471b1e0f420dd1430ef9210a1dce96e2cda0ec1f900b34bac616e61172e433edb22370b334483b4707320ff55a1d0e3a88d898dedc4531bd7061217977c9e4af3e2613fd05d08e4810f35a4c5540588d1fe35cd47ec9bfc76b1e3651bec028e68947ee0f12c195c5ca90c045ce0d1054da98578b37a1167e4e49f5e052ee5309338ac1f9e0ae56f8319397ff25160d95fae4e4362ff0e462452cfdc9f9f2e8e518d7fdd6ebaf46c0ac923c2e08be63ce10d4f2df40ff4e9c9c85cc5a04c46080e392652076c81a2d686ef19f4d6a27631ccb7187cb20093c5ee6d43bff500bc1b61db976521b2c84534e8297fb004400028008000180fffffffe0900020073797a300000000008000180fffffffe08000180fffffffd08000180fffffffe08000180fffffffd0900020073797a3100000000100002800900020073797a320000000004000780901100800c00044000000000000057550b00064062752fbbed9344000c000440000000000000079c081101802c0002800900020073797a3200000000080001800000000508000180ffffffff0900020073797a3100000000ab00010087348147dea46bf012a891fc1b3454ddc08191a9034e3ed3fb5f2508eb806b9640ab849a756ffc8b77a202a4825bbe6d5d6e2c50736a0b07a214e32d4451014a6c77c41ccd04d2da04ab90f76486487495a4cf12dd368d596c54a1c83c775836a83088ecc5e33459e91e8483eb8654d4d3940d142a3899f6cc828b24d1c4d470f3985804a55e96e85a246872e5f5201ced37d2abc1899029db916759df8e6eeeda6ad2851d0a68000400010004100100e613cdb98279fd55d319c754284068416b4881cc574610de4c9dc50cfe329ca9904ecb30a115d514b5978b4179718edc1c17503c6c7332b8229883bfb4f71a38672cc40e1f7447773cc4c5c9f17a99d42844c849e1dcc8eeefe699aa358b3773a75adca93c7e5ab98556678994354ea07506d7cd0892c3cb433f3d3e2bbe2634cc898581bd203d6c9265c72acc7db149c5a7fea1ad1d21622c2325a3ef9d75ab4fdec7e58130fddd248e63ab5e812b9eb4f714667d3ece99cec605714a1f8e4860e99bcee4a0a9ca17c0198f1238a1a4e20709789845681f11f02bc998d0747ceb6ac5d55e03878cd76385438b4451549e1c4854b03317ef4e2d1b8ebff99b21ef3e935d83ec13b8ff9ec391af7551c38b12e061bba01d1cdc01c8407bd1c3b62d716f5ffe7e59479b6acc20fe755b471c8b38e6f9051ca95e8f4498bc01dc341a75ef5d42451bdf97ceebccfa7f05f80f06fd0baf9c8f70513bf0fbd5e08695a503f1371cdc35fc48fb73cbb29700662e95ee203b433ad039a9014335a4b179d122671645fa9e753d9010026cb103e345a660be812d2af23c0139338918ce5d343243a9ac2aabe6825f8ecc2a241ebc89f349b7f72ac2f9f858e2406cdf13d4a20335e761dd63d7854e329cb1f6a428becf01284686a34e4c727f87ec8164f1174c13101bad28966463f276351095904af03ca0d90a937ef15dabfad92f136432d5aaa2c004d4e02cc5855236ef8287e6d273ed46a27097a385f29765438366eec3abd72d3e2c41eda1d53934142ac75c8b0758b922e6cb2c918ae90e36470608a51b61c28b6d7588edfe327226d4615224deaeeca7f5370b2de8e77fb5dceb0bdcc08084adf163891990193c3e22f2de27d0487e2dba829a0e0871fe4e4191b5f9c68f361157f068c5eb7ab5c380ce90215fd48a77b2c00dc04fc5fa87e96b0f09b57f33c9a566b602cb2aad23edf7a1fc7b258574199bcd1c09c3586198c617659d863552e3475060e27776bb8089da7ad03d7a24a9a616c38d5d5bd82b70b14451a44783f336b3139c4c049dca299916eec02e3c0f55b98906e113abbbe56e11d5bed1d7e7b70d5409097c05cec85b463b28e08e9ea2a73237cf71c438e27182a1efa1f06c8857bd1404cf06e8656ef73c441c965d3d32196a6e0aa89015322260665b41afbe2fb2d5152d608ae62351f9cb94d97bbba2a47bbe2c0d47c3a0e581619aff5ff5d5cfbf985dd07967feec3e7b20a1c9ce65525a0beafff54f634d87cec7d77556ed662f07e759955d1cede0c09553bab680ac5da77c91f89b437f7fa219a6574a8ef98d4a44ff7ff8720c15651cc239f7a2a7fda00b33b993fa93349801bb71619640e7bc5b58c8c75c0686d9c970221cf151a3171b273451ab42911537189ae63726c5f90f5fbb70171202d2d272752f38ec462664d3fafe5cddbf9bebda2391b448563106326845d9b8c8cce893d0df10f09576e98fda70cb912e9c06446524f1d9cfe9c616edf7b158a9e8de313eb8fad644018634f800b2820757f1452cc1a1258fa07e9f38da056fc23a70efc0a01bdaacae4541c4bdbbcef4bad068baa78128f6b1aeae952e9613d3c7040b96037ac86624dce037672aaac36bba4ce3b66f3b8b8e2014c752db6ba641f1aea3a1e877503d3d2f5f9e02384fa24b02c843a37edfd0ce50f34abf212e6b490fdd637877e10cff20eb8ad5328c99120e26c31132c039df2d2597bacbdcb2c5bc3e0b709fb2e50a9cea7dc02295bdeb21608be2dccc58da9cf6c5730b171c8dead9a8a687ebbf80f8cacb7acc92359c78d92b310317f34952ca9cfbd70345100475f0aebe0bae939ef980aa773efe1ecbdb2140f2670b316919b5ea9ccea8c1afea7ce77e372bc1f1869e3b02fcf16bd168f2cb9723499e505e9217a1423694019ae54ba707a34c3a84a7ecdb2d941158a6cdf525e428b313092003f6f6d5496f0b61dab8f86776e79107b0386b61b77093edc08fcd362bc446a65e67eee002188a16d0daa99536b02af9743bd20182a16cd354bd8d7d9dc81583effc03e37cc6be6be71e3d0bde161493304083c96aa904b332370f3edd7888e97613aead3bdbdd8b166b3eab39d47d89e44299a48a3a132b729fa69a3fa0f9066ba1e22b10a5d7e0373f8448ead3373944f2ad31c2e43468a134d130bf00f13cd88f31aef8d66f7bd22fa4232702e5c5302f70040181660c31957b66075b6555863150086e41e8cc73e30a823365bbc4f77cb106c05b9522a2ac77468a7d619db13ed5cf63e100a0df12bd881c994fba6fd63d2e10b8934f2da1d90dd5b47f5e5fb5a71527e238b7be8a9bcdb78d83d5b13193fc19ae93fc3aa9a1be7d63de42605a204992f6288ec40590536b24c5f92866bee0262fd92b3b5f7a28356f8b3069377643f1424188ad006cd2bf6285d051e3b6d44c376e3f94ddd0ebba7444aaa7030887d401ac7f7c995ceb1e15dfb3933a7f68f91f924dc6a1f95ec0012758f48b838b522edcfba3c2dde4c99f3efc3eba442e2dd9e87b5f16105399de1df65b735ef640a047addf8240d051aa8ac66f652843bd1f9980ae936983514d99a0900ce235c13f8dd6abe47b8503f1d926781cee3b29cfcccaa93f3ce41f2a2b2ecf0e983ef099033ca98e6cf83e5548dc6a437471473c0d32a3f60606dae6364b92721c4d3286a9410e394f6cabcf352ad59eb3c6e1020478a92596cc37d0436e7180d954ab042b7a7a72d563af04021a455d4b8c1afae8f426e74e2ea4c9b6dc9b6a9c53e1c11524d34202c662ba16780b96cb889b981037ad92281fe6c88389c748b8ff43589849f88c4546d34b7cf4e31264c0f768ee6d0f49cf88b064bb3d1a821b8280833662277037300feafb9c94c68d052cbf0130b831407aacde222df9429ec0f4eb45d0999c22ef69ad714e37de3cc99f45547ae5efc01e49d99301da1d12641f9babb0ecec3fa258ced67ee229b16d70d46bff76527eba25fdf745c75a47ff217c3f5a232502a5707abf2bf92f92206b9bf26d47b6b8df61471a2d09bfab667b02771dcf9892dad789a056c81125bb5b25a62208c9cf775cb3a8ca32f3953aea22879aaf4126ce27f2b85fe011a1b3581b2caf6d1b9bc706e36f6ac8f38425b3d899ad0b741142c5ac50d87be218762db2acf36bd34fcec24960e0ad699e34ba5a44d1aed754d3f3994ac2a9b18edd4f035bf7b620f7b3729f9c3bac755ee3a4d86241b15aae71c1a1986ca09b1a64d40b0a7e486e47af312403ffdd32af7311b017eaf7632bd9ad6988dd64ad5819523f6610ca4bc5d01341dadf33288d273b5a860c83b1e87251e64bffa47f27ca0a65b5039b4dd00ec25337485963f936ff0b8974d8ca7c0e1b1b812105d54dbfe3807380fb6ad2e228b14b10d583f6018694dfb08ce1376673cacb6b7aa3603b735d38385d5c6f3ebf520fa447a2379dd84a61d0f1d49478b79998c8f45d21654983617834b27dcf5d93ebf6b429ed0cf7cc8d73ec7a4d3ebe0cea4a51fe3f1697cf25cb33b4b61f7c1519fca7b00ced15e1798df66f4bf9f4591598b1f0d80fb594aef0d6d951cf45c8fdfac7accbd43a9a8f76f29f141d9bc0ce40046352f94e402c4402c67e81b4c468fb26b71325fa9f93a51658a5f5425944eac860bb76bbc9af5b4290ad2365f2af5b28e0a23b2bb7ff5e79b9b9d419e3ca8b44ef66a7a956dc068fb9130fe288165aea9f1bbb91976be1c39d7e893f03cde4267c91f3799dcc7d601d9a16ab3d0aeacf7724849d1f4912c64fe4b8d1e9d094ea6985d11f98f9fe4b37912352b26d233a5022426524cba80dc85be5913e0d34a13fe8fff81f4943d2a0d99ea63fc0511f58cd43e289de859d3658ee4a1cbfe426474a59a7e939d52aa45aaf86d93af40afc64ba180fedf464c58f8da91d6be20dcd6c6813bc038157c5e6a7ad9d23488b472bc3323c2f5d31fca878c2fe27de0b695f24ef664afd918d661b010b2b9634898805d1e7ed37b81309442e059ce3dd3e2e41d8a793ff796527673ea239f253669576d0009b5e329764a0bcb0b5590db7bdf13e87aeb67e716c2b73b51e7601a2d20a800b988d603e2bd5b07af5b6f60504efc69c15b3500b4cafae4303ab16d5efa2a39088c4e18bf7487f341a6f97279076c40430135e8b1ff8f9acc803bd7790c02ba5a47cb033a9e3099eb211a3611b2ca81a2867f6ded71e39c88667989b76e70b8194220d4eaff4ba2761c6276c18b0c35609d9ef701980a0962d95681d48d0ee8799c6b7620ace795145b4976a38d81751484a51d3044fdfb8c1b384456b45b2758df555eb3d9e40456618a5adac744694b56310afcc050cadf5dc07f97556f07cda3677dfcc2527eb557c95739f20d5f7b321eb6f33855947014494ea2c43225134896ec45e1cc1543aebe32c764a0a7ef172388466aa68baaa7c05d98bf88ccefea155928e08eb42f623d9539b214bac4f9b53dfc0e09919761c6e092bff8f5a412b0bf5008f09f22dcb0bd14cab6c53eccb558eae5c3b2f8f434f3a62bc2dc462aacc175f38dbc4370df2241f391707ab3436c3428c6c20f99cb1be1dadc313fceb047567172107acade3298eef85d8fff53fa8645a31c411303d4bf1b5cf0c68d028d428ea69702b17feedee6769e885e4fe48855d80e6757f05b9ad9efce3fa55136c456364fcb85f962f8ae4dd0196857172f08ffe2419539a689e1721cb921c2352531d402a5105dad28e53ff61df5f79fa2db82fc2ec17e77bfcdca3c5290f1101523f0025d28b4f556c0bb9e49cc6320fefa8873adc236ee0fc28a89098b6e565fd7a5fd7cb902fbbae8f1317d92aac62596d0939e308af5c24efe536fc535b9c4a03a62359ba91325d3f3143e58132a0471cac07b11e62ba2e6b0df1899dfa0d2ca143dc7ae01b3943d3eef93a38afc52f9f45af950c726199f30761d7efa1b5aee449d8c64cf65125155b24b2c283d3cb31800e9de18037f1e48f4c34a957cdc1b5ba0020c75b47cd22963274e98f8fae1a0d0d643518a82c8ffb32f818e120e555b9254af033ebcbf25d135485fd685451e5f81ec6ad4523440b3ec7bef18923b4e507fe09c3b3e93eae4e60fb396c2242a4d9f10867e5a008a4441677cab1d24509770d3debebcadc946478ae557c4604b58d1b28768cf3ad511ffd4273df84363c3c9eedd23be509d69e6d9faf5bbceef7390d436ffbe1d67b69936e9e4c832f64bc5acf77e2e27e36e77a913e87df6d55daadc87ff04e1e946c2ec8aea9eb529b9d79e9a2c9659725b76e8f768506b970427dcf73a9422e16e51d148c4be77b4c944be8ec3342320c7d7d45f9ccb43e3e8b04d242f7e02e0889f0bd94cf7f38846cd9f26f2f942c141e9084e4ba8aef7a1caaeddfbb80a8e6ce3f670dafc9c621b8419af95a3498b0f4cfaad6ffcea969b5104e669b03ecfa0ac037af8c58da29e5ed5e6f12a055091d6f0409e23ff3c14ed726ddec9e52aed9665fe828d48b2a2abeef51ec4220ef19c41b317750cf2803cd20eaa48057c981c76b1b9ae0ab006decb1570171d1aee8a56fb4636e825b558f3956715306d469ba90f10378fd18483ee815fe4fe0375bc90d68cb04b3f151d3424b74bf864460f68c9290c7df932866fc1eecfb0803313260d89e51738c78c1e8c99ff10d28bd6d53f5730065903bd2ac8b21395646ef10c977e6b8f0b4309dfa451122276909d1d8e144d05b6198459505a0371271ed0b235ddbec2b2400028008000180fffffffe0900020073797a30000000000900020073797a320000000004000780080003400000000150000a804c0002800900020073797a320000000008000180fffffffe08000180fffffffe0900020073797a30000000000900020073797a310000000008000180fffffffe0900020073797a300000000004000780d0010080c0010a800c00028008000180fffffffd580002800900020073797a310000000008000180000000000900020073797a31000000000900020073797a320000000008000180fffffffd08000180fffffffb0900020073797a32000000000900020073797a3200000000020101008ebf2d155053eabc0f4b09d9957c6dae50dc8811994d280173a5405cd58eaf2a669424afa8c8ab955d1daeb161f79f9d7e42a86df7b4c0d95dae15fa151dac0f0015dd2890590ee49a0f60c1b125350e60c58554bfcc7ea0b6b9cc492e88c9b91f2d041236c1588c2d321097cacc1049c3706f6951a555bf36943a13b89ba3c19fb2e83ec55bb878cddd3d14c422a2860245ff80b9b8e8016961138ab34246c1b9369e298d0c4e31c1ac815cba12169dcff5efef53f603c489d0a5b85d649adb2a5931cb162c32239108a50ac037bf05c15a9c0fa391e92c56b6512c4a16ab917ca4ad97d04e9b7e7aaf7938cad9a261803c408b925edbbb944d1cd29f700000540002800900020073797a32000000000900020073797a3000000000080001800000000008000180fffffffe08000180fffffffc08000180fffffffb0900020073797a31000000000900020073797a31000000000900090073797a310000000018000080040007800900090073797a3000000000040007800900020073797a3200000000"], 0x164c}, 0x1, 0x0, 0x0, 0x40}, 0x4801)

13:15:53 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:53 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:53 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2be}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:53 executing program 0:
syz_emit_ethernet(0xd, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:53 executing program 4:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
recvmmsg(r0, &(0x7f0000001f00)=[{{&(0x7f0000000000)=@caif=@dgm, 0x80, &(0x7f0000001240)=[{&(0x7f0000000080)=""/41, 0x29}, {&(0x7f0000000180)=""/155, 0x9b}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/21, 0x15}], 0x5, &(0x7f00000012c0)=""/179, 0xb3}}, {{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000001580)=[{&(0x7f0000001400)}, {&(0x7f0000001440)=""/22, 0x16}, {&(0x7f0000001480)=""/34, 0x22}, {&(0x7f00000014c0)=""/163, 0xa3}], 0x4, &(0x7f00000015c0)=""/186, 0xba}, 0xfffffffe}, {{&(0x7f0000001680)=@in={0x2, 0x0, @initdev}, 0x80, &(0x7f0000001940)=[{&(0x7f0000001700)=""/44, 0x2c}, {&(0x7f0000001740)=""/26, 0x1a}, {&(0x7f0000001780)=""/64, 0x40}, {&(0x7f00000017c0)=""/92, 0x5c}, {&(0x7f0000001840)=""/59, 0x3b}, {&(0x7f0000001880)=""/143, 0x8f}], 0x6, &(0x7f00000019c0)=""/119, 0x77}, 0x10001}, {{0x0, 0x0, &(0x7f0000001cc0)=[{&(0x7f0000001a40)=""/228, 0xe4}, {&(0x7f0000001b40)=""/255, 0xff}, {&(0x7f0000001c40)=""/26, 0x1a}, {&(0x7f0000001c80)=""/50, 0x32}], 0x4, &(0x7f0000001d00)=""/107, 0x6b}, 0x61}, {{&(0x7f0000001d80)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000001e80)=[{&(0x7f0000001e00)=""/66, 0x42}], 0x1, &(0x7f0000001ec0)=""/58, 0x3a}, 0x4}], 0x5, 0x0, &(0x7f0000002040)={0x0, 0x989680})
socketpair(0x8000000000001e, 0x2, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r4, r3, 0x0, 0x100000002)
setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000002080)="c13c3575c3d311c1119571ea696eed3c395ad1c72533632aa13a3d97d0ec27f711417dbe379124641b174ca8c75d9f0671e1e4c8043758b0752d91f1156739d0d770ed70b48aca7d95e4822fba", 0xfee2)
sendmmsg$alg(r1, &(0x7f0000003240), 0x492492492492619, 0x0)
write$cgroup_int(0xffffffffffffffff, 0x0, 0x0)
close(r2)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000003800)={'bridge_slave_1\x00'})
sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f00000037c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000003780)={&(0x7f0000002100)=ANY=[@ANYBLOB="4c1600000d0a03000000000000000000000000002c160380580000800800034000000000340002802e000100dfcb0b865735903be18b035cb9d5c370b7ebee75cc72f319946d37c8e6daf0247b61926d35dfe2d1cb1d00000c00054000000000000000080c0004400000000000000f08580200800900090073797a31000000000c000540ffffffffffffff22e8000a8073000100c51cd58793e829edae74ef05de1326903e40580fd4441fd2dc7746d1e975c634462d3dab19aaf631f93b04eaa0bcdd9b6a8413096a5a9ccc6f41a6a6536ecd46b99cb45d97ffb48bf3bbe4d6c8823f54b0c8816295182761159590a8cb34ef68b3649bea726cba8ee376cafb1756d4006f0001001cd2a134978cde9084fba9df7d2b0ec67be3960357fe9738d23cd7ff937520096d2938806e7fb23da6c17a72b081577290c17cf2405fae3803ed93455b831616953fbfc802520b459441ccf04a1976cd10e7805ed8747eb66ea8697f91d835f51ab1325bd7b8efee55fc0a0050010a80f7000100686b00710194471b1e0f420dd1430ef9210a1dce96e2cda0ec1f900b34bac616e61172e433edb22370b334483b4707320ff55a1d0e3a88d898dedc4531bd7061217977c9e4af3e2613fd05d08e4810f35a4c5540588d1fe35cd47ec9bfc76b1e3651bec028e68947ee0f12c195c5ca90c045ce0d1054da98578b37a1167e4e49f5e052ee5309338ac1f9e0ae56f8319397ff25160d95fae4e4362ff0e462452cfdc9f9f2e8e518d7fdd6ebaf46c0ac923c2e08be63ce10d4f2df40ff4e9c9c85cc5a04c46080e392652076c81a2d686ef19f4d6a27631ccb7187cb20093c5ee6d43bff500bc1b61db976521b2c84534e8297fb004400028008000180fffffffe0900020073797a300000000008000180fffffffe08000180fffffffd08000180fffffffe08000180fffffffd0900020073797a3100000000100002800900020073797a320000000004000780901100800c00044000000000000057550b00064062752fbbed9344000c000440000000000000079c081101802c0002800900020073797a3200000000080001800000000508000180ffffffff0900020073797a3100000000ab00010087348147dea46bf012a891fc1b3454ddc08191a9034e3ed3fb5f2508eb806b9640ab849a756ffc8b77a202a4825bbe6d5d6e2c50736a0b07a214e32d4451014a6c77c41ccd04d2da04ab90f76486487495a4cf12dd368d596c54a1c83c775836a83088ecc5e33459e91e8483eb8654d4d3940d142a3899f6cc828b24d1c4d470f3985804a55e96e85a246872e5f5201ced37d2abc1899029db916759df8e6eeeda6ad2851d0a68000400010004100100e613cdb98279fd55d319c754284068416b4881cc574610de4c9dc50cfe329ca9904ecb30a115d514b5978b4179718edc1c17503c6c7332b8229883bfb4f71a38672cc40e1f7447773cc4c5c9f17a99d42844c849e1dcc8eeefe699aa358b3773a75adca93c7e5ab98556678994354ea07506d7cd0892c3cb433f3d3e2bbe2634cc898581bd203d6c9265c72acc7db149c5a7fea1ad1d21622c2325a3ef9d75ab4fdec7e58130fddd248e63ab5e812b9eb4f714667d3ece99cec605714a1f8e4860e99bcee4a0a9ca17c0198f1238a1a4e20709789845681f11f02bc998d0747ceb6ac5d55e03878cd76385438b4451549e1c4854b03317ef4e2d1b8ebff99b21ef3e935d83ec13b8ff9ec391af7551c38b12e061bba01d1cdc01c8407bd1c3b62d716f5ffe7e59479b6acc20fe755b471c8b38e6f9051ca95e8f4498bc01dc341a75ef5d42451bdf97ceebccfa7f05f80f06fd0baf9c8f70513bf0fbd5e08695a503f1371cdc35fc48fb73cbb29700662e95ee203b433ad039a9014335a4b179d122671645fa9e753d9010026cb103e345a660be812d2af23c0139338918ce5d343243a9ac2aabe6825f8ecc2a241ebc89f349b7f72ac2f9f858e2406cdf13d4a20335e761dd63d7854e329cb1f6a428becf01284686a34e4c727f87ec8164f1174c13101bad28966463f276351095904af03ca0d90a937ef15dabfad92f136432d5aaa2c004d4e02cc5855236ef8287e6d273ed46a27097a385f29765438366eec3abd72d3e2c41eda1d53934142ac75c8b0758b922e6cb2c918ae90e36470608a51b61c28b6d7588edfe327226d4615224deaeeca7f5370b2de8e77fb5dceb0bdcc08084adf163891990193c3e22f2de27d0487e2dba829a0e0871fe4e4191b5f9c68f361157f068c5eb7ab5c380ce90215fd48a77b2c00dc04fc5fa87e96b0f09b57f33c9a566b602cb2aad23edf7a1fc7b258574199bcd1c09c3586198c617659d863552e3475060e27776bb8089da7ad03d7a24a9a616c38d5d5bd82b70b14451a44783f336b3139c4c049dca299916eec02e3c0f55b98906e113abbbe56e11d5bed1d7e7b70d5409097c05cec85b463b28e08e9ea2a73237cf71c438e27182a1efa1f06c8857bd1404cf06e8656ef73c441c965d3d32196a6e0aa89015322260665b41afbe2fb2d5152d608ae62351f9cb94d97bbba2a47bbe2c0d47c3a0e581619aff5ff5d5cfbf985dd07967feec3e7b20a1c9ce65525a0beafff54f634d87cec7d77556ed662f07e759955d1cede0c09553bab680ac5da77c91f89b437f7fa219a6574a8ef98d4a44ff7ff8720c15651cc239f7a2a7fda00b33b993fa93349801bb71619640e7bc5b58c8c75c0686d9c970221cf151a3171b273451ab42911537189ae63726c5f90f5fbb70171202d2d272752f38ec462664d3fafe5cddbf9bebda2391b448563106326845d9b8c8cce893d0df10f09576e98fda70cb912e9c06446524f1d9cfe9c616edf7b158a9e8de313eb8fad644018634f800b2820757f1452cc1a1258fa07e9f38da056fc23a70efc0a01bdaacae4541c4bdbbcef4bad068baa78128f6b1aeae952e9613d3c7040b96037ac86624dce037672aaac36bba4ce3b66f3b8b8e2014c752db6ba641f1aea3a1e877503d3d2f5f9e02384fa24b02c843a37edfd0ce50f34abf212e6b490fdd637877e10cff20eb8ad5328c99120e26c31132c039df2d2597bacbdcb2c5bc3e0b709fb2e50a9cea7dc02295bdeb21608be2dccc58da9cf6c5730b171c8dead9a8a687ebbf80f8cacb7acc92359c78d92b310317f34952ca9cfbd70345100475f0aebe0bae939ef980aa773efe1ecbdb2140f2670b316919b5ea9ccea8c1afea7ce77e372bc1f1869e3b02fcf16bd168f2cb9723499e505e9217a1423694019ae54ba707a34c3a84a7ecdb2d941158a6cdf525e428b313092003f6f6d5496f0b61dab8f86776e79107b0386b61b77093edc08fcd362bc446a65e67eee002188a16d0daa99536b02af9743bd20182a16cd354bd8d7d9dc81583effc03e37cc6be6be71e3d0bde161493304083c96aa904b332370f3edd7888e97613aead3bdbdd8b166b3eab39d47d89e44299a48a3a132b729fa69a3fa0f9066ba1e22b10a5d7e0373f8448ead3373944f2ad31c2e43468a134d130bf00f13cd88f31aef8d66f7bd22fa4232702e5c5302f70040181660c31957b66075b6555863150086e41e8cc73e30a823365bbc4f77cb106c05b9522a2ac77468a7d619db13ed5cf63e100a0df12bd881c994fba6fd63d2e10b8934f2da1d90dd5b47f5e5fb5a71527e238b7be8a9bcdb78d83d5b13193fc19ae93fc3aa9a1be7d63de42605a204992f6288ec40590536b24c5f92866bee0262fd92b3b5f7a28356f8b3069377643f1424188ad006cd2bf6285d051e3b6d44c376e3f94ddd0ebba7444aaa7030887d401ac7f7c995ceb1e15dfb3933a7f68f91f924dc6a1f95ec0012758f48b838b522edcfba3c2dde4c99f3efc3eba442e2dd9e87b5f16105399de1df65b735ef640a047addf8240d051aa8ac66f652843bd1f9980ae936983514d99a0900ce235c13f8dd6abe47b8503f1d926781cee3b29cfcccaa93f3ce41f2a2b2ecf0e983ef099033ca98e6cf83e5548dc6a437471473c0d32a3f60606dae6364b92721c4d3286a9410e394f6cabcf352ad59eb3c6e1020478a92596cc37d0436e7180d954ab042b7a7a72d563af04021a455d4b8c1afae8f426e74e2ea4c9b6dc9b6a9c53e1c11524d34202c662ba16780b96cb889b981037ad92281fe6c88389c748b8ff43589849f88c4546d34b7cf4e31264c0f768ee6d0f49cf88b064bb3d1a821b8280833662277037300feafb9c94c68d052cbf0130b831407aacde222df9429ec0f4eb45d0999c22ef69ad714e37de3cc99f45547ae5efc01e49d99301da1d12641f9babb0ecec3fa258ced67ee229b16d70d46bff76527eba25fdf745c75a47ff217c3f5a232502a5707abf2bf92f92206b9bf26d47b6b8df61471a2d09bfab667b02771dcf9892dad789a056c81125bb5b25a62208c9cf775cb3a8ca32f3953aea22879aaf4126ce27f2b85fe011a1b3581b2caf6d1b9bc706e36f6ac8f38425b3d899ad0b741142c5ac50d87be218762db2acf36bd34fcec24960e0ad699e34ba5a44d1aed754d3f3994ac2a9b18edd4f035bf7b620f7b3729f9c3bac755ee3a4d86241b15aae71c1a1986ca09b1a64d40b0a7e486e47af312403ffdd32af7311b017eaf7632bd9ad6988dd64ad5819523f6610ca4bc5d01341dadf33288d273b5a860c83b1e87251e64bffa47f27ca0a65b5039b4dd00ec25337485963f936ff0b8974d8ca7c0e1b1b812105d54dbfe3807380fb6ad2e228b14b10d583f6018694dfb08ce1376673cacb6b7aa3603b735d38385d5c6f3ebf520fa447a2379dd84a61d0f1d49478b79998c8f45d21654983617834b27dcf5d93ebf6b429ed0cf7cc8d73ec7a4d3ebe0cea4a51fe3f1697cf25cb33b4b61f7c1519fca7b00ced15e1798df66f4bf9f4591598b1f0d80fb594aef0d6d951cf45c8fdfac7accbd43a9a8f76f29f141d9bc0ce40046352f94e402c4402c67e81b4c468fb26b71325fa9f93a51658a5f5425944eac860bb76bbc9af5b4290ad2365f2af5b28e0a23b2bb7ff5e79b9b9d419e3ca8b44ef66a7a956dc068fb9130fe288165aea9f1bbb91976be1c39d7e893f03cde4267c91f3799dcc7d601d9a16ab3d0aeacf7724849d1f4912c64fe4b8d1e9d094ea6985d11f98f9fe4b37912352b26d233a5022426524cba80dc85be5913e0d34a13fe8fff81f4943d2a0d99ea63fc0511f58cd43e289de859d3658ee4a1cbfe426474a59a7e939d52aa45aaf86d93af40afc64ba180fedf464c58f8da91d6be20dcd6c6813bc038157c5e6a7ad9d23488b472bc3323c2f5d31fca878c2fe27de0b695f24ef664afd918d661b010b2b9634898805d1e7ed37b81309442e059ce3dd3e2e41d8a793ff796527673ea239f253669576d0009b5e329764a0bcb0b5590db7bdf13e87aeb67e716c2b73b51e7601a2d20a800b988d603e2bd5b07af5b6f60504efc69c15b3500b4cafae4303ab16d5efa2a39088c4e18bf7487f341a6f97279076c40430135e8b1ff8f9acc803bd7790c02ba5a47cb033a9e3099eb211a3611b2ca81a2867f6ded71e39c88667989b76e70b8194220d4eaff4ba2761c6276c18b0c35609d9ef701980a0962d95681d48d0ee8799c6b7620ace795145b4976a38d81751484a51d3044fdfb8c1b384456b45b2758df555eb3d9e40456618a5adac744694b56310afcc050cadf5dc07f97556f07cda3677dfcc2527eb557c95739f20d5f7b321eb6f33855947014494ea2c43225134896ec45e1cc1543aebe32c764a0a7ef172388466aa68baaa7c05d98bf88ccefea155928e08eb42f623d9539b214bac4f9b53dfc0e09919761c6e092bff8f5a412b0bf5008f09f22dcb0bd14cab6c53eccb558eae5c3b2f8f434f3a62bc2dc462aacc175f38dbc4370df2241f391707ab3436c3428c6c20f99cb1be1dadc313fceb047567172107acade3298eef85d8fff53fa8645a31c411303d4bf1b5cf0c68d028d428ea69702b17feedee6769e885e4fe48855d80e6757f05b9ad9efce3fa55136c456364fcb85f962f8ae4dd0196857172f08ffe2419539a689e1721cb921c2352531d402a5105dad28e53ff61df5f79fa2db82fc2ec17e77bfcdca3c5290f1101523f0025d28b4f556c0bb9e49cc6320fefa8873adc236ee0fc28a89098b6e565fd7a5fd7cb902fbbae8f1317d92aac62596d0939e308af5c24efe536fc535b9c4a03a62359ba91325d3f3143e58132a0471cac07b11e62ba2e6b0df1899dfa0d2ca143dc7ae01b3943d3eef93a38afc52f9f45af950c726199f30761d7efa1b5aee449d8c64cf65125155b24b2c283d3cb31800e9de18037f1e48f4c34a957cdc1b5ba0020c75b47cd22963274e98f8fae1a0d0d643518a82c8ffb32f818e120e555b9254af033ebcbf25d135485fd685451e5f81ec6ad4523440b3ec7bef18923b4e507fe09c3b3e93eae4e60fb396c2242a4d9f10867e5a008a4441677cab1d24509770d3debebcadc946478ae557c4604b58d1b28768cf3ad511ffd4273df84363c3c9eedd23be509d69e6d9faf5bbceef7390d436ffbe1d67b69936e9e4c832f64bc5acf77e2e27e36e77a913e87df6d55daadc87ff04e1e946c2ec8aea9eb529b9d79e9a2c9659725b76e8f768506b970427dcf73a9422e16e51d148c4be77b4c944be8ec3342320c7d7d45f9ccb43e3e8b04d242f7e02e0889f0bd94cf7f38846cd9f26f2f942c141e9084e4ba8aef7a1caaeddfbb80a8e6ce3f670dafc9c621b8419af95a3498b0f4cfaad6ffcea969b5104e669b03ecfa0ac037af8c58da29e5ed5e6f12a055091d6f0409e23ff3c14ed726ddec9e52aed9665fe828d48b2a2abeef51ec4220ef19c41b317750cf2803cd20eaa48057c981c76b1b9ae0ab006decb1570171d1aee8a56fb4636e825b558f3956715306d469ba90f10378fd18483ee815fe4fe0375bc90d68cb04b3f151d3424b74bf864460f68c9290c7df932866fc1eecfb0803313260d89e51738c78c1e8c99ff10d28bd6d53f5730065903bd2ac8b21395646ef10c977e6b8f0b4309dfa451122276909d1d8e144d05b6198459505a0371271ed0b235ddbec2b2400028008000180fffffffe0900020073797a30000000000900020073797a320000000004000780080003400000000150000a804c0002800900020073797a320000000008000180fffffffe08000180fffffffe0900020073797a30000000000900020073797a310000000008000180fffffffe0900020073797a300000000004000780d0010080c0010a800c00028008000180fffffffd580002800900020073797a310000000008000180000000000900020073797a31000000000900020073797a320000000008000180fffffffd08000180fffffffb0900020073797a32000000000900020073797a3200000000020101008ebf2d155053eabc0f4b09d9957c6dae50dc8811994d280173a5405cd58eaf2a669424afa8c8ab955d1daeb161f79f9d7e42a86df7b4c0d95dae15fa151dac0f0015dd2890590ee49a0f60c1b125350e60c58554bfcc7ea0b6b9cc492e88c9b91f2d041236c1588c2d321097cacc1049c3706f6951a555bf36943a13b89ba3c19fb2e83ec55bb878cddd3d14c422a2860245ff80b9b8e8016961138ab34246c1b9369e298d0c4e31c1ac815cba12169dcff5efef53f603c489d0a5b85d649adb2a5931cb162c32239108a50ac037bf05c15a9c0fa391e92c56b6512c4a16ab917ca4ad97d04e9b7e7aaf7938cad9a261803c408b925edbbb944d1cd29f700000540002800900020073797a32000000000900020073797a3000000000080001800000000008000180fffffffe08000180fffffffc08000180fffffffb0900020073797a31000000000900020073797a31000000000900090073797a310000000018000080040007800900090073797a3000000000040007800900020073797a3200000000"], 0x164c}, 0x1, 0x0, 0x0, 0x40}, 0x4801)

[ 3308.025542][T19550] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3308.083585][T19547] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3308.108760][T19550] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
13:15:53 executing program 0:
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:53 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:53 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3308.164536][T19556] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3308.285676][T19556] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3308.300168][T19547] device ipvlan1606 entered promiscuous mode
[ 3308.448018][   T29] audit: type=1800 audit(1596806154.140:3121): pid=19552 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16002 res=0
13:15:54 executing program 0:
syz_emit_ethernet(0xfdef, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3308.539116][T19552] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:54 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3308.646125][   T29] audit: type=1804 audit(1596806154.280:3122): pid=19547 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1562/cgroup.controllers" dev="sda1" ino=16002 res=1
13:15:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3308.746047][T19552] device ipvlan1607 entered promiscuous mode
13:15:54 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
recvmmsg(r0, &(0x7f0000001f00)=[{{&(0x7f0000000000)=@caif=@dgm, 0x80, &(0x7f0000001240)=[{&(0x7f0000000080)=""/41, 0x29}, {&(0x7f0000000180)=""/155, 0x9b}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/21, 0x15}], 0x5, &(0x7f00000012c0)=""/179, 0xb3}}, {{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000001580)=[{&(0x7f0000001400)}, {&(0x7f0000001440)=""/22, 0x16}, {&(0x7f0000001480)=""/34, 0x22}, {&(0x7f00000014c0)=""/163, 0xa3}], 0x4, &(0x7f00000015c0)=""/186, 0xba}, 0xfffffffe}, {{&(0x7f0000001680)=@in={0x2, 0x0, @initdev}, 0x80, &(0x7f0000001940)=[{&(0x7f0000001700)=""/44, 0x2c}, {&(0x7f0000001740)=""/26, 0x1a}, {&(0x7f0000001780)=""/64, 0x40}, {&(0x7f00000017c0)=""/92, 0x5c}, {&(0x7f0000001840)=""/59, 0x3b}, {&(0x7f0000001880)=""/143, 0x8f}], 0x6, &(0x7f00000019c0)=""/119, 0x77}, 0x10001}, {{0x0, 0x0, &(0x7f0000001cc0)=[{&(0x7f0000001a40)=""/228, 0xe4}, {&(0x7f0000001b40)=""/255, 0xff}, {&(0x7f0000001c40)=""/26, 0x1a}, {&(0x7f0000001c80)=""/50, 0x32}], 0x4, &(0x7f0000001d00)=""/107, 0x6b}, 0x61}, {{&(0x7f0000001d80)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000001e80)=[{&(0x7f0000001e00)=""/66, 0x42}], 0x1, &(0x7f0000001ec0)=""/58, 0x3a}, 0x4}], 0x5, 0x0, &(0x7f0000002040)={0x0, 0x989680})
socketpair(0x8000000000001e, 0x2, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r4, r3, 0x0, 0x100000002)
setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000002080)="c13c3575c3d311c1119571ea696eed3c395ad1c72533632aa13a3d97d0ec27f711417dbe379124641b174ca8c75d9f0671e1e4c8043758b0752d91f1156739d0d770ed70b48aca7d95e4822fba", 0xfee2)
sendmmsg$alg(r1, &(0x7f0000003240), 0x492492492492619, 0x0)
write$cgroup_int(0xffffffffffffffff, 0x0, 0x0)
close(r2)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000003800)={'bridge_slave_1\x00'})
sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f00000037c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000003780)={&(0x7f0000002100)=ANY=[@ANYBLOB="4c1600000d0a03000000000000000000000000002c160380580000800800034000000000340002802e000100dfcb0b865735903be18b035cb9d5c370b7ebee75cc72f319946d37c8e6daf0247b61926d35dfe2d1cb1d00000c00054000000000000000080c0004400000000000000f08580200800900090073797a31000000000c000540ffffffffffffff22e8000a8073000100c51cd58793e829edae74ef05de1326903e40580fd4441fd2dc7746d1e975c634462d3dab19aaf631f93b04eaa0bcdd9b6a8413096a5a9ccc6f41a6a6536ecd46b99cb45d97ffb48bf3bbe4d6c8823f54b0c8816295182761159590a8cb34ef68b3649bea726cba8ee376cafb1756d4006f0001001cd2a134978cde9084fba9df7d2b0ec67be3960357fe9738d23cd7ff937520096d2938806e7fb23da6c17a72b081577290c17cf2405fae3803ed93455b831616953fbfc802520b459441ccf04a1976cd10e7805ed8747eb66ea8697f91d835f51ab1325bd7b8efee55fc0a0050010a80f7000100686b00710194471b1e0f420dd1430ef9210a1dce96e2cda0ec1f900b34bac616e61172e433edb22370b334483b4707320ff55a1d0e3a88d898dedc4531bd7061217977c9e4af3e2613fd05d08e4810f35a4c5540588d1fe35cd47ec9bfc76b1e3651bec028e68947ee0f12c195c5ca90c045ce0d1054da98578b37a1167e4e49f5e052ee5309338ac1f9e0ae56f8319397ff25160d95fae4e4362ff0e462452cfdc9f9f2e8e518d7fdd6ebaf46c0ac923c2e08be63ce10d4f2df40ff4e9c9c85cc5a04c46080e392652076c81a2d686ef19f4d6a27631ccb7187cb20093c5ee6d43bff500bc1b61db976521b2c84534e8297fb004400028008000180fffffffe0900020073797a300000000008000180fffffffe08000180fffffffd08000180fffffffe08000180fffffffd0900020073797a3100000000100002800900020073797a320000000004000780901100800c00044000000000000057550b00064062752fbbed9344000c000440000000000000079c081101802c0002800900020073797a3200000000080001800000000508000180ffffffff0900020073797a3100000000ab00010087348147dea46bf012a891fc1b3454ddc08191a9034e3ed3fb5f2508eb806b9640ab849a756ffc8b77a202a4825bbe6d5d6e2c50736a0b07a214e32d4451014a6c77c41ccd04d2da04ab90f76486487495a4cf12dd368d596c54a1c83c775836a83088ecc5e33459e91e8483eb8654d4d3940d142a3899f6cc828b24d1c4d470f3985804a55e96e85a246872e5f5201ced37d2abc1899029db916759df8e6eeeda6ad2851d0a68000400010004100100e613cdb98279fd55d319c754284068416b4881cc574610de4c9dc50cfe329ca9904ecb30a115d514b5978b4179718edc1c17503c6c7332b8229883bfb4f71a38672cc40e1f7447773cc4c5c9f17a99d42844c849e1dcc8eeefe699aa358b3773a75adca93c7e5ab98556678994354ea07506d7cd0892c3cb433f3d3e2bbe2634cc898581bd203d6c9265c72acc7db149c5a7fea1ad1d21622c2325a3ef9d75ab4fdec7e58130fddd248e63ab5e812b9eb4f714667d3ece99cec605714a1f8e4860e99bcee4a0a9ca17c0198f1238a1a4e20709789845681f11f02bc998d0747ceb6ac5d55e03878cd76385438b4451549e1c4854b03317ef4e2d1b8ebff99b21ef3e935d83ec13b8ff9ec391af7551c38b12e061bba01d1cdc01c8407bd1c3b62d716f5ffe7e59479b6acc20fe755b471c8b38e6f9051ca95e8f4498bc01dc341a75ef5d42451bdf97ceebccfa7f05f80f06fd0baf9c8f70513bf0fbd5e08695a503f1371cdc35fc48fb73cbb29700662e95ee203b433ad039a9014335a4b179d122671645fa9e753d9010026cb103e345a660be812d2af23c0139338918ce5d343243a9ac2aabe6825f8ecc2a241ebc89f349b7f72ac2f9f858e2406cdf13d4a20335e761dd63d7854e329cb1f6a428becf01284686a34e4c727f87ec8164f1174c13101bad28966463f276351095904af03ca0d90a937ef15dabfad92f136432d5aaa2c004d4e02cc5855236ef8287e6d273ed46a27097a385f29765438366eec3abd72d3e2c41eda1d53934142ac75c8b0758b922e6cb2c918ae90e36470608a51b61c28b6d7588edfe327226d4615224deaeeca7f5370b2de8e77fb5dceb0bdcc08084adf163891990193c3e22f2de27d0487e2dba829a0e0871fe4e4191b5f9c68f361157f068c5eb7ab5c380ce90215fd48a77b2c00dc04fc5fa87e96b0f09b57f33c9a566b602cb2aad23edf7a1fc7b258574199bcd1c09c3586198c617659d863552e3475060e27776bb8089da7ad03d7a24a9a616c38d5d5bd82b70b14451a44783f336b3139c4c049dca299916eec02e3c0f55b98906e113abbbe56e11d5bed1d7e7b70d5409097c05cec85b463b28e08e9ea2a73237cf71c438e27182a1efa1f06c8857bd1404cf06e8656ef73c441c965d3d32196a6e0aa89015322260665b41afbe2fb2d5152d608ae62351f9cb94d97bbba2a47bbe2c0d47c3a0e581619aff5ff5d5cfbf985dd07967feec3e7b20a1c9ce65525a0beafff54f634d87cec7d77556ed662f07e759955d1cede0c09553bab680ac5da77c91f89b437f7fa219a6574a8ef98d4a44ff7ff8720c15651cc239f7a2a7fda00b33b993fa93349801bb71619640e7bc5b58c8c75c0686d9c970221cf151a3171b273451ab42911537189ae63726c5f90f5fbb70171202d2d272752f38ec462664d3fafe5cddbf9bebda2391b448563106326845d9b8c8cce893d0df10f09576e98fda70cb912e9c06446524f1d9cfe9c616edf7b158a9e8de313eb8fad644018634f800b2820757f1452cc1a1258fa07e9f38da056fc23a70efc0a01bdaacae4541c4bdbbcef4bad068baa78128f6b1aeae952e9613d3c7040b96037ac86624dce037672aaac36bba4ce3b66f3b8b8e2014c752db6ba641f1aea3a1e877503d3d2f5f9e02384fa24b02c843a37edfd0ce50f34abf212e6b490fdd637877e10cff20eb8ad5328c99120e26c31132c039df2d2597bacbdcb2c5bc3e0b709fb2e50a9cea7dc02295bdeb21608be2dccc58da9cf6c5730b171c8dead9a8a687ebbf80f8cacb7acc92359c78d92b310317f34952ca9cfbd70345100475f0aebe0bae939ef980aa773efe1ecbdb2140f2670b316919b5ea9ccea8c1afea7ce77e372bc1f1869e3b02fcf16bd168f2cb9723499e505e9217a1423694019ae54ba707a34c3a84a7ecdb2d941158a6cdf525e428b313092003f6f6d5496f0b61dab8f86776e79107b0386b61b77093edc08fcd362bc446a65e67eee002188a16d0daa99536b02af9743bd20182a16cd354bd8d7d9dc81583effc03e37cc6be6be71e3d0bde161493304083c96aa904b332370f3edd7888e97613aead3bdbdd8b166b3eab39d47d89e44299a48a3a132b729fa69a3fa0f9066ba1e22b10a5d7e0373f8448ead3373944f2ad31c2e43468a134d130bf00f13cd88f31aef8d66f7bd22fa4232702e5c5302f70040181660c31957b66075b6555863150086e41e8cc73e30a823365bbc4f77cb106c05b9522a2ac77468a7d619db13ed5cf63e100a0df12bd881c994fba6fd63d2e10b8934f2da1d90dd5b47f5e5fb5a71527e238b7be8a9bcdb78d83d5b13193fc19ae93fc3aa9a1be7d63de42605a204992f6288ec40590536b24c5f92866bee0262fd92b3b5f7a28356f8b3069377643f1424188ad006cd2bf6285d051e3b6d44c376e3f94ddd0ebba7444aaa7030887d401ac7f7c995ceb1e15dfb3933a7f68f91f924dc6a1f95ec0012758f48b838b522edcfba3c2dde4c99f3efc3eba442e2dd9e87b5f16105399de1df65b735ef640a047addf8240d051aa8ac66f652843bd1f9980ae936983514d99a0900ce235c13f8dd6abe47b8503f1d926781cee3b29cfcccaa93f3ce41f2a2b2ecf0e983ef099033ca98e6cf83e5548dc6a437471473c0d32a3f60606dae6364b92721c4d3286a9410e394f6cabcf352ad59eb3c6e1020478a92596cc37d0436e7180d954ab042b7a7a72d563af04021a455d4b8c1afae8f426e74e2ea4c9b6dc9b6a9c53e1c11524d34202c662ba16780b96cb889b981037ad92281fe6c88389c748b8ff43589849f88c4546d34b7cf4e31264c0f768ee6d0f49cf88b064bb3d1a821b8280833662277037300feafb9c94c68d052cbf0130b831407aacde222df9429ec0f4eb45d0999c22ef69ad714e37de3cc99f45547ae5efc01e49d99301da1d12641f9babb0ecec3fa258ced67ee229b16d70d46bff76527eba25fdf745c75a47ff217c3f5a232502a5707abf2bf92f92206b9bf26d47b6b8df61471a2d09bfab667b02771dcf9892dad789a056c81125bb5b25a62208c9cf775cb3a8ca32f3953aea22879aaf4126ce27f2b85fe011a1b3581b2caf6d1b9bc706e36f6ac8f38425b3d899ad0b741142c5ac50d87be218762db2acf36bd34fcec24960e0ad699e34ba5a44d1aed754d3f3994ac2a9b18edd4f035bf7b620f7b3729f9c3bac755ee3a4d86241b15aae71c1a1986ca09b1a64d40b0a7e486e47af312403ffdd32af7311b017eaf7632bd9ad6988dd64ad5819523f6610ca4bc5d01341dadf33288d273b5a860c83b1e87251e64bffa47f27ca0a65b5039b4dd00ec25337485963f936ff0b8974d8ca7c0e1b1b812105d54dbfe3807380fb6ad2e228b14b10d583f6018694dfb08ce1376673cacb6b7aa3603b735d38385d5c6f3ebf520fa447a2379dd84a61d0f1d49478b79998c8f45d21654983617834b27dcf5d93ebf6b429ed0cf7cc8d73ec7a4d3ebe0cea4a51fe3f1697cf25cb33b4b61f7c1519fca7b00ced15e1798df66f4bf9f4591598b1f0d80fb594aef0d6d951cf45c8fdfac7accbd43a9a8f76f29f141d9bc0ce40046352f94e402c4402c67e81b4c468fb26b71325fa9f93a51658a5f5425944eac860bb76bbc9af5b4290ad2365f2af5b28e0a23b2bb7ff5e79b9b9d419e3ca8b44ef66a7a956dc068fb9130fe288165aea9f1bbb91976be1c39d7e893f03cde4267c91f3799dcc7d601d9a16ab3d0aeacf7724849d1f4912c64fe4b8d1e9d094ea6985d11f98f9fe4b37912352b26d233a5022426524cba80dc85be5913e0d34a13fe8fff81f4943d2a0d99ea63fc0511f58cd43e289de859d3658ee4a1cbfe426474a59a7e939d52aa45aaf86d93af40afc64ba180fedf464c58f8da91d6be20dcd6c6813bc038157c5e6a7ad9d23488b472bc3323c2f5d31fca878c2fe27de0b695f24ef664afd918d661b010b2b9634898805d1e7ed37b81309442e059ce3dd3e2e41d8a793ff796527673ea239f253669576d0009b5e329764a0bcb0b5590db7bdf13e87aeb67e716c2b73b51e7601a2d20a800b988d603e2bd5b07af5b6f60504efc69c15b3500b4cafae4303ab16d5efa2a39088c4e18bf7487f341a6f97279076c40430135e8b1ff8f9acc803bd7790c02ba5a47cb033a9e3099eb211a3611b2ca81a2867f6ded71e39c88667989b76e70b8194220d4eaff4ba2761c6276c18b0c35609d9ef701980a0962d95681d48d0ee8799c6b7620ace795145b4976a38d81751484a51d3044fdfb8c1b384456b45b2758df555eb3d9e40456618a5adac744694b56310afcc050cadf5dc07f97556f07cda3677dfcc2527eb557c95739f20d5f7b321eb6f33855947014494ea2c43225134896ec45e1cc1543aebe32c764a0a7ef172388466aa68baaa7c05d98bf88ccefea155928e08eb42f623d9539b214bac4f9b53dfc0e09919761c6e092bff8f5a412b0bf5008f09f22dcb0bd14cab6c53eccb558eae5c3b2f8f434f3a62bc2dc462aacc175f38dbc4370df2241f391707ab3436c3428c6c20f99cb1be1dadc313fceb047567172107acade3298eef85d8fff53fa8645a31c411303d4bf1b5cf0c68d028d428ea69702b17feedee6769e885e4fe48855d80e6757f05b9ad9efce3fa55136c456364fcb85f962f8ae4dd0196857172f08ffe2419539a689e1721cb921c2352531d402a5105dad28e53ff61df5f79fa2db82fc2ec17e77bfcdca3c5290f1101523f0025d28b4f556c0bb9e49cc6320fefa8873adc236ee0fc28a89098b6e565fd7a5fd7cb902fbbae8f1317d92aac62596d0939e308af5c24efe536fc535b9c4a03a62359ba91325d3f3143e58132a0471cac07b11e62ba2e6b0df1899dfa0d2ca143dc7ae01b3943d3eef93a38afc52f9f45af950c726199f30761d7efa1b5aee449d8c64cf65125155b24b2c283d3cb31800e9de18037f1e48f4c34a957cdc1b5ba0020c75b47cd22963274e98f8fae1a0d0d643518a82c8ffb32f818e120e555b9254af033ebcbf25d135485fd685451e5f81ec6ad4523440b3ec7bef18923b4e507fe09c3b3e93eae4e60fb396c2242a4d9f10867e5a008a4441677cab1d24509770d3debebcadc946478ae557c4604b58d1b28768cf3ad511ffd4273df84363c3c9eedd23be509d69e6d9faf5bbceef7390d436ffbe1d67b69936e9e4c832f64bc5acf77e2e27e36e77a913e87df6d55daadc87ff04e1e946c2ec8aea9eb529b9d79e9a2c9659725b76e8f768506b970427dcf73a9422e16e51d148c4be77b4c944be8ec3342320c7d7d45f9ccb43e3e8b04d242f7e02e0889f0bd94cf7f38846cd9f26f2f942c141e9084e4ba8aef7a1caaeddfbb80a8e6ce3f670dafc9c621b8419af95a3498b0f4cfaad6ffcea969b5104e669b03ecfa0ac037af8c58da29e5ed5e6f12a055091d6f0409e23ff3c14ed726ddec9e52aed9665fe828d48b2a2abeef51ec4220ef19c41b317750cf2803cd20eaa48057c981c76b1b9ae0ab006decb1570171d1aee8a56fb4636e825b558f3956715306d469ba90f10378fd18483ee815fe4fe0375bc90d68cb04b3f151d3424b74bf864460f68c9290c7df932866fc1eecfb0803313260d89e51738c78c1e8c99ff10d28bd6d53f5730065903bd2ac8b21395646ef10c977e6b8f0b4309dfa451122276909d1d8e144d05b6198459505a0371271ed0b235ddbec2b2400028008000180fffffffe0900020073797a30000000000900020073797a320000000004000780080003400000000150000a804c0002800900020073797a320000000008000180fffffffe08000180fffffffe0900020073797a30000000000900020073797a310000000008000180fffffffe0900020073797a300000000004000780d0010080c0010a800c00028008000180fffffffd580002800900020073797a310000000008000180000000000900020073797a31000000000900020073797a320000000008000180fffffffd08000180fffffffb0900020073797a32000000000900020073797a3200000000020101008ebf2d155053eabc0f4b09d9957c6dae50dc8811994d280173a5405cd58eaf2a669424afa8c8ab955d1daeb161f79f9d7e42a86df7b4c0d95dae15fa151dac0f0015dd2890590ee49a0f60c1b125350e60c58554bfcc7ea0b6b9cc492e88c9b91f2d041236c1588c2d321097cacc1049c3706f6951a555bf36943a13b89ba3c19fb2e83ec55bb878cddd3d14c422a2860245ff80b9b8e8016961138ab34246c1b9369e298d0c4e31c1ac815cba12169dcff5efef53f603c489d0a5b85d649adb2a5931cb162c32239108a50ac037bf05c15a9c0fa391e92c56b6512c4a16ab917ca4ad97d04e9b7e7aaf7938cad9a261803c408b925edbbb944d1cd29f700000540002800900020073797a32000000000900020073797a3000000000080001800000000008000180fffffffe08000180fffffffc08000180fffffffb0900020073797a31000000000900020073797a31000000000900090073797a310000000018000080040007800900090073797a3000000000040007800900020073797a3200000000"], 0x164c}, 0x1, 0x0, 0x0, 0x40}, 0x4801)

13:15:54 executing program 0:
syz_emit_ethernet(0x2000007e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:54 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2bf}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:54 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:54 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:54 executing program 4:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0)
openat$cgroup_procs(r0, &(0x7f0000000140)='tasks\x00', 0x2, 0x0)
write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r0, 0x0)
shutdown(0xffffffffffffffff, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x2c, &(0x7f0000000080)=[@in={0x2, 0x4e21, @private=0xa010100}, @in6={0xa, 0x4e21, 0x0, @dev, 0x6}]}, &(0x7f0000000180)=0x10)
r1 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r2=>0x0}, &(0x7f0000000040)=0x8)
setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00000001c0)={r2, 0x8}, 0x14)
getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000200)={r2, 0x2}, &(0x7f0000000240)=0x8)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = socket$kcm(0x10, 0x2, 0x10)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r5, 0x0)
getsockname$ax25(0xffffffffffffffff, &(0x7f0000000280)={{0x3, @default}, [@remote, @remote, @netrom, @netrom, @default, @remote, @default, @bcast]}, &(0x7f0000000300)=0x48)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYRES16=r4], 0x1}, 0x1, 0x0, 0x0, 0x4000894}, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r6, r3, 0x0, 0x100000001)

[ 3309.476130][T19588] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3309.512372][T19596] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3309.528181][   T29] audit: type=1804 audit(1596806155.220:3123): pid=19595 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir737268182/syzkaller.QFVM5g/158/cgroup.controllers" dev="sda1" ino=16306 res=1
13:15:55 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:55 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:55 executing program 0:
syz_emit_ethernet(0xfffffdef, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3309.682870][T19596] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3309.758863][T19588] device ipvlan1608 entered promiscuous mode
[ 3309.844404][   T29] audit: type=1804 audit(1596806155.260:3124): pid=19590 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir737268182/syzkaller.QFVM5g/158/cgroup.controllers" dev="sda1" ino=16306 res=1
13:15:55 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000400)={'wg2\x00', <r6=>r5})
sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)={0xfc, 0x0, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1000}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PEERS={0xb4, 0x8, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0xfffffffd, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}}]}, {0x8c, 0x0, 0x0, 0x1, [@WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g='\xd1s(\x99\xf6\x11\xcd\x89\x94\x03M\x7fA=\xc9Wc\x0eT\x93\xc2\x85\xac\xa4\x00e\xcbc\x11\xbeik'}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e23, 0x400, @mcast2, 0x7}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x81}, @WGPEER_A_ALLOWEDIPS={0x2c, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x5}}]}]}]}]}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r6}]}, 0xfc}, 0x1, 0x0, 0x0, 0x2004000}, 0x0)
r7 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="38180000240007050000007f91b8790005080000e141ce2de815d94845ef40bebf6c8c879cbe5b3b", @ANYRES32=r8, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB='$\x00\x00\x00)\x00\'\r\x00'/20, @ANYRES32=r8, @ANYBLOB="00000000ff310ea3b08efd3c86f03221ec1afdffff00000000"], 0x24}}, 0x0)

[ 3309.996227][T19598] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:15:55 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:55 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3310.153773][   T29] audit: type=1800 audit(1596806155.690:3125): pid=19594 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16337 res=0
[ 3310.184201][T19598] device ipvlan1609 entered promiscuous mode
[ 3310.229069][T19614] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3310.332651][T19614] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3310.351065][T19617] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3310.546012][T19619] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
13:15:56 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
recvmmsg(r0, &(0x7f0000001f00)=[{{&(0x7f0000000000)=@caif=@dgm, 0x80, &(0x7f0000001240)=[{&(0x7f0000000080)=""/41, 0x29}, {&(0x7f0000000180)=""/155, 0x9b}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/21, 0x15}], 0x5, &(0x7f00000012c0)=""/179, 0xb3}}, {{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000001580)=[{&(0x7f0000001400)}, {&(0x7f0000001440)=""/22, 0x16}, {&(0x7f0000001480)=""/34, 0x22}, {&(0x7f00000014c0)=""/163, 0xa3}], 0x4, &(0x7f00000015c0)=""/186, 0xba}, 0xfffffffe}, {{&(0x7f0000001680)=@in={0x2, 0x0, @initdev}, 0x80, &(0x7f0000001940)=[{&(0x7f0000001700)=""/44, 0x2c}, {&(0x7f0000001740)=""/26, 0x1a}, {&(0x7f0000001780)=""/64, 0x40}, {&(0x7f00000017c0)=""/92, 0x5c}, {&(0x7f0000001840)=""/59, 0x3b}, {&(0x7f0000001880)=""/143, 0x8f}], 0x6, &(0x7f00000019c0)=""/119, 0x77}, 0x10001}, {{0x0, 0x0, &(0x7f0000001cc0)=[{&(0x7f0000001a40)=""/228, 0xe4}, {&(0x7f0000001b40)=""/255, 0xff}, {&(0x7f0000001c40)=""/26, 0x1a}, {&(0x7f0000001c80)=""/50, 0x32}], 0x4, &(0x7f0000001d00)=""/107, 0x6b}, 0x61}, {{&(0x7f0000001d80)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000001e80)=[{&(0x7f0000001e00)=""/66, 0x42}], 0x1, &(0x7f0000001ec0)=""/58, 0x3a}, 0x4}], 0x5, 0x0, &(0x7f0000002040)={0x0, 0x989680})
socketpair(0x8000000000001e, 0x2, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r4, r3, 0x0, 0x100000002)
setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000002080)="c13c3575c3d311c1119571ea696eed3c395ad1c72533632aa13a3d97d0ec27f711417dbe379124641b174ca8c75d9f0671e1e4c8043758b0752d91f1156739d0d770ed70b48aca7d95e4822fba", 0xfee2)
sendmmsg$alg(r1, &(0x7f0000003240), 0x492492492492619, 0x0)
write$cgroup_int(0xffffffffffffffff, 0x0, 0x0)
close(r2)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000003800)={'bridge_slave_1\x00'})
sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f00000037c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000003780)={&(0x7f0000002100)=ANY=[@ANYBLOB="4c1600000d0a03000000000000000000000000002c160380580000800800034000000000340002802e000100dfcb0b865735903be18b035cb9d5c370b7ebee75cc72f319946d37c8e6daf0247b61926d35dfe2d1cb1d00000c00054000000000000000080c0004400000000000000f08580200800900090073797a31000000000c000540ffffffffffffff22e8000a8073000100c51cd58793e829edae74ef05de1326903e40580fd4441fd2dc7746d1e975c634462d3dab19aaf631f93b04eaa0bcdd9b6a8413096a5a9ccc6f41a6a6536ecd46b99cb45d97ffb48bf3bbe4d6c8823f54b0c8816295182761159590a8cb34ef68b3649bea726cba8ee376cafb1756d4006f0001001cd2a134978cde9084fba9df7d2b0ec67be3960357fe9738d23cd7ff937520096d2938806e7fb23da6c17a72b081577290c17cf2405fae3803ed93455b831616953fbfc802520b459441ccf04a1976cd10e7805ed8747eb66ea8697f91d835f51ab1325bd7b8efee55fc0a0050010a80f7000100686b00710194471b1e0f420dd1430ef9210a1dce96e2cda0ec1f900b34bac616e61172e433edb22370b334483b4707320ff55a1d0e3a88d898dedc4531bd7061217977c9e4af3e2613fd05d08e4810f35a4c5540588d1fe35cd47ec9bfc76b1e3651bec028e68947ee0f12c195c5ca90c045ce0d1054da98578b37a1167e4e49f5e052ee5309338ac1f9e0ae56f8319397ff25160d95fae4e4362ff0e462452cfdc9f9f2e8e518d7fdd6ebaf46c0ac923c2e08be63ce10d4f2df40ff4e9c9c85cc5a04c46080e392652076c81a2d686ef19f4d6a27631ccb7187cb20093c5ee6d43bff500bc1b61db976521b2c84534e8297fb004400028008000180fffffffe0900020073797a300000000008000180fffffffe08000180fffffffd08000180fffffffe08000180fffffffd0900020073797a3100000000100002800900020073797a320000000004000780901100800c00044000000000000057550b00064062752fbbed9344000c000440000000000000079c081101802c0002800900020073797a3200000000080001800000000508000180ffffffff0900020073797a3100000000ab00010087348147dea46bf012a891fc1b3454ddc08191a9034e3ed3fb5f2508eb806b9640ab849a756ffc8b77a202a4825bbe6d5d6e2c50736a0b07a214e32d4451014a6c77c41ccd04d2da04ab90f76486487495a4cf12dd368d596c54a1c83c775836a83088ecc5e33459e91e8483eb8654d4d3940d142a3899f6cc828b24d1c4d470f3985804a55e96e85a246872e5f5201ced37d2abc1899029db916759df8e6eeeda6ad2851d0a68000400010004100100e613cdb98279fd55d319c754284068416b4881cc574610de4c9dc50cfe329ca9904ecb30a115d514b5978b4179718edc1c17503c6c7332b8229883bfb4f71a38672cc40e1f7447773cc4c5c9f17a99d42844c849e1dcc8eeefe699aa358b3773a75adca93c7e5ab98556678994354ea07506d7cd0892c3cb433f3d3e2bbe2634cc898581bd203d6c9265c72acc7db149c5a7fea1ad1d21622c2325a3ef9d75ab4fdec7e58130fddd248e63ab5e812b9eb4f714667d3ece99cec605714a1f8e4860e99bcee4a0a9ca17c0198f1238a1a4e20709789845681f11f02bc998d0747ceb6ac5d55e03878cd76385438b4451549e1c4854b03317ef4e2d1b8ebff99b21ef3e935d83ec13b8ff9ec391af7551c38b12e061bba01d1cdc01c8407bd1c3b62d716f5ffe7e59479b6acc20fe755b471c8b38e6f9051ca95e8f4498bc01dc341a75ef5d42451bdf97ceebccfa7f05f80f06fd0baf9c8f70513bf0fbd5e08695a503f1371cdc35fc48fb73cbb29700662e95ee203b433ad039a9014335a4b179d122671645fa9e753d9010026cb103e345a660be812d2af23c0139338918ce5d343243a9ac2aabe6825f8ecc2a241ebc89f349b7f72ac2f9f858e2406cdf13d4a20335e761dd63d7854e329cb1f6a428becf01284686a34e4c727f87ec8164f1174c13101bad28966463f276351095904af03ca0d90a937ef15dabfad92f136432d5aaa2c004d4e02cc5855236ef8287e6d273ed46a27097a385f29765438366eec3abd72d3e2c41eda1d53934142ac75c8b0758b922e6cb2c918ae90e36470608a51b61c28b6d7588edfe327226d4615224deaeeca7f5370b2de8e77fb5dceb0bdcc08084adf163891990193c3e22f2de27d0487e2dba829a0e0871fe4e4191b5f9c68f361157f068c5eb7ab5c380ce90215fd48a77b2c00dc04fc5fa87e96b0f09b57f33c9a566b602cb2aad23edf7a1fc7b258574199bcd1c09c3586198c617659d863552e3475060e27776bb8089da7ad03d7a24a9a616c38d5d5bd82b70b14451a44783f336b3139c4c049dca299916eec02e3c0f55b98906e113abbbe56e11d5bed1d7e7b70d5409097c05cec85b463b28e08e9ea2a73237cf71c438e27182a1efa1f06c8857bd1404cf06e8656ef73c441c965d3d32196a6e0aa89015322260665b41afbe2fb2d5152d608ae62351f9cb94d97bbba2a47bbe2c0d47c3a0e581619aff5ff5d5cfbf985dd07967feec3e7b20a1c9ce65525a0beafff54f634d87cec7d77556ed662f07e759955d1cede0c09553bab680ac5da77c91f89b437f7fa219a6574a8ef98d4a44ff7ff8720c15651cc239f7a2a7fda00b33b993fa93349801bb71619640e7bc5b58c8c75c0686d9c970221cf151a3171b273451ab42911537189ae63726c5f90f5fbb70171202d2d272752f38ec462664d3fafe5cddbf9bebda2391b448563106326845d9b8c8cce893d0df10f09576e98fda70cb912e9c06446524f1d9cfe9c616edf7b158a9e8de313eb8fad644018634f800b2820757f1452cc1a1258fa07e9f38da056fc23a70efc0a01bdaacae4541c4bdbbcef4bad068baa78128f6b1aeae952e9613d3c7040b96037ac86624dce037672aaac36bba4ce3b66f3b8b8e2014c752db6ba641f1aea3a1e877503d3d2f5f9e02384fa24b02c843a37edfd0ce50f34abf212e6b490fdd637877e10cff20eb8ad5328c99120e26c31132c039df2d2597bacbdcb2c5bc3e0b709fb2e50a9cea7dc02295bdeb21608be2dccc58da9cf6c5730b171c8dead9a8a687ebbf80f8cacb7acc92359c78d92b310317f34952ca9cfbd70345100475f0aebe0bae939ef980aa773efe1ecbdb2140f2670b316919b5ea9ccea8c1afea7ce77e372bc1f1869e3b02fcf16bd168f2cb9723499e505e9217a1423694019ae54ba707a34c3a84a7ecdb2d941158a6cdf525e428b313092003f6f6d5496f0b61dab8f86776e79107b0386b61b77093edc08fcd362bc446a65e67eee002188a16d0daa99536b02af9743bd20182a16cd354bd8d7d9dc81583effc03e37cc6be6be71e3d0bde161493304083c96aa904b332370f3edd7888e97613aead3bdbdd8b166b3eab39d47d89e44299a48a3a132b729fa69a3fa0f9066ba1e22b10a5d7e0373f8448ead3373944f2ad31c2e43468a134d130bf00f13cd88f31aef8d66f7bd22fa4232702e5c5302f70040181660c31957b66075b6555863150086e41e8cc73e30a823365bbc4f77cb106c05b9522a2ac77468a7d619db13ed5cf63e100a0df12bd881c994fba6fd63d2e10b8934f2da1d90dd5b47f5e5fb5a71527e238b7be8a9bcdb78d83d5b13193fc19ae93fc3aa9a1be7d63de42605a204992f6288ec40590536b24c5f92866bee0262fd92b3b5f7a28356f8b3069377643f1424188ad006cd2bf6285d051e3b6d44c376e3f94ddd0ebba7444aaa7030887d401ac7f7c995ceb1e15dfb3933a7f68f91f924dc6a1f95ec0012758f48b838b522edcfba3c2dde4c99f3efc3eba442e2dd9e87b5f16105399de1df65b735ef640a047addf8240d051aa8ac66f652843bd1f9980ae936983514d99a0900ce235c13f8dd6abe47b8503f1d926781cee3b29cfcccaa93f3ce41f2a2b2ecf0e983ef099033ca98e6cf83e5548dc6a437471473c0d32a3f60606dae6364b92721c4d3286a9410e394f6cabcf352ad59eb3c6e1020478a92596cc37d0436e7180d954ab042b7a7a72d563af04021a455d4b8c1afae8f426e74e2ea4c9b6dc9b6a9c53e1c11524d34202c662ba16780b96cb889b981037ad92281fe6c88389c748b8ff43589849f88c4546d34b7cf4e31264c0f768ee6d0f49cf88b064bb3d1a821b8280833662277037300feafb9c94c68d052cbf0130b831407aacde222df9429ec0f4eb45d0999c22ef69ad714e37de3cc99f45547ae5efc01e49d99301da1d12641f9babb0ecec3fa258ced67ee229b16d70d46bff76527eba25fdf745c75a47ff217c3f5a232502a5707abf2bf92f92206b9bf26d47b6b8df61471a2d09bfab667b02771dcf9892dad789a056c81125bb5b25a62208c9cf775cb3a8ca32f3953aea22879aaf4126ce27f2b85fe011a1b3581b2caf6d1b9bc706e36f6ac8f38425b3d899ad0b741142c5ac50d87be218762db2acf36bd34fcec24960e0ad699e34ba5a44d1aed754d3f3994ac2a9b18edd4f035bf7b620f7b3729f9c3bac755ee3a4d86241b15aae71c1a1986ca09b1a64d40b0a7e486e47af312403ffdd32af7311b017eaf7632bd9ad6988dd64ad5819523f6610ca4bc5d01341dadf33288d273b5a860c83b1e87251e64bffa47f27ca0a65b5039b4dd00ec25337485963f936ff0b8974d8ca7c0e1b1b812105d54dbfe3807380fb6ad2e228b14b10d583f6018694dfb08ce1376673cacb6b7aa3603b735d38385d5c6f3ebf520fa447a2379dd84a61d0f1d49478b79998c8f45d21654983617834b27dcf5d93ebf6b429ed0cf7cc8d73ec7a4d3ebe0cea4a51fe3f1697cf25cb33b4b61f7c1519fca7b00ced15e1798df66f4bf9f4591598b1f0d80fb594aef0d6d951cf45c8fdfac7accbd43a9a8f76f29f141d9bc0ce40046352f94e402c4402c67e81b4c468fb26b71325fa9f93a51658a5f5425944eac860bb76bbc9af5b4290ad2365f2af5b28e0a23b2bb7ff5e79b9b9d419e3ca8b44ef66a7a956dc068fb9130fe288165aea9f1bbb91976be1c39d7e893f03cde4267c91f3799dcc7d601d9a16ab3d0aeacf7724849d1f4912c64fe4b8d1e9d094ea6985d11f98f9fe4b37912352b26d233a5022426524cba80dc85be5913e0d34a13fe8fff81f4943d2a0d99ea63fc0511f58cd43e289de859d3658ee4a1cbfe426474a59a7e939d52aa45aaf86d93af40afc64ba180fedf464c58f8da91d6be20dcd6c6813bc038157c5e6a7ad9d23488b472bc3323c2f5d31fca878c2fe27de0b695f24ef664afd918d661b010b2b9634898805d1e7ed37b81309442e059ce3dd3e2e41d8a793ff796527673ea239f253669576d0009b5e329764a0bcb0b5590db7bdf13e87aeb67e716c2b73b51e7601a2d20a800b988d603e2bd5b07af5b6f60504efc69c15b3500b4cafae4303ab16d5efa2a39088c4e18bf7487f341a6f97279076c40430135e8b1ff8f9acc803bd7790c02ba5a47cb033a9e3099eb211a3611b2ca81a2867f6ded71e39c88667989b76e70b8194220d4eaff4ba2761c6276c18b0c35609d9ef701980a0962d95681d48d0ee8799c6b7620ace795145b4976a38d81751484a51d3044fdfb8c1b384456b45b2758df555eb3d9e40456618a5adac744694b56310afcc050cadf5dc07f97556f07cda3677dfcc2527eb557c95739f20d5f7b321eb6f33855947014494ea2c43225134896ec45e1cc1543aebe32c764a0a7ef172388466aa68baaa7c05d98bf88ccefea155928e08eb42f623d9539b214bac4f9b53dfc0e09919761c6e092bff8f5a412b0bf5008f09f22dcb0bd14cab6c53eccb558eae5c3b2f8f434f3a62bc2dc462aacc175f38dbc4370df2241f391707ab3436c3428c6c20f99cb1be1dadc313fceb047567172107acade3298eef85d8fff53fa8645a31c411303d4bf1b5cf0c68d028d428ea69702b17feedee6769e885e4fe48855d80e6757f05b9ad9efce3fa55136c456364fcb85f962f8ae4dd0196857172f08ffe2419539a689e1721cb921c2352531d402a5105dad28e53ff61df5f79fa2db82fc2ec17e77bfcdca3c5290f1101523f0025d28b4f556c0bb9e49cc6320fefa8873adc236ee0fc28a89098b6e565fd7a5fd7cb902fbbae8f1317d92aac62596d0939e308af5c24efe536fc535b9c4a03a62359ba91325d3f3143e58132a0471cac07b11e62ba2e6b0df1899dfa0d2ca143dc7ae01b3943d3eef93a38afc52f9f45af950c726199f30761d7efa1b5aee449d8c64cf65125155b24b2c283d3cb31800e9de18037f1e48f4c34a957cdc1b5ba0020c75b47cd22963274e98f8fae1a0d0d643518a82c8ffb32f818e120e555b9254af033ebcbf25d135485fd685451e5f81ec6ad4523440b3ec7bef18923b4e507fe09c3b3e93eae4e60fb396c2242a4d9f10867e5a008a4441677cab1d24509770d3debebcadc946478ae557c4604b58d1b28768cf3ad511ffd4273df84363c3c9eedd23be509d69e6d9faf5bbceef7390d436ffbe1d67b69936e9e4c832f64bc5acf77e2e27e36e77a913e87df6d55daadc87ff04e1e946c2ec8aea9eb529b9d79e9a2c9659725b76e8f768506b970427dcf73a9422e16e51d148c4be77b4c944be8ec3342320c7d7d45f9ccb43e3e8b04d242f7e02e0889f0bd94cf7f38846cd9f26f2f942c141e9084e4ba8aef7a1caaeddfbb80a8e6ce3f670dafc9c621b8419af95a3498b0f4cfaad6ffcea969b5104e669b03ecfa0ac037af8c58da29e5ed5e6f12a055091d6f0409e23ff3c14ed726ddec9e52aed9665fe828d48b2a2abeef51ec4220ef19c41b317750cf2803cd20eaa48057c981c76b1b9ae0ab006decb1570171d1aee8a56fb4636e825b558f3956715306d469ba90f10378fd18483ee815fe4fe0375bc90d68cb04b3f151d3424b74bf864460f68c9290c7df932866fc1eecfb0803313260d89e51738c78c1e8c99ff10d28bd6d53f5730065903bd2ac8b21395646ef10c977e6b8f0b4309dfa451122276909d1d8e144d05b6198459505a0371271ed0b235ddbec2b2400028008000180fffffffe0900020073797a30000000000900020073797a320000000004000780080003400000000150000a804c0002800900020073797a320000000008000180fffffffe08000180fffffffe0900020073797a30000000000900020073797a310000000008000180fffffffe0900020073797a300000000004000780d0010080c0010a800c00028008000180fffffffd580002800900020073797a310000000008000180000000000900020073797a31000000000900020073797a320000000008000180fffffffd08000180fffffffb0900020073797a32000000000900020073797a3200000000020101008ebf2d155053eabc0f4b09d9957c6dae50dc8811994d280173a5405cd58eaf2a669424afa8c8ab955d1daeb161f79f9d7e42a86df7b4c0d95dae15fa151dac0f0015dd2890590ee49a0f60c1b125350e60c58554bfcc7ea0b6b9cc492e88c9b91f2d041236c1588c2d321097cacc1049c3706f6951a555bf36943a13b89ba3c19fb2e83ec55bb878cddd3d14c422a2860245ff80b9b8e8016961138ab34246c1b9369e298d0c4e31c1ac815cba12169dcff5efef53f603c489d0a5b85d649adb2a5931cb162c32239108a50ac037bf05c15a9c0fa391e92c56b6512c4a16ab917ca4ad97d04e9b7e7aaf7938cad9a261803c408b925edbbb944d1cd29f700000540002800900020073797a32000000000900020073797a3000000000080001800000000008000180fffffffe08000180fffffffc08000180fffffffb0900020073797a31000000000900020073797a31000000000900090073797a310000000018000080040007800900090073797a3000000000040007800900020073797a3200000000"], 0x164c}, 0x1, 0x0, 0x0, 0x40}, 0x4801)

13:15:56 executing program 0:
syz_emit_ethernet(0xfffffffffffffdef, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:56 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:56 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2c0}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:56 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3310.673320][T19614] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3310.713256][T19614] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
13:15:56 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x500, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3310.832652][T19640] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
13:15:56 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:56 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3310.929689][T19640] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
13:15:56 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x802, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3311.575815][   T29] audit: type=1800 audit(1596806157.270:3126): pid=19641 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15987 res=0
[ 3311.692582][   T29] audit: type=1804 audit(1596806157.390:3127): pid=19641 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1564/cgroup.controllers" dev="sda1" ino=15987 res=1
[ 3312.211467][T19617] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3312.261650][T19619] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3312.307029][T19643] device ipvlan1610 entered promiscuous mode
13:15:58 executing program 4:
r0 = socket$inet6(0xa, 0x803, 0x2)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
setsockopt$X25_QBITINCL(r1, 0x106, 0x1, &(0x7f0000000040)=0x1, 0x4)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000540)={{{@in=@private, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0x80000000000001}, {{@in6=@empty, 0x0, 0x6c}, 0x2, @in6=@empty, 0x0, 0x4, 0x0, 0x2}}, 0xe8)
sendmmsg(r0, &(0x7f0000008440)=[{{0x0, 0x1aa, 0x0}}], 0x400000000000107, 0x0)

13:15:58 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x803, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 3:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00')
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r4, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r4, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r5, 0x0)
ioctl$TUNSETSTEERINGEBPF(r4, 0x800454e0, &(0x7f0000000180)=r5)
r6 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r6, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYRESOCT=r0], 0x3}}, 0x0)
sendfile(r2, r1, 0x0, 0x100000001)

[ 3312.387391][T19658] device ipvlan1611 entered promiscuous mode
13:15:58 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x805, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2c1}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:15:58 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 3:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='memory.events\x00', 0x26e1, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
splice(r0, 0x0, r2, 0x0, 0x100000800ffe0, 0x0)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfffffc8f)

13:15:58 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x806, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3312.876340][T19692] device ipvlan1612 entered promiscuous mode
[ 3312.949311][   T29] audit: type=1800 audit(1596806158.651:3128): pid=19692 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16376 res=0
13:15:58 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x870, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r1, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00')
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x52}, 0x1, 0x0, 0x0, 0x814}, 0x0)
getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000580)={{{@in6=@ipv4={[], [], @dev}, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in6=@mcast2}}, &(0x7f0000000480)=0xe8)
r6 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000a80)=@newtaction={0x104, 0x30, 0x53b, 0x0, 0x0, {}, [{0xf0, 0x1, [@m_skbmod={0xec, 0x1b, 0x0, 0x0, {{0xb, 0x1, 'skbmod\x00'}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_DMAC={0xa, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @multicast}, @TCA_SKBMOD_SMAC={0xa}]}, {0xb4, 0x6, "cf0a58e0aad87173849f5e74d134cc2978f19d6bf9c8c04a42d9a7f6566051e0483fe0844ddd43172a626f520b3b5bced0589736668e45cd3967f6475a6f2ae95df3cfb8349c23511da0f862fd711af4380c937507ae5bda3111616a514a645568f94e31062c103d6fc32df2d8768e55427454e253b65c718de2cb2b2b56f59a7d858fda9a8499730cb6c5f3e76a357d2ad15780cedeaa046177f9d29320fbc5a2ed9c54cfe31acb3eb77819ecc6f71e"}}}]}]}, 0x104}}, 0x48001)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00')
sendmsg$NL80211_CMD_REQ_SET_REG(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, r8, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000003c0)={&(0x7f0000000400), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x84, r8, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@NL80211_ATTR_MESH_CONFIG={0x2c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_CONFIRM_TIMEOUT={0x6, 0x2, 0x45}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5}, @NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT={0x8, 0xb, 0x60b}, @NL80211_MESHCONF_HWMP_ROOT_INTERVAL={0x6, 0x18, 0x7}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6, 0x12, 0x20}]}, @NL80211_ATTR_WIPHY={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x3}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r5}, @NL80211_ATTR_MESH_CONFIG={0x24, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_POWER_MODE={0x8, 0x1a, 0x2}, @NL80211_MESHCONF_HWMP_RANN_INTERVAL={0x6, 0x10, 0x9}, @NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0x8b}, @NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x13}]}]}, 0x84}, 0x1, 0x0, 0x0, 0xc041}, 0x20040001)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8}]}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0)

[ 3313.078123][   T29] audit: type=1804 audit(1596806158.771:3129): pid=19692 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1565/cgroup.controllers" dev="sda1" ino=16376 res=1
13:15:58 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:15:58 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x4305, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3324.235785][T19706] validate_nla: 3 callbacks suppressed
[ 3324.235793][T19706] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3324.434989][T19706] device ipvlan1613 entered promiscuous mode
[ 3324.465123][T19714] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
13:16:10 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2c2}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:16:10 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:10 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x8035, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:10 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:10 executing program 3:
r0 = socket$inet6(0xa, 0x80002, 0x88)
bind$inet6(r0, &(0x7f0000000080)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x4}, 0x1c)
recvmmsg(r0, &(0x7f0000002d00)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)=""/2, 0x2}, {&(0x7f00000000c0)=""/151, 0x43}], 0x2}}], 0x1, 0x0, 0x0)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
syz_emit_ethernet(0x83, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r0, @ANYRES16=r0, @ANYRESDEC, @ANYRESHEX, @ANYBLOB="1419cfa3d94452c03719ab5e2d59ff59f4441ee7bc028eeca7f8e6b5f4c5a566bd7606716cf0f97cbbe5fb38285e358f6e0eed401b55b8864d38d96437fc588b5f1355aba9f437d95b0baff1713c2504f3b4386232f903ed6be8920583559e60a577122fef35fdb1b43c9728ef653dfc2b4ae1e9585d3852457d905371676da861211b0b09fc34951cfed7420480a7b1edaf709c01459d3bd998e720af535600e561", @ANYRES16=r1, @ANYRESDEC=r1, @ANYBLOB="713cbcab5b66", @ANYRESOCT], 0x0)
shutdown(r0, 0x0)

13:16:10 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x8100, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:10 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3324.696611][T19747] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3324.707689][T19748] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3324.726109][T19748] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
13:16:10 executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000008fc0)='IPVS\x00')
sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x2c, r3, 0x0, 0x0, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffff8}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x76}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0xac, r3, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1039}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3b4}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e22}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xb928}]}, @IPVS_CMD_ATTR_DAEMON={0x6c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x72}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xb4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xff}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4084}, 0x10)
sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000510000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e30000000000200000000000003f00000000006a6d9900002bb19d7e1f24d209d461d9c4705841df18bec6a60ac5ad347f39c64ed8722629436e71a0a7db5778b40f5ab2723dbcbeb4a70d014c32ebf525eb6d29ffcdaaa0df0304e60605169a0ee4463fe85f293b448c97089321457362d243efbc45a0b468d31fab8c65ae9189e416ecebd4becbd5abef460b3805114073ee2d14ef97f57432217dfc000000"], 0xb8}, 0x1, 0xfffff000}, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r5, r4, 0x0, 0x100000002)
setsockopt$inet_group_source_req(r4, 0x0, 0x29, &(0x7f0000000540)={0xffffffff, {{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x14}}}, {{0x2, 0x4e23, @empty}}}, 0x108)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r6, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r6, 0x0)
getsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000240)=0x5311, &(0x7f0000000280)=0x2)
sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000180)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x1, [0x0, 0x3f000000]}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x3f000000}}}, 0xb8}, 0x1, 0xfffff000}, 0x0)
sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, 0x0, 0x2, 0x201, 0x0, 0x0, {0x7, 0x0, 0x8}, [@CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x3ff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040075}, 0x20000004)

[ 3324.766081][T19747] device ipvlan1614 entered promiscuous mode
13:16:10 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3324.886882][T19748] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
13:16:10 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x8847, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3324.965818][   T29] audit: type=1800 audit(1596806170.622:3130): pid=19750 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16378 res=0
[ 3324.974787][T19762] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3324.991651][T19748] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
13:16:10 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:10 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3325.014693][   T29] audit: type=1804 audit(1596806170.712:3131): pid=19747 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1566/cgroup.controllers" dev="sda1" ino=16378 res=1
[ 3325.168326][T19762] device ipvlan1615 entered promiscuous mode
[ 3325.253055][   T29] audit: type=1804 audit(1596806170.712:3132): pid=19757 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir737268182/syzkaller.QFVM5g/162/cgroup.controllers" dev="sda1" ino=16383 res=1
13:16:11 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2c3}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:16:11 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x8848, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:11 executing program 3:
r0 = socket$inet(0x10, 0x2, 0x0)
sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000140)="240000002e0007031dfffd946fa283002020020009000000001d85680c1ba3a20400ff6e280000005e00ff39e38e0d0857aa99b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15ab", 0x4c}], 0x1}, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x100000002)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r3, r2, 0x0, 0x100000002)
r4 = openat$cgroup_ro(r2, &(0x7f0000000080)='memory.events\x00', 0x0, 0x0)
ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000100)=r4)
socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f00000004c0)={0x0, {0x2, 0x4e24, @broadcast}, {0x2, 0x4e20, @rand_addr=0xcd}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x58, 0x0, 0x0, 0x0, 0x80, &(0x7f00000003c0)='veth0_vlan\x00', 0x30, 0xd95, 0x4})
r5 = socket(0x10, 0x803, 0x0)
r6 = socket(0x10, 0x80002, 0x0)
r7 = socket$nl_crypto(0x10, 0x3, 0x15)
setsockopt$netlink_NETLINK_PKTINFO(r7, 0x10e, 0x3, &(0x7f0000000000)=0x3, 0x4)
ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071")
setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r6, 0x114, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x2)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000240)={0x6, 'macsec0\x00', {0x8}, 0xfff})
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newlink={0x94, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x6c, 0x12, 0x0, 0x1, @ipip6={{0xb, 0x1, 'ip6tnl\x00'}, {0x5c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_SPORT={0x6, 0x11, 0x4e24}, @IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0x7}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @dev}, @IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e23}, @IFLA_IPTUN_FWMARK={0x8, 0x14, 0x400}, @IFLA_IPTUN_PROTO={0x5, 0x9, 0x4}, @IFLA_IPTUN_FLAGS={0x8, 0x8, 0x38}, @IFLA_IPTUN_REMOTE={0x14, 0x3, @ipv4={[], [], @multicast2}}]}}}, @IFLA_MASTER={0x8}]}, 0x94}}, 0x4000)

13:16:11 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x2, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:11 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3325.380653][   T29] audit: type=1804 audit(1596806170.982:3133): pid=19767 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir737268182/syzkaller.QFVM5g/162/cgroup.controllers" dev="sda1" ino=16383 res=1
13:16:11 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3325.534153][T19789] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3325.647776][T19789] device ipvlan1616 entered promiscuous mode
13:16:11 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x8864, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3325.701522][   T29] audit: type=1800 audit(1596806171.392:3134): pid=19789 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15733 res=0
[ 3325.701727][T19792] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:16:11 executing program 4:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x2bf, 0x0, 0x32}, 0x9c)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000100)={0x20}, 0x1)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0x13648, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r0, &(0x7f00000000c0)="03", 0x7a0, 0x0, 0x0, 0x0)

13:16:11 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0xf)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f00000005c0)=ANY=[], 0x208e24b)
r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00')
sendmsg$TIPC_NL_SOCK_GET(r3, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x44, r6, 0x10, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x30, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x4004)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r5, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00')
sendmsg$TIPC_CMD_GET_MAX_PORTS(r7, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r8, 0x200, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000010}, 0x4)
sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000080}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)={0x1c, r8, 0x300, 0x70bd28, 0x25dfdbfc, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000000}, 0x804)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c00000024001d0f00"/20, @ANYRES32=r4, @ANYBLOB="00000000f1ffffff000000000b00010064736d61726b00000c0002000e00010010000000"], 0x3c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@delchain={0x24, 0x66, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff2, 0xffff}}}, 0x24}}, 0x0)

13:16:11 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x3, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:11 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:11 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x8906, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3325.868165][   T29] audit: type=1804 audit(1596806171.562:3135): pid=19789 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1567/cgroup.controllers" dev="sda1" ino=15733 res=1
[ 3325.962500][T19792] device ipvlan1617 entered promiscuous mode
13:16:11 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2c4}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:16:11 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:11 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x4, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:11 executing program 4:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-generic\x00'}, 0x58)
r1 = accept$alg(r0, 0x0, 0x0)
sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x80}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000007b00)}}], 0x2, 0x0)

13:16:11 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x4, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3326.193638][T19821] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:16:11 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x5, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x2, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3326.306691][T19821] device ipvlan1618 entered promiscuous mode
[ 3326.441108][   T29] audit: type=1800 audit(1596806172.132:3136): pid=19825 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16368 res=0
[ 3326.480124][T19825] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:16:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3326.571850][T19825] device ipvlan1619 entered promiscuous mode
13:16:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x6, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x3, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 4:
pipe(&(0x7f00000000c0))
r0 = socket$inet_udp(0x2, 0x2, 0x0)
close(r0)
unshare(0x40000000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
sendmsg(0xffffffffffffffff, 0x0, 0x0)
socket$inet6(0xa, 0x80002, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='yeah\x00', 0x5)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='yeah\x00', 0x5)
getsockopt$inet6_tcp_buf(r2, 0x6, 0x1a, 0x0, &(0x7f0000000340))
setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f00000001c0)={{0xa, 0x4e20, 0xc1, @rand_addr=' \x01\x00', 0x1}, {0xa, 0x4e20, 0x7, @rand_addr=' \x01\x00', 0xfa7}, 0x8, [0x10000, 0x9, 0x2, 0x5, 0x59, 0x2, 0x10000, 0x1]}, 0x5c)
getsockopt$inet6_tcp_buf(r1, 0x6, 0x1a, 0x0, &(0x7f0000000340))
r3 = socket(0x11, 0x800000003, 0x0)
bind(r3, &(0x7f0000000280)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c58110308d9123127ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r3, &(0x7f0000000000)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'ipvlan0\x00', r4})
socket$inet6(0xa, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)

13:16:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2c5}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:16:12 executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
sendmsg$ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000480)={0xfc, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6tnl0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x4c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0x8}}, [@filter_kind_options=@f_flower={{0xb, 0x1, 'flower\x00'}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x14, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5}]}]}]}}]}, 0x4c}}, 0x0)
r6 = socket(0x1000000010, 0x80002, 0x0)
sendmmsg$alg(r6, &(0x7f0000000200), 0x4924924924926d3, 0x0)

13:16:12 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x7, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x2, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3326.826059][T19850] IPVS: ftp: loaded support on port[0] = 21
13:16:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0xb, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x2, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x3, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x3, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:12 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0xf, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3327.874774][   T29] audit: type=1800 audit(1596806173.562:3137): pid=19871 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16376 res=0
[ 3328.115595][   T29] audit: type=1804 audit(1596806173.802:3138): pid=19871 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1569/cgroup.controllers" dev="sda1" ino=16376 res=1
[ 3328.311244][T19855] IPVS: ftp: loaded support on port[0] = 21
[ 3328.396990][T19859] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3328.427317][T19862] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3328.483782][T19867] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3328.516236][T19867] device ipvlan1620 entered promiscuous mode
[ 3328.595712][T19873] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3328.605135][T19868] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3328.648956][T19890] device ipvlan1621 entered promiscuous mode
[ 3328.745210][T19850] lo speed is unknown, defaulting to 1000
13:16:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x5c, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:18 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x4, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:18 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:18 executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
ioctl$sock_bt_hci(r1, 0x400448e7, &(0x7f00000000c0)="479479e57d59d3c96e532c0340b3")
getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000000000000000001000000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="380000002400070500007b2c1d59242ebabd9b44", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@newtfilter={0x38, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0x8}}, [@filter_kind_options=@f_rsvp6={{0xa, 0x1, 'rsvp6\x00'}, {0x8, 0x2, [@TCA_RSVP_POLICE={0x4}]}}]}, 0x38}}, 0x0)
r3 = socket(0x1000000010, 0x80002, 0x0)
sendmmsg$alg(r3, &(0x7f0000000200), 0x4924924924926d3, 0x0)

13:16:18 executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x420000015001})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @loopback}})
write$tun(r0, &(0x7f0000000680)={@void, @val, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "a5c268", 0x10ba, 0x3a, 0xff, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, [], @loopback, @dev={0xfe, 0x80, [], 0x14}, [{0x1f, 0x200, "4990849c455033127af06926585005bb0e9b2222aab03c3aae6b1488695a2278017f48cdfdd4419f584db9bba24dd176b082e4063cdbb04ec846fbb6da2c2af450a731368dd17008b46e9b1b3d69b17a53a4e59743a38d262f4c55a54cf1cb1070c2b66b5df0a0fed1f98901aca1a860b6b25e08b351f003704c6b61d00495bff4097254304c7e3d901dcb005730b671d87457f97d2e88f0e540456d8feac9ff9d809cad523d91ef2e8b05c51ea99a1163d13fe2bdb4954cc6407d72445fc258b29ce2187a635bda40ed2c24890d5539af3a672ea85b5bea523b562981cbe978da578cdf60ee9eef540577dd77c99238dace720cd078000c68e72d77237acb99b0b0a13ac6683704e6e56ccc3824c8184ced1497a61bba1309abd05efeb329210dd9d214edaa923513a949591b1a2a8b4ecbe82194b851e0661cc89757729e214a4327e60653bd39255d1a385b72355d6d356c5b16e9a4f8f7b6d1ab139ef8e9e6ab8bd8a88b85c0a5bf9580e6be92ee81f11320a65885d7e44a336b41929ceff4f4883641efd4b00dd31ddb1079b145d0c386a009596ca6cf17802b22d9bcb74cc98f49e3f3d16ad075089dde71a7ed431ec53a2f46da75f725f2219f8d7c8eefb9bb2137f333888afe81c99f5eb79b151cfb817d47e9f06eacca5ea7aa78fbc7bb14cbb2ad521dfad5f839111057054b04d8444ab0b2a550da3ea3053def4e6fee9c4892923a91cb809c8d79b81b357e10edc5fa471c4554c5ae1d3830820d4831a8e1c3ea16d3860a09dd778fe0473bcf2525ff12c75ae91deb84c2f018c392c755e0c036c233a37106e1cf59b25ab1fe56abc842bb257b7940ec10a67e7feef2d2b1ab4afc1ee861dd29fb1859068509cd3589e4c5342cba47feda0836936dc9be11f5e7f7dd259d05d5b813094d72d9fbc412f13d9df6098af7083a6e01ed01f91372796121156a32bd95d3530f5b3161d2ec711a01b6251b558eaa8217aff989222ad045ab6f81269fc348ed32404dc16e7228f7a4d5f55f51ce341eaca587712ccefb847a0d3aad228f5e1c51701eb591fa3a9e375d40438724db0ff586e8b22a82dba0e13156a05c4da04f531fafd059fc28de00d148f3e1ed3c11cdd16128672955225d3280e9382a8e693148b05f513d1ed5680edd348ba96108ba9fc8af86139e011b6060fb624e5529f39104d42658c0432a1ad1e92a5b9af2620b53391d14ff46a20be7457910d8bfcb6c028a78cd665d05cab9c0dbdc253a66e0581dbbe01b1ad8dd751463190493845f56ea53ca46c75ef9ed355d485734539199bf0118d02b63fa1141e6693d98dc37595d10fd167159d7e616455b8ebd39bae60a095e7232c0c04ba5011320980309c31a2f7aafa729f5a2ec67315f38e227c983025d46d80577f2d170cb7f7aee6f2b287a863aa253918e66cffb4b15681aff679885cca56ead66dd22f9cbc852134b22e1715c519706247740eaca2e3e0cdad0074d30b068ff5212923fa4d726eacde2a6ae1245910afcdf91e2a38931ed5c7c11fe8f3bcf3e0617469c016654bf770df936c64351f69e0401a03da399e12e4c66b893520eabb75e62e377cf7173f819336531449a67b9057ea992e607fc15e44e63e339e310d497386abd6d7635057d1dcda77503f6c9fad65331c8254cb436aa8a8c796bcf00ce05b6fab1e652e8448843d3f5a6dc3bfd518ce8bc86ce090b095af93559bbb410125eb5954242881c93ee23a65e7a074a800a49b406ccc8d40f17728dccc7fb78a57b3badaabc228e96f49be4cf0e01ead9aa3a8167ef683e9af3e85cb7bec34cfba34f5b719a7cd254099fcd5b94c8bb6ccc7be3774c9d6e4db1b607c1192cc33a88d8fc6f8bcd49423044d4855e5ea4e1c65d507cae5bfab0a1338d53ccb81f6ef0fef4fa50a2ee764c9dc7990f818e3b21abf6ed3c71a28fd5d6a775a796fb51a1ef90c248b187488e969323579e984b9ef445a1d29b604289888e771b50f1300c13c42fb85c66216d384c47c04460409973770c3ee58c91bbcec3d563f12c482c7d245a2a20db8f6bcdb7943cb82b2aa0a95dbd3a8c0659878a75008e22b40d294bb329895982d870b7ff00127b90ed37981b759a6044fdae08fc84d38f6a64859ece135cb61b9e55dfd087bafd58c0fcb08f3e437b24a6661ffedfe050e754164216b9c14d783bb16441339ed509a88a60891658a48531c63b5f8da739cacf8c647eec3b66cce9fc59e0fd630694f49ac0bb24380fd0a789084a4b782fcf7061414bc0a8d6d580eb44871ee132871aba05660ffab83a7442f10b74ffeda38706e9fe0a395f5313eb276ead991ed6e51bd02e9c9d18b9d5793fff92766930d7f0761b2f6fb5410f55ce199974fae2d3d39644b18b346d65b1a9088a4ed78bfc4100c737844cdec357ff20b97367f2cc85cf16058876879322bddc624b9a1b0ea16f1ad0b553bf6b8acc24ddb993a05da01053b03e6da7e5bcaa9b0fd5aab3faaaa40e517b187e11a4230bf24ece66be954ec41ac89361a52bcf4aa08888020fbaae97e126880468795bc6db1adda1733cd3c8e5c3cd57d235e7befce7aee7675d1fa2cc9e753773546d9ada94f2bad418416a4bb40f75e35b8a26a8f8dbab0f30476a7747c6a5c4426dd8594d620979aae2a83b28e671c96847fc46e22e2e2a6a1677008bcc0c4413104c9f3dbb597003e9614aa7a7ac05caf2e887da5c595ebe183fb96ae65bea1a4dc45df11b4af73540f3c98b6966e342e222e5519369d2d1c89095537aabba027842180bdd13aca838ed03a926dbb49afe74c84f6eb994bc15925eb710bf162ab6e13301e3e6ba03e611ec6c159649f419443f2dabc3ac70643f0b0ca48f141e08f25c5435ea4d6e21b14d3607a939e067f96fe47a16923cbaa9ee3aa322cd73e2638658b3b2a2b8186cd16d2ce18cf2ef5c55fdceebcbbff0fc513f45a6c78a35e8d178779b1f0079943c2de272e67c51f16e69ff564073e655c702d0aecbc22b11e0a6519ba8c0bf86adf36b6c0be4414cb8a934b71fbcc19c6a89a122222ea97b9b1bebd6b88bf32cd0a510fed280739df4d9078ae6d481d69cb17390a95eabf04c8e6f51f41f793c78c83a8de5f264993d8dc08bab3880019ba061e95128c9000418d8ad24d838d78a4d8deeeeac0eec4205af641995a6432763fc3ac7db09ac0ee62654d465eab22f7771e638552949579c32bbd6301e1680a2ae24ec180db2b83a107e9743b515cb3f7a0a40be26934034df322c4d3559359915cb003801206dd7d6479c6152c03264c137458a4f45af2174c15412d2e821252d986c5817cc16e89d2c8bdb12a03abfe72b62712644bd7b2b7245c40eca0f55abf4170a8843403cd0beeb8f37001d5a6376da9a0dcb9969a960565757a0ad35f7d4e667aa1c67964aa8f4f385a75f37e074580aeca66349025333d82dbfcb46dc84533f1a4e32e694dca2283fcc8aac2757ec338553e828397f813c89f1843f6effd052cbbde7a0963a368ee1bc2982112a5199240fe2324603183a503963575ad202fef9ad2afd5f1f6703f7f0eacf0f0205b9c491866b408412eca5a41d16d35b00861a873a72e729f01724e8a1e9089167ce3af3034ba4e3505fd44a6945ea340cb8003f9e1d478cda653b39025b75c965ffadc970db906b03b2f3b1784223d761fb6b824693082ec53a24bf5537bb778c859c56fac1ac4a9df01b1dacdf4ffc4a6b638299f36578e167755c0017fee4d57e03f727ba5262faa638263bc17d31e9bdfe93244c1b4c196ec3280eda1783c6d6c3ff1936821667e4f0d6e6a5dea7ff8df2bd1edae52253ad6c6aecaeb8c200a43188b8323cd450897d06ce5b5bf21a174566fa3ac4e23f41c236e4efab79e3119f83661c57b6f6f82b4c45cba53458fb14bf2bce08ff8f0b6620de74562d52769bed87328846f4e9da93a25e60b861b0aa111ff6bc34a48c291d6d57a3b84e65205714fbfe93627118c08902d35ab931cf3e0bdcf9c8bb88375f98f733d9e01aa543444e82612180a8629cff963ca56eabbcb0963065d0ee652328e9295c2d8a44c31f784ede5ee351a562035ba78f9a3854910b40438d5206e65d26e98fba71fea4b6792592c616c1aaf616e3fe1dd69f70cffe02efc34d666a8bfcf8c2bb3802adb5980e705eeb57e54d3c7283dcdea3dae8b7630ef17a852b96ced1411925d2af394a4d2be662777cbf98a2d0cc89e871c488f1276488899b6132d1358d27e3decfa39a1a3a96e16f6cdcc492e08e2d071ab1c44ba97b9f8a842640fd3e45a277092d213cd7bccb3166baf8a96d6cc4cdd31b0e2b6e33b56440c9b64cece604933959753e702d7dad5cdb57740b192307f7aa363422442e42429b2c24f4de40b27152e011020cc19ab6f3c936d7d9c8cf41a46dea6518719332ac029bf669ff3227f01b435275938239fb452ae247117f3607a23ff583ccf28f6a94c376c98e3ca035ee90a3629d6f2b475bf648bab09dc1fe05fff70250c4066bdf48fdcb9f0f4c606a06a1b7fedeadafd45abd27bb4941bdc6d3aa83abac1c09b3ff0979359e9c940200fe0d97320ae5ca1bac7ca76ca29fc32e935bbe7894bd7c774fd081102c17eaebce9caec55dde63baf28bbb082bebefb489fdbff049835f8b69a48e473d9cc72c2f9952863062ce3f8b3103c152ef4f75e94427b8e01f7df94d9ff57d000ff05eb4eb3a84c09bbbd064314cfecdfd3bb47f3364629d08553b85ab9d8a234f602c2d4d90740de7cf8520089e6c8179526f1d692c9f0e0d201cac72c64f01c9ea61d33fac13f29265634ba07a1f28e325bfcf7b9300daddb4948f029f267b349b05b10e4356f462c54ef446089a1999fdaa18dac136665f203b11edfdf4ec445f2780a064ecc39ca785b7a9874fa67cc53bf506da27c8d60b01e502ebdbc28f9c25b7fb280daf77b1429a41cec6a9dcd8905304f3f459f475848cab205ee5c7318a455406b48e77bc9a4eee40500f2f06ae39340739c156a01ff3f53970a03a5b4ea0e0e20d2dbc063c690c7f76fea0aab9a7b5c5e95401a3e7645de03c0ba01a36d761c0e75082ef4a823611b905f13754e73e879cb791d149f747101ba16818754a61a2d03e619b36c9b3b2b73ce89a0aa8cdd8149a4de50ecac280a799a2b62a2ce89a935a07b68d887040996a10f4599589a4ecdca8de51494f33b4789d2296ec4d29efdc3151bfadb20a97d0b169bd49e05085f12187b92d35f879ecf9ab00b6da7477293095f815d9bd3e99592ec440f2339699c6379eefb7dbae3fc1bf17b0888914230d00ee48f68121e265cf92a884eeb778443a270c287e6efb986d7bf2f1731e3cb4ebbd3f3c49e25cebc7298c95180d1f6ec0ba65edfe8cb07935a8663713b4e996b05e47af3f7a2e670d06d14b8dfe16e0bb10b59eaa1b0b01a0a8c63ee7cfce1f1c50640bca83dbcfcfae9296d954a4cdfa3f1a04463dd1f0dd05f09503e47a1a4bc3d5b2503c07901ca2730a52ec539eed04da57faef530315caa4fa530877688d713fcd83d297e918a06e53a17bb3d801042c7eee40a95a6fa945d00e648898794282964d00b2b352a2c950b0c7f8316cd76a4a3d2ee631dd970bda545e6dc0a7a7c2cca179f33f69c869e37a8385494c416bdc29bf0884bb0103ec052629fe29823e6ad6049265808f93448963f1d7a190f1e81cfd567e6a81a0ebdae31a3e932f6d14c29708f9428555b327da7e5df0fdaa3c313526bb1348c9f182dca9c7f37763ed3ca40875b52aaf415edb8b"}, {0x22, 0x11, "020acb8dc502fa593c76c7235552836454f8e491f4adba3340c444a3a8fc846ab04b0c591402984a68cb6167482d5b54556dd89f1639f7cfc53a1b393fb90e23f17662dfbc8356177fa95ada561159cef98ffdbdbc7f69e4a8091a4ff1ce200a8f73b11fef022f3af1fda322843a3e37f332e0af56e8cc6cc5f559e1708a92b2ef69ca299d036c21ef29"}, {0x5, 0x0, "7917"}]}}}}}, 0x10ec)

13:16:18 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2c6}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:16:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x70, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:18 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x5, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:18 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x2, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:18 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0xfc, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3333.284529][T19947] validate_nla: 1 callbacks suppressed
[ 3333.284538][T19947] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:16:19 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x3, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:19 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x6, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:19 executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="2277f292252155b21c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0)
setsockopt$netrom_NETROM_IDLE(r2, 0x103, 0x7, &(0x7f0000000000)=0x9, 0x4)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c000000100017fd00000000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="5045010000000000140012800b000400000400028008000a00", @ANYRES32=r3, @ANYBLOB], 0x3c}}, 0x90)

[ 3333.361064][T19947] device ipvlan1622 entered promiscuous mode
13:16:19 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x300, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3333.405972][   T29] audit: type=1800 audit(1596806179.092:3139): pid=19943 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16378 res=0
13:16:19 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x5, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:19 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x7, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3333.541056][   T29] audit: type=1804 audit(1596806179.192:3140): pid=19943 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1570/cgroup.controllers" dev="sda1" ino=16378 res=1
[ 3334.186207][T19951] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3334.207228][T19951] device ipvlan1623 entered promiscuous mode
[ 3334.224319][T19975] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3334.345746][T19975] device bond5 entered promiscuous mode
[ 3334.364526][T19977] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3334.379999][T19977] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 3334.401775][T20028] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
13:16:22 executing program 4:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x7a05, 0x1700)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000))
setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, 0x0, 0x0)
pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0)
sendfile(r1, r0, 0x0, 0x800000000000c)
ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f00000000c0)={0x8, &(0x7f0000000080)=[{0x7fff, 0x1, 0x2, 0x8}, {0x7, 0x9, 0x1f, 0x3ff}, {0x101, 0x3f, 0x20, 0x9}, {0x18d, 0x1, 0x8, 0x7}, {0x1f, 0x80, 0x20, 0x2}, {0x2, 0x3, 0x16, 0x100}, {0x8001, 0x81, 0x0, 0x200}, {0x800, 0x9, 0x3, 0xfffff921}]})
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

13:16:22 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x500, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:22 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x3f, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:22 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0xb, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:22 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2cc}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:16:22 executing program 3:
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="85000000130000003600000002f7250520280ed5932400"/37], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x1}, 0x10}, 0x78)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000300)={'#! ', './file0', [{0x20, 'TIPCv2\x00'}, {0x20, 'cgroup.controllers\x00'}, {0x20, 'gcm(aes)\x00'}, {0x20, '(%.\\-'}, {0x20, 'gcm(aes)\x00'}, {0x20, '!'}, {0x20, 'gcm(aes)\x00'}], 0xa, "77a853390203fda4b9d712e385768035e9eb2be921260f6066bc298b0c522d6fc12b57f33875189a421bb23bbff8db196c1153252720689a3f96c88d56e803ef83ad8ba56e70ea197438fe337ac96648cb03eb4a7d1b674facb0bdebf125d8389a4a89979c2ee4d99d3247fbfcec57b7ec8f395bc41e51a44bdf1fdaa8b595f8dd1bf743bfeb6e517cbdbacee80cbee404c02be471ac317090e5"}, 0xe7)
write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r1, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00')
sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)={0x54, r3, 0x5, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "2cdae66f91dac475aab512aac5d7e6bcd9f5f438"}}]}]}, 0x54}}, 0x0)
sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x58, r3, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8a2a}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x20}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1ff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x454}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xb6c3}]}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4010}, 0x4008811)
bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10)

[ 3336.903063][T20039] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:16:22 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x13, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:22 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0xf, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3337.053392][T20039] device ipvlan1624 entered promiscuous mode
13:16:22 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x600, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3337.174688][   T29] audit: type=1800 audit(1596806182.863:3141): pid=20045 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16033 res=0
[ 3337.213805][T20057] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:16:22 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x5c, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3337.335722][   T29] audit: type=1804 audit(1596806182.953:3142): pid=20039 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1571/cgroup.controllers" dev="sda1" ino=16033 res=1
13:16:23 executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
socket$alg(0x26, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000001100290a000000000000000007000000", @ANYRESDEC, @ANYRES32], 0x34}}, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468dfb82d2d5be59dbcc29012bc753ae7da197979a720417f5008a69440d16b143a931004317823430a48dfb98860a9347212e374cc044aaa719f1e6acdc64866faf2c81d0ec0940ce629e52848ef29f0250a9e97446abb000df1e92a921af366f972b175f23bf6980413c329966230c4e103f32241bb8fe544c38f733a638694476c"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff0008000a02e84e39004d79c7681e341cbadfb272bd1028764c20da910127595aeae832de1c452a2f67dd66842b06048121e9ffe72955d8e409cb8b7a5e16d65c2a86dae1ff56c287eb1b0012ecb981b45c1f70279215034c3cf84ff90f3bb169a1de8cf3e1599fec1d4d79ae273d317e947cedb824d1b151ab616f8b71b7291971d5517b0e2b7cb92d05ed6b31d2960f233b61accfa3a0181e0716e2c67780614e1a2575dc833bda16fcd10916399dc15a70db9fb6c382ad46348ecc31779189861ec494b04b5de060e0fd5d570409987ee8069c5fe24bb19ecd"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0x0, 0x4}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0xc0050)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', <r5=>r4})
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r7, &(0x7f00000002c0)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYRESDEC=r2, @ANYRES32=r8, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r8, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x10}, {}, {0x3, 0x7}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x492f}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x492d0ddb6f043594}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@mpls_getnetconf={0x3c, 0x52, 0x100, 0x70bd27, 0x25dfdbfe, {}, [@NETCONFA_IFINDEX={0x8}, @NETCONFA_IFINDEX={0x8, 0x1, r2}, @NETCONFA_IFINDEX={0x8, 0x1, r5}, @NETCONFA_IFINDEX={0x8, 0x1, r2}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x8040)

[ 3337.421873][T20057] device ipvlan1625 entered promiscuous mode
13:16:23 executing program 4:
r0 = socket$inet6(0xa, 0x80003, 0xff)
sendmsg$inet6(r0, &(0x7f0000000040)={&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c, &(0x7f0000000340)=[{&(0x7f0000000140)="982b56ad37732c208b680b0aee893cead31a08108acadfbf0700841812d3d0d5d33f7ad4da2902fc", 0x30}], 0x1}, 0xe00)
r1 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
socket$inet6(0xa, 0x5, 0x9)
r2 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
r3 = accept(r2, &(0x7f0000000680)=@ax25={{0x3, @rose}, [@remote, @default, @netrom, @default, @null, @default, @default, @netrom]}, &(0x7f0000000700)=0x80)
getsockopt$llc_int(r3, 0x10c, 0x4, &(0x7f0000000740), &(0x7f0000000780)=0x4)
clock_gettime(0x0, &(0x7f0000000000)={<r4=>0x0, <r5=>0x0})
setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000080)={r4, r5/1000+60000}, 0x10)

13:16:23 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x2, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x700, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x70, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:23 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d2cd}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:16:23 executing program 3:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000202e00000084000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[{0x100, 0x8d, 0x1, 0x2a3}, {0x0, 0x7, 0x7, 0x2}]}, 0x10)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)

[ 3337.893518][T20081] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:16:23 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0xfc, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:23 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x3, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3337.965912][T20082] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
13:16:23 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0xb00, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3338.078949][T20088] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3338.087330][T20082] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3338.134654][T20081] device ipvlan1626 entered promiscuous mode
[ 3338.175714][T20088] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
13:16:23 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x5, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3338.309876][   T29] audit: type=1800 audit(1596806184.003:3143): pid=20083 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15859 res=0
[ 3338.360485][T20082] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3338.377346][T20083] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
13:16:24 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x300, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3338.411817][T20082] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 3338.422775][T20093] netlink: 'syz-executor.4': attribute type 1 has an invalid length.
[ 3338.449904][T20093] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.4'.
13:16:24 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0xf00, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3338.560363][T20083] device ipvlan1627 entered promiscuous mode
[ 3338.588612][   T29] audit: type=1804 audit(1596806184.123:3144): pid=20081 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1572/cgroup.controllers" dev="sda1" ino=15859 res=1
13:16:24 executing program 4:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
ioctl$F2FS_IOC_FLUSH_DEVICE(r0, 0x4008f50a, &(0x7f0000000000)={0x7, 0x3})
sendmmsg(r0, &(0x7f00000010c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000dc0)=[{0x10, 0x1}], 0x10}}], 0x2, 0x80)

13:16:24 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x70, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:24 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d325}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:16:24 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x3f00, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:24 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x500, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3338.982632][T20122] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3339.153885][T20122] device ipvlan1628 entered promiscuous mode
[ 3339.250293][T20128] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3339.314377][T20128] device ipvlan1629 entered promiscuous mode
13:16:26 executing program 3:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
socket$rxrpc(0x21, 0x2, 0xa)
socket$rxrpc(0x21, 0x2, 0xa)
write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0xf0, &(0x7f0000000000)=[{&(0x7f0000000080)="4500000034000535a4abd32b80180025042482c137153e37100001800125d124000000b3e9d3dfd08300000000000000", 0x30}, {&(0x7f0000000100)="6a2a261bb49c3cfd4a93b0ed6022ad8aa9859d8787", 0x15}], 0x2}, 0x0)
r4 = accept(r3, &(0x7f0000000a00)=@vsock={0x28, 0x0, 0x0, @host}, &(0x7f0000000a80)=0x80)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00')
sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)={0x54, r6, 0x5, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "2cdae66f91dac475aab512aac5d7e6bcd9f5f438"}}]}]}, 0x54}}, 0x0)
sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f0000000cc0)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000b00)={0x164, r6, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_LINK={0xa0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc7b4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20000000}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffff42}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NODE={0x5c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xf8}, @TIPC_NLA_NODE_KEY={0x46, 0x4, {'gcm(aes)\x00', 0x1e, "7a19e5dcea17e6e1f67adfc19593241dc8c85c16eb9fc165fbf742c8ab3c"}}]}, @TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x3ff, @private0, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0xfffffffe, @empty, 0x8}}}}]}]}, 0x164}, 0x1, 0x0, 0x0, 0x40}, 0x0)
r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580)='batadv\x00')
r8 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="1cfe8b00", @ANYRES16=0x0, @ANYBLOB="000000000000000000000f10000008000300", @ANYRES32], 0x4}}, 0x0)
sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r7, @ANYBLOB="ff830a00000016000a00", @ANYRES32=r8], 0x4}}, 0x0)
sendfile(r2, r1, 0x0, 0x100000002)

13:16:26 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x300, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:26 executing program 4:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
write$cgroup_int(r1, &(0x7f0000000200), 0xf000)
sendfile(r1, 0xffffffffffffffff, 0x0, 0x1f)
sendfile(r1, r0, 0x0, 0x800000000000c)
socket$netlink(0x10, 0x3, 0x0)
write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="2321202e2f66696c659385943d30205e2d20656d6f72792e6c616e317b6d6f72792e657665007473000ae0a44301e35f6ea70565eb521d078e8331cc494cda1a5bcdce7a367fc22372c64b9cd509bf542d6943a89ac7f0a5cd01ffc671f4afd52f9209dfb706a9a6ef38a967b548000e6aa52f4a78b56901000000000000e66ad5eeeaf3608c09e7c2d66a18c484aee2d1b950a92e2214ac483a01233932e93608ed16149749f7a53c09db4ca9722d9278348d41c1d511a45053d271cfbf354ba38683474f457763558cd893e1b22d112c4601c79e1e72b0abc82f2efc6143c70d44f8e4213e247a8927171b4440f385b3c47cfb0af700000051a400000000000000000000003db85b12618c42624a043a5132da3377e49c53bee9bdead00ea8681361c18a124419bb93e420e42ed65f78a573a1f06887e0afbdf007f4deea9c76473499025de3b7ee000000000000000000000000000009000000000000000000000000538b2d2f2a1f68acbe71bc4b75e980b8ff3018156a2a3b860a6e305167b3f2359a86920b6332c240589967c8b75342061b37930a35b496b5f57ede35e446f973dd7b4bf329321e8582349a5cdd7d29d760449b6c74966838c7083e5d074c9b485bc83ba1de041544bf1c8c77fd0821a5e63be61071624ab397884d7b4cb29c3419c6cb44ccebfe0682d9dc66b7f5b5d1051ac149c560c4f34bad6d0551b9b26874068a29c878f7211c16a60874e799b585909180d61bfcbf7860a1064a6e412682562273eab4473f76a989a778940a4e78426c4a255491f0d4129b50a27ec43f32ac50812429ea5031fc522525af31726c736bb1072dd78663ee8e3aad349a000000"], 0x111)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001})
close(r2)
ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000000))
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071")
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700)
ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0)
pwrite64(0xffffffffffffffff, &(0x7f0000000600), 0x0, 0x0)
r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
setsockopt$sock_int(r3, 0x1, 0x3e, &(0x7f00000000c0)=0x7, 0x4)
bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x10, 0x80, 0x5, 0x5}, 0x10)
sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0)
ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0)

13:16:26 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x4000, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:26 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x600, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:26 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2e02020025000535d25a80648c63940d0424fc601600174002000000051a82c137153e6709020f8003001700d1bd", 0x33fe0}], 0x1, 0x0, 0x5d326}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendfile(r2, r1, 0x0, 0x100000002)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x4, 0x8, 0xfc26b8255a7b012, 0x0, 0x0, {0xc, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @empty={[0xe]}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x48040)
bind(r4, &(0x7f0000000100)=@phonet={0x23, 0x3, 0x5, 0x3f}, 0x80)
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="050400000000000000007e"], 0x14}}, 0x0)

13:16:26 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x5c00, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:26 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x500, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:26 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x700, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3340.723260][   T29] audit: type=1804 audit(1596806186.413:3145): pid=20152 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir327749771/syzkaller.if7ufm/1451/cgroup.controllers" dev="sda1" ino=15810 res=1
[ 3340.752971][T20151] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 3340.828802][T20151] netlink: 29 bytes leftover after parsing attributes in process `syz-executor.3'.
13:16:26 executing program 2:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x7000, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:26 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x7000, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x4, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

13:16:26 executing program 5:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @source_quench={0x3, 0x0, 0x0, 0x2c00, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0xb00, @multicast1, @private, {[@timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local={0xac, 0x14, 0x3a}}, {@empty}]}, @timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote}]}, @timestamp_addr={0x44, 0xc}, @ra={0x94, 0x4}, @cipso={0x86, 0x42, 0x0, [{0x0, 0x7, "eccdb50d00"}]}]}}}}}}}, 0x0)

[ 3341.278758][   T29] audit: type=1800 audit(1596806186.973:3146): pid=20154 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=15842 res=0
[ 3341.448195][   T29] audit: type=1804 audit(1596806187.043:3147): pid=20154 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir266747688/syzkaller.6DMxdu/1574/cgroup.controllers" dev="sda1" ino=15842 res=1
[ 3343.737319][    T0] NOHZ: local_softirq_pending 08
[ 3344.009777][T20147] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3344.043934][T20147] device ipvlan1630 entered promiscuous mode
[ 3344.080967][T20172] netlink: 'syz-executor.1': attribute type 5 has an invalid length.
[ 3344.111018][T20172] device ipvlan1631 entered promiscuous mode
[ 3503.711807][ T1159] INFO: task khugepaged:1174 blocked for more than 143 seconds.
[ 3503.719491][ T1159]       Not tainted 5.8.0-syzkaller #0
[ 3503.728995][ T1159] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3503.745381][ T1159] khugepaged      D24184  1174      2 0x00004000
[ 3503.753908][ T1159] Call Trace:
[ 3503.757213][ T1159]  __schedule+0x8e5/0x21e0
[ 3503.768862][ T1159]  ? io_schedule_timeout+0x140/0x140
[ 3503.775874][ T1159]  ? __lock_acquire+0x16cb/0x5640
[ 3503.780912][ T1159]  schedule+0xd0/0x2a0
[ 3503.796770][ T1159]  schedule_timeout+0x1d8/0x250
[ 3503.807474][ T1159]  ? usleep_range+0x170/0x170
[ 3503.813921][ T1159]  ? mark_held_locks+0x9f/0xe0
[ 3503.818700][ T1159]  ? _raw_spin_unlock_irq+0x1f/0x80
[ 3503.830518][ T1159]  ? lockdep_hardirqs_on_prepare+0x354/0x530
[ 3503.838302][ T1159]  ? trace_hardirqs_on+0x5f/0x220
[ 3503.849907][ T1159]  wait_for_completion+0x163/0x260
[ 3503.856826][ T1159]  ? wait_for_completion_interruptible+0x2e0/0x2e0
[ 3503.869124][ T1159]  ? _raw_spin_unlock_irq+0x1f/0x80
[ 3503.876110][ T1159]  ? lockdep_hardirqs_on_prepare+0x354/0x530
[ 3503.887867][ T1159]  __flush_work+0x51f/0xab0
[ 3503.894946][ T1159]  ? queue_work_node+0x370/0x370
[ 3503.899981][ T1159]  ? lock_downgrade+0x830/0x830
[ 3503.912214][ T1159]  ? flush_workqueue_prep_pwqs+0x4f0/0x4f0
[ 3503.918155][ T1159]  ? queue_work_on+0xe6/0x200
[ 3503.929050][ T1159]  ? lockdep_hardirqs_on_prepare+0x354/0x530
[ 3503.937119][ T1159]  ? trace_hardirqs_on+0x5f/0x220
[ 3503.947980][ T1159]  ? _find_next_bit.constprop.0+0x1a3/0x200
[ 3503.966886][ T1159]  lru_add_drain_all+0x3ca/0x590
[ 3503.973545][ T1159]  khugepaged+0x10b/0x5a10
[ 3503.977998][ T1159]  ? collapse_pte_mapped_thp+0xb90/0xb90
[ 3503.989886][ T1159]  ? __kthread_parkme+0xad/0x1e0
[ 3503.996662][ T1159]  ? lock_downgrade+0x830/0x830
[ 3504.007138][ T1159]  ? add_wait_queue_exclusive+0x180/0x180
[ 3504.014525][ T1159]  ? _raw_spin_unlock_irqrestore+0x62/0xe0
[ 3504.020336][ T1159]  ? __kthread_parkme+0x4c/0x1e0
[ 3504.033285][ T1159]  ? lockdep_hardirqs_on_prepare+0x354/0x530
[ 3504.039368][ T1159]  ? __kthread_parkme+0x13f/0x1e0
[ 3504.049676][ T1159]  ? collapse_pte_mapped_thp+0xb90/0xb90
[ 3504.058128][ T1159]  kthread+0x3b5/0x4a0
[ 3504.067618][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3504.075396][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3504.080526][ T1159]  ret_from_fork+0x1f/0x30
[ 3504.090107][ T1159] INFO: task kworker/u4:2:20399 blocked for more than 143 seconds.
[ 3504.100737][ T1159]       Not tainted 5.8.0-syzkaller #0
[ 3504.110835][ T1159] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3504.136808][ T1159] kworker/u4:2    D24480 20399      2 0x00004000
[ 3504.150004][ T1159] Workqueue: netns cleanup_net
[ 3504.155818][ T1159] Call Trace:
[ 3504.159125][ T1159]  __schedule+0x8e5/0x21e0
[ 3504.172435][ T1159]  ? io_schedule_timeout+0x140/0x140
[ 3504.177743][ T1159]  schedule+0xd0/0x2a0
[ 3504.195413][ T1159]  schedule_timeout+0x1d8/0x250
[ 3504.200380][ T1159]  ? usleep_range+0x170/0x170
[ 3504.210213][ T1159]  ? mark_held_locks+0x9f/0xe0
[ 3504.218262][ T1159]  ? _raw_spin_unlock_irq+0x1f/0x80
[ 3504.228124][ T1159]  ? lockdep_hardirqs_on_prepare+0x354/0x530
[ 3504.236766][ T1159]  ? trace_hardirqs_on+0x5f/0x220
[ 3504.246462][ T1159]  wait_for_completion+0x163/0x260
[ 3504.254595][ T1159]  ? __mutex_unlock_slowpath+0xe2/0x610
[ 3504.260156][ T1159]  ? wait_for_completion_interruptible+0x2e0/0x2e0
[ 3504.276171][ T1159]  ? flush_workqueue_prep_pwqs+0x2a2/0x4f0
[ 3504.286569][ T1159]  ? kthread_data+0x4f/0xc0
[ 3504.294897][ T1159]  ? check_flush_dependency+0x2e2/0x400
[ 3504.300461][ T1159]  flush_workqueue+0x3ff/0x13e0
[ 3504.310305][ T1159]  ? rxrpc_discard_prealloc+0x90/0xaf0
[ 3504.319479][ T1159]  ? find_held_lock+0x2d/0x110
[ 3504.327942][ T1159]  ? max_active_store+0x120/0x120
[ 3504.336849][ T1159]  ? rxrpc_release+0x495/0x5a0
[ 3504.345364][ T1159]  ? rxrpc_discard_prealloc+0x1d6/0xaf0
[ 3504.350921][ T1159]  ? rxrpc_release_calls_on_socket+0x187/0x300
[ 3504.367046][ T1159]  rxrpc_release+0x26f/0x5a0
[ 3504.372741][ T1159]  sock_release+0x87/0x1b0
[ 3504.377170][ T1159]  afs_close_socket+0x1c7/0x320
[ 3504.389116][ T1159]  ? afs_purge_servers+0x181/0x330
[ 3504.395918][ T1159]  ? afs_rx_discard_new_call+0x50/0x50
[ 3504.408085][ T1159]  ? init_wait_var_entry+0x200/0x200
[ 3504.414986][ T1159]  ? trace_hardirqs_on+0x5f/0x220
[ 3504.420028][ T1159]  afs_net_exit+0x1c4/0x310
[ 3504.431611][ T1159]  ? __bpf_trace_afs_cb_miss+0x100/0x100
[ 3504.437372][ T1159]  ops_exit_list+0xb0/0x160
[ 3504.452033][ T1159]  cleanup_net+0x4ea/0xa00
[ 3504.456473][ T1159]  ? ops_free_list.part.0+0x3d0/0x3d0
[ 3504.468199][ T1159]  ? lock_is_held_type+0xbb/0xf0
[ 3504.473948][ T1159]  process_one_work+0x94c/0x1670
[ 3504.478903][ T1159]  ? lock_release+0x8e0/0x8e0
[ 3504.490798][ T1159]  ? pwq_dec_nr_in_flight+0x2d0/0x2d0
[ 3504.497027][ T1159]  ? rwlock_bug.part.0+0x90/0x90
[ 3504.509393][ T1159]  worker_thread+0x64c/0x1120
[ 3504.515617][ T1159]  ? __kthread_parkme+0x13f/0x1e0
[ 3504.520658][ T1159]  ? process_one_work+0x1670/0x1670
[ 3504.533151][ T1159]  kthread+0x3b5/0x4a0
[ 3504.537231][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3504.547492][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3504.555487][ T1159]  ret_from_fork+0x1f/0x30
[ 3504.559937][ T1159] INFO: task syz-executor.3:20144 blocked for more than 144 seconds.
[ 3504.575193][ T1159]       Not tainted 5.8.0-syzkaller #0
[ 3504.580649][ T1159] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3504.599846][ T1159] syz-executor.3  D28392 20144   7315 0x00000004
[ 3504.607099][ T1159] Call Trace:
[ 3504.610403][ T1159]  __schedule+0x8e5/0x21e0
[ 3504.622851][ T1159]  ? io_schedule_timeout+0x140/0x140
[ 3504.628158][ T1159]  schedule+0xd0/0x2a0
[ 3504.639093][ T1159]  schedule_timeout+0x1d8/0x250
[ 3504.645854][ T1159]  ? usleep_range+0x170/0x170
[ 3504.650545][ T1159]  ? mark_held_locks+0x9f/0xe0
[ 3504.662485][ T1159]  ? _raw_spin_unlock_irq+0x1f/0x80
[ 3504.667696][ T1159]  ? lockdep_hardirqs_on_prepare+0x354/0x530
[ 3504.678917][ T1159]  ? trace_hardirqs_on+0x5f/0x220
[ 3504.686822][ T1159]  wait_for_completion+0x163/0x260
[ 3504.696655][ T1159]  ? __mutex_unlock_slowpath+0xe2/0x610
[ 3504.705122][ T1159]  ? wait_for_completion_interruptible+0x2e0/0x2e0
[ 3504.716276][ T1159]  ? flush_workqueue_prep_pwqs+0x2a2/0x4f0
[ 3504.726054][ T1159]  ? check_flush_dependency+0x15b/0x400
[ 3504.737051][ T1159]  flush_workqueue+0x3ff/0x13e0
[ 3504.744655][ T1159]  ? rxrpc_discard_prealloc+0x90/0xaf0
[ 3504.750123][ T1159]  ? find_held_lock+0x2d/0x110
[ 3504.760153][ T1159]  ? max_active_store+0x120/0x120
[ 3504.768074][ T1159]  ? mark_lock+0xbc/0x1710
[ 3504.777099][ T1159]  ? rxrpc_discard_prealloc+0x1d6/0xaf0
[ 3504.785537][ T1159]  ? rxrpc_release_calls_on_socket+0x187/0x300
[ 3504.796517][ T1159]  ? trace_hardirqs_on+0x5f/0x220
[ 3504.804540][ T1159]  ? __sock_release+0x280/0x280
[ 3504.809401][ T1159]  rxrpc_release+0x26f/0x5a0
[ 3504.819390][ T1159]  __sock_release+0xcd/0x280
[ 3504.826714][ T1159]  sock_close+0x18/0x20
[ 3504.835877][ T1159]  __fput+0x33c/0x880
[ 3504.839876][ T1159]  task_work_run+0xdd/0x190
[ 3504.848346][ T1159]  exit_to_user_mode_prepare+0x1aa/0x1d0
[ 3504.859460][ T1159]  syscall_exit_to_user_mode+0x59/0x2b0
[ 3504.868608][ T1159]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 3504.879158][ T1159] RIP: 0033:0x4167f1
[ 3504.885903][ T1159] Code: Bad RIP value.
[ 3504.889982][ T1159] RSP: 002b:00007fff1641fbe0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 3504.905756][ T1159] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004167f1
[ 3504.915627][ T1159] RDX: 0000000000000000 RSI: 0000000000000b78 RDI: 0000000000000004
[ 3504.929551][ T1159] RBP: 0000000000000001 R08: 0000000067354b78 R09: 0000000067354b7c
[ 3504.939369][ T1159] R10: 00007fff1641fcd0 R11: 0000000000000293 R12: 000000000078c900
[ 3504.954942][ T1159] R13: 000000000078c900 R14: ffffffffffffffff R15: 000000000078bf0c
[ 3504.966018][ T1159] 
[ 3504.966018][ T1159] Showing all locks held in the system:
[ 3504.978665][ T1159] 1 lock held by khungtaskd/1159:
[ 3504.987303][ T1159]  #0: ffffffff89bd6980 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260
[ 3505.010669][ T1159] 1 lock held by khugepaged/1174:
[ 3505.016535][ T1159]  #0: ffffffff89c5d188 (lock#5){+.+.}-{3:3}, at: lru_add_drain_all+0x59/0x590
[ 3505.032728][ T1159] 1 lock held by in:imklog/6526:
[ 3505.037674][ T1159]  #0: ffff8880973c33f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100
[ 3505.054413][ T1159] 5 locks held by kworker/1:16/6985:
[ 3505.059712][ T1159] 3 locks held by kworker/u4:2/20399:
[ 3505.069289][ T1159]  #0: ffff88821b03c138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670
[ 3505.086522][ T1159]  #1: ffffc90016eafda8 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670
[ 3505.097219][ T1159]  #2: ffffffff8a7ce8f0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9b/0xa00
[ 3505.114229][ T1159] 1 lock held by syz-executor.3/20144:
[ 3505.119686][ T1159]  #0: ffff888038690750 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at: __sock_release+0x86/0x280
[ 3505.137486][ T1159] 
[ 3505.139825][ T1159] =============================================
[ 3505.139825][ T1159] 
[ 3505.149766][ T1159] NMI backtrace for cpu 0
[ 3505.154346][ T1159] CPU: 0 PID: 1159 Comm: khungtaskd Not tainted 5.8.0-syzkaller #0
[ 3505.162229][ T1159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3505.172276][ T1159] Call Trace:
[ 3505.175564][ T1159]  dump_stack+0x18f/0x20d
[ 3505.179903][ T1159]  nmi_cpu_backtrace.cold+0x70/0xb1
[ 3505.185103][ T1159]  ? lapic_can_unplug_cpu.cold+0x38/0x38
[ 3505.190737][ T1159]  nmi_trigger_cpumask_backtrace+0x1b3/0x223
[ 3505.196720][ T1159]  watchdog+0xd7d/0x1000
[ 3505.200962][ T1159]  ? reset_hung_task_detector+0x30/0x30
[ 3505.206504][ T1159]  kthread+0x3b5/0x4a0
[ 3505.210576][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3505.215682][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3505.220798][ T1159]  ret_from_fork+0x1f/0x30
[ 3505.225416][ T1159] Sending NMI from CPU 0 to CPUs 1:
[ 3505.231745][ T1159] NMI backtrace for cpu 1
[ 3505.231752][ T1159] CPU: 1 PID: 6985 Comm: kworker/1:16 Not tainted 5.8.0-syzkaller #0
[ 3505.231757][ T1159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3505.231760][ T1159] Workqueue: events ipvlan_process_multicast
[ 3505.231766][ T1159] RIP: 0010:find_match.part.0+0xd0/0xc70
[ 3505.231776][ T1159] Code: c0 84 c0 0f 84 39 04 00 00 e8 ac af 8b fa 49 8d bf 5c 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 <48> 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 91 06 00 00 45
[ 3505.231780][ T1159] RSP: 0018:ffffc90000da85f0 EFLAGS: 00000a07
[ 3505.231786][ T1159] RAX: dffffc0000000000 RBX: ffff88805b0a5aa0 RCX: ffffffff86e871a0
[ 3505.231791][ T1159] RDX: 0000000000000000 RSI: ffffffff86e86d34 RDI: ffff888093d4b25c
[ 3505.231795][ T1159] RBP: ffffc90000da8660 R08: 0000000000000001 R09: ffffc90000da8840
[ 3505.231799][ T1159] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003
[ 3505.231804][ T1159] R13: 0000000000000001 R14: 00000000000002df R15: ffff888093d4b000
[ 3505.231809][ T1159] FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
[ 3505.231812][ T1159] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3505.231817][ T1159] CR2: 000055b5ad6c2a78 CR3: 00000000a9199000 CR4: 00000000001506e0
[ 3505.231821][ T1159] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3505.231826][ T1159] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3505.231828][ T1159] Call Trace:
[ 3505.231830][ T1159]  <IRQ>
[ 3505.231832][ T1159]  __find_rr_leaf+0x17f/0xd10
[ 3505.231835][ T1159]  ? ip6_sk_redirect+0x120/0x120
[ 3505.231838][ T1159]  ? fib6_node_lookup+0x110/0x170
[ 3505.231841][ T1159]  ? fib6_add+0x3ed0/0x3ed0
[ 3505.231844][ T1159]  ? lockdep_hardirqs_on_prepare+0x530/0x530
[ 3505.231847][ T1159]  fib6_table_lookup+0x5b3/0xa20
[ 3505.231850][ T1159]  ? rt6_age_exceptions+0x150/0x150
[ 3505.231853][ T1159]  ? mark_held_locks+0x9f/0xe0
[ 3505.231856][ T1159]  ip6_pol_route+0x1e1/0x1190
[ 3505.231859][ T1159]  ? ip6_pol_route_lookup+0x1ad0/0x1ad0
[ 3505.231862][ T1159]  ? flow_hash_from_keys+0x7b/0x110
[ 3505.231865][ T1159]  ? __flow_hash_from_keys+0x6c0/0x6c0
[ 3505.231868][ T1159]  fib6_rule_lookup+0x111/0x6f0
[ 3505.231871][ T1159]  ? ip6_pol_route+0x1190/0x1190
[ 3505.231874][ T1159]  ? fib6_lookup+0x2d0/0x2d0
[ 3505.231876][ T1159]  ? nf_conntrack_in+0x71f/0x12a0
[ 3505.231879][ T1159]  ? nf_nat_ipv6_fn+0xfc/0x2e0
[ 3505.231883][ T1159]  ? nf_nat_icmpv6_reply_translation+0x630/0x630
[ 3505.231886][ T1159]  ? __sanitizer_cov_trace_switch+0x45/0x70
[ 3505.231889][ T1159]  ip6_route_input+0x68a/0xae0
[ 3505.231892][ T1159]  ? nf_hook.constprop.0+0x394/0x5d0
[ 3505.231895][ T1159]  ? ip6_route_check_nh+0x670/0x670
[ 3505.231898][ T1159]  ? lock_downgrade+0x830/0x830
[ 3505.231901][ T1159]  ? ipv6_defrag+0x79/0x4c0
[ 3505.231904][ T1159]  ? __sanitizer_cov_trace_switch+0x45/0x70
[ 3505.231907][ T1159]  ? nf_hook_slow+0xf5/0x1e0
[ 3505.231910][ T1159]  ip6_rcv_finish_core.constprop.0.isra.0+0x168/0x570
[ 3505.231913][ T1159]  ipv6_rcv+0x22b/0x3c0
[ 3505.231916][ T1159]  ? ip6_rcv_core+0x1cb0/0x1cb0
[ 3505.231919][ T1159]  __netif_receive_skb_one_core+0x114/0x180
[ 3505.231923][ T1159]  ? __netif_receive_skb_core+0x3690/0x3690
[ 3505.231925][ T1159]  ? mark_held_locks+0x9f/0xe0
[ 3505.231928][ T1159]  ? rwlock_bug.part.0+0x90/0x90
[ 3505.231931][ T1159]  __netif_receive_skb+0x27/0x1c0
[ 3505.231934][ T1159]  process_backlog+0x28d/0x7f0
[ 3505.231937][ T1159]  net_rx_action+0x4a1/0xe80
[ 3505.231940][ T1159]  ? napi_complete_done+0x860/0x860
[ 3505.231942][ T1159]  ? mark_held_locks+0x9f/0xe0
[ 3505.231945][ T1159]  ? sched_clock_cpu+0x18/0x1b0
[ 3505.231948][ T1159]  ? lock_is_held_type+0xbb/0xf0
[ 3505.231951][ T1159]  __do_softirq+0x2de/0xa24
[ 3505.231953][ T1159]  asm_call_on_stack+0xf/0x20
[ 3505.231955][ T1159]  </IRQ>
[ 3505.231958][ T1159]  do_softirq_own_stack+0x9d/0xd0
[ 3505.231961][ T1159]  do_softirq+0x17b/0x1e0
[ 3505.231964][ T1159]  ? ipvlan_process_multicast+0x813/0xd50
[ 3505.231967][ T1159]  __local_bh_enable_ip+0x14d/0x190
[ 3505.231970][ T1159]  ipvlan_process_multicast+0x829/0xd50
[ 3505.231973][ T1159]  ? ipvlan_mac_hash+0xd0/0xd0
[ 3505.231976][ T1159]  ? lock_downgrade+0x830/0x830
[ 3505.231979][ T1159]  ? do_raw_spin_lock+0x120/0x2b0
[ 3505.231982][ T1159]  ? _raw_spin_unlock_irq+0x1f/0x80
[ 3505.231985][ T1159]  ? lock_is_held_type+0xbb/0xf0
[ 3505.231988][ T1159]  process_one_work+0x94c/0x1670
[ 3505.231991][ T1159]  ? lock_release+0x8e0/0x8e0
[ 3505.231994][ T1159]  ? pwq_dec_nr_in_flight+0x2d0/0x2d0
[ 3505.231997][ T1159]  ? rwlock_bug.part.0+0x90/0x90
[ 3505.232000][ T1159]  worker_thread+0x64c/0x1120
[ 3505.232003][ T1159]  ? process_one_work+0x1670/0x1670
[ 3505.232005][ T1159]  kthread+0x3b5/0x4a0
[ 3505.232008][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3505.232011][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3505.232014][ T1159]  ret_from_fork+0x1f/0x30
[ 3505.759014][ T1159] Kernel panic - not syncing: hung_task: blocked tasks
[ 3505.765897][ T1159] CPU: 0 PID: 1159 Comm: khungtaskd Not tainted 5.8.0-syzkaller #0
[ 3505.773774][ T1159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3505.783829][ T1159] Call Trace:
[ 3505.787126][ T1159]  dump_stack+0x18f/0x20d
[ 3505.791456][ T1159]  panic+0x2e3/0x75c
[ 3505.795348][ T1159]  ? __warn_printk+0xf3/0xf3
[ 3505.799936][ T1159]  ? lapic_can_unplug_cpu.cold+0x38/0x38
[ 3505.805575][ T1159]  ? preempt_schedule_thunk+0x16/0x18
[ 3505.811028][ T1159]  ? watchdog.cold+0x5/0x16b
[ 3505.815628][ T1159]  ? watchdog+0xa82/0x1000
[ 3505.820051][ T1159]  watchdog.cold+0x16/0x16b
[ 3505.824553][ T1159]  ? reset_hung_task_detector+0x30/0x30
[ 3505.830094][ T1159]  kthread+0x3b5/0x4a0
[ 3505.834152][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3505.839256][ T1159]  ? __kthread_bind_mask+0xc0/0xc0
[ 3505.844365][ T1159]  ret_from_fork+0x1f/0x30
[ 3505.850224][ T1159] Kernel Offset: disabled
[ 3505.854541][ T1159] Rebooting in 86400 seconds..