c-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xc3ffffff, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:32 executing program 1: 07:09:32 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={r2}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f00000003c0)={r2, 0x5}, 0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000000)={r2, @in={{0x2, 0x4e23, @rand_addr=0x3}}, [0x5, 0xb4, 0x5, 0xff0, 0x8, 0x20, 0x0, 0x4, 0x35, 0x7, 0x40, 0x100000001, 0x100, 0x7, 0x7]}, &(0x7f0000000140)=0x100) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f00000001c0)={r3, 0x81}, 0x8) 07:09:32 executing program 3: 07:09:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x7a000000, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:32 executing program 3: 07:09:32 executing program 1: 07:09:32 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x80, 0x0) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000040)) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) [ 823.827925] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:32 executing program 3: 07:09:32 executing program 1: [ 823.976303] Unknown ioctl 4730 07:09:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x81000000, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 824.007105] device nr0 entered promiscuous mode [ 824.012426] Unknown ioctl 4730 [ 824.110964] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xf0ffffff, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:32 executing program 3: 07:09:32 executing program 1: 07:09:32 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:32 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x1}], 0x2) 07:09:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x88a8ffff, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:32 executing program 3: 07:09:32 executing program 1: 07:09:32 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000040)={0x7, 0x7f, 0x0, 'queue1\x00'}) writev(r0, &(0x7f0000000140), 0x100000000000020f) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000100)={0x6b, 0x8, 0x4, 0x20000000, 0xe0f, {0x0, 0x7530}, {0x3, 0x1, 0x7, 0x5, 0x43, 0xf3, "e10faee1"}, 0x8, 0x3, @userptr=0x5b6e, 0x8, 0x0, r0}) ioctl$USBDEVFS_CLAIMINTERFACE(r3, 0x8004550f, &(0x7f0000000180)=0x4) [ 824.345459] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 824.405434] device nr0 entered promiscuous mode 07:09:33 executing program 3: 07:09:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x9effffff, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:33 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xfeffffff, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:33 executing program 1: 07:09:33 executing program 3: 07:09:33 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f0000000000)="37ecd3a4c45bc1f808edf7140d5141f96f79fe7b2529227bdc3ab2fd5af33324ab2fe6e69ada188519d7ef225babd3feefae232f22", 0x1}, {&(0x7f0000000240)='\t', 0x249}], 0x2) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={r2}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f00000003c0)={r2, 0x5}, 0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000280)=@assoc_value={r2, 0x7}, &(0x7f00000002c0)=0x8) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080)='devlink\x00') r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$inet6_tcp_TLS_RX(r4, 0x6, 0x2, &(0x7f0000000440)=@ccm_128={{0x303}, "18e4f53c37c4f3bd", "f78a330a470297185d0f85261e593106", "0c39b797", "6ea92a95b44cead5"}, 0x28) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0xffffffffffffffff, 0x8, &(0x7f0000000580)=""/218) tkill(r5, 0x20) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000380)={0xffffffffffffffff, r0, 0x0, 0x1, &(0x7f0000000340)='\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r5, r1, 0x0, 0x37, &(0x7f0000000300)='^\'&mime_typeeth1!vmnet0posix_acl_access^eth0em1trusted\x00', r6}, 0x30) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$RTC_SET_TIME(r7, 0x4024700a, &(0x7f0000000480)={0x6, 0x20, 0xd, 0x6, 0x5, 0xff, 0x3, 0x14d, 0xa68d9c8bc5838175}) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x8c, r3, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, @nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, @nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x40404) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r8, 0x111, 0x1, 0x401, 0x4) [ 824.664397] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:33 executing program 3: 07:09:33 executing program 1: 07:09:33 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='6', 0x1}, {&(0x7f0000000000)="59a37ac8a453c8b3daaed798db4e63d8bf6a3516d0eee315bd5c559bc23a251e6978ca92350939fe6fad025fb85fb74c2af3b1af30173e2935d7ca5b529540e6d57b196284a895f650b45d34f378aaa2dd36fb43059187c8da1c9011e5eee6c2735987ea9116b40a9859af2ef8a2848a1f", 0x71}], 0x2) 07:09:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xc3ffffff, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:33 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xffffa888, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:33 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:33 executing program 1: 07:09:33 executing program 3: [ 825.161470] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:33 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, &(0x7f0000000000)=[{}, {}, {}], &(0x7f0000000040)=0x18) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000080)=0x0) fcntl$setownex(r2, 0xf, &(0x7f00000000c0)={0xb2bef925846b00e3, r3}) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) 07:09:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xf0ffffff, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:33 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xfffff000, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:34 executing program 1: 07:09:34 executing program 3: 07:09:34 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1) [ 825.454888] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:34 executing program 1: 07:09:34 executing program 3: [ 825.593318] device nr0 entered promiscuous mode 07:09:34 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xfeffffff, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:34 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:34 executing program 3: 07:09:34 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xffffff7f, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:34 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$P9_RRENAME(r0, &(0x7f0000000000)={0x7, 0x15, 0x2}, 0x7) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ptrace$getsig(0x4202, 0x0, 0x415, &(0x7f0000000180)) r2 = syz_open_dev$sndpcmc(&(0x7f0000001540)='/dev/snd/pcmC#D#c\x00', 0x3, 0x10000) ftruncate(r2, 0x8) ioctl$SNDRV_PCM_IOCTL_USER_PVERSION(r2, 0x40044104, &(0x7f00000015c0)=0x1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$sock_inet6_tcp_SIOCINQ(r4, 0x40046109, &(0x7f0000000300)) ioctl$VIDIOC_SUBDEV_S_EDID(r4, 0xc0285629, &(0x7f0000001500)={0x0, 0x9, 0x8000, [], &(0x7f00000014c0)=0x7}) r5 = dup(r3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001580)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup3(r7, r6, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000013c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r8, &(0x7f0000001480)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x20410001}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x24, r9, 0x100, 0x70bd27, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10000044}, 0x4800c000) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$DRM_IOCTL_GET_UNIQUE(r5, 0xc0106401, &(0x7f0000000000)={0xd1, &(0x7f0000000240)=""/209}) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x61, &(0x7f0000001600)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000010000038127843c9b134f1ebf363aa5e0610b9669962ef6f054dc921ca30ae6841f6e630966c63083c030ea8aff6350373e0a657b564bb97e9990bf40ef121c2d3feef463a97f835f7bf80293a65c53fe097fc1aa7c4ff255d2336e16f88d152178f5606e475ce1f534dc20e8570f3e8119512d70232cdd5024e4fedd769d87af1a1190d5ae16ba2f70ce01b8d9a4335e1c4a3d3df953d795822670a65032be90bbc8b1edccafe3457c717b2838716142e67d45b2906be8fd8d2969828f3675308e925ab61bc174288dffc59944f9bad4d3b535440320efa7201ea3156fad33e27f0d4da1c5da1bfbf7932842291444798e67459669525ed8efe8aaceb081f29ab95009f522142866db4044b64e9b73c8f2ed0a309aaf9555d5297226331ba2f195829c002fdd717e949ee940e7397dc3b67ac5df581395bd262cd62e7e5b4621782e4ec40e66dab41f02ceaf2a94fbecb1e3f1bb9172167a5904d81ac230d1c99fdf311f61a967ead753fcc5c094afb2a40902b3e566378d9232afdf5ec9e8e14a79c0f974ced5d07f10915db90a6c5144d9478522496dfcecaf03efb797399181e3ad547e3f94a14fbebecf69fe24811c2cad6ad213844fadd7d48388e78b6d1c9cb47186bd3b388b4b174e76d5783c8f313560ad7d5fe8a724ca3b564cebd4359380b761ac4e67477dee81e690565b588edbfac459173eaa0c8a1aae654cd0313f9265fea2f1c735c97e0790de2c92be3cf7f19f9050c6d29f62b6d4fd36789dc7f48b58b0c5ebf947669b3eade596bbf420089c929c8cd33f7b8485da6054cc0517e57ca73e4076e20000ab515b9a567a05c315a94aa251b0b3c71146048109d5a72d6f22a9aaa6e418272971771c7f80303cb5db4f96e1c7a8d967dd37ba9928186126fedcfdbe2602d0c9d9b95c3181b7db5ef0152199edba220cf9e98e7d7219367995f2ed704c1b0bf25b3d95f58ffd1d1618bbe4a39580e22d80f6a1a63da5a2db406ad131a30cb0a4714e9a9b9db6159ef6d05815eb700c3d544c05b43e5b4701831b76a2d695884d0f26801793bfdae4afa5923edd0004f29cf09919e93aa4aca225b711ef890b95c69dce4174160fabb1435da03356a761236d5307eecb9a5c45bc123b09ad627c6e423033629bb9b0acc3f6dbac5cd648728054a3f9a5f5e2a88e942ffb81a4a8ca53febc11ab8137cb802e2921b0c0829de4fa606f37e74e1025f2a666f262850ef77e041631ccf4787ed4290a5b32dc630caf0b80601a3759e425cb189002e5a0ee356f076084bcac031a9444713c000b318a8045c63229b43424589ce4c708d6ab626f2dbab890105be24856dd3cd414dd65269f6ec68e038338906b5176dd439abaa8f18b1902de0d03d1726b7a9d5299145c972ad474c74f78b7492906a9a580df0bc38d807f700815a6b65d2f86a0b873b4e82e0a8940e550fdac7a03272e0cb5b7541cb820f1c39ee66301e31123ba5b05f59cbce6f9dea8c771cd7cd96ffc943d5f7907bc3e5347054503af584287d3b419fd660f141b64ba2e43769ecde8d37fe47a5f09e738a0aa062019e5aa852e4e77aa343992b5e7a72951aebf309a51e2520ec83804f2b5655d3bffa90d9ccf729f7ef292e071c64ab448f928732f00cf142cf2b6b42d23915f9e7a633a6cf34d447417b2fd22e52aa4efd2979a51ab90436b7f7cdc05e4d82fbe2acb99e081098c9cdd524ab7300a7f805ea3e0945da563554a0614e55ae179d33ebe87dcc2c31a1889f6008c2306b24c3533e9941acc37f62af996513d22e95622e02822f2f8424d23836ce04420b2a8a86d1ca63870d20e46b66de48ae1efca0af9d8c44a5b6a2f6d22f22376ab97178321bbcf58111b94939d3f1fba18c3bf11c8df242aff7460fc1322d129ec9d8212d5e85a1b838f0ead0b9152f874cf20e06727e7d21e14912c74b0f91829a5abf6b7a3ec09445e135b779742f93e5e9a750c1238891d8cbe54845a4ffc62c7d9aa31d930ff5b2c502bb689cc1e2310fcbb897d1718b6c506c5814ad418a545f868de51e68eaede8c4f97e1265495eb377dbeac84b21ac83aa98f92ceac5bda923329c307e4973b599145d11ed04a55b26cb1b08f9fee057d8c93fa4aa063817cb8dfacbd4bca239ec525f91b206787fe4c3065741460926a2fdf2dcab9da07a05f099b9a8220a2fadd33df5f38ab0dff7ccd3a81ccd7efa89c4a49a684f63366a74e84837d3be673223b200604e90711a4e5bac02bef3bf0195adcb7c6f331ca68c759be2ffe8d04e06c1b4887d039bd18b38e6c1f03b19987fde0f24094eec2480e73ed9f263adcc21e485fef8b3b98cd2a620ee20ee11b0a4556400b63e508b675d896846a82d7a15541767731fcb9bcf51958825f3fd1fe863c66879b896250970d211400acb9fb8e2ed55fee03538034f64902c5d25dc8cd8df789e6be58fe6714199072be7258240997ca3b30c6828a84163dec81b7976994934edadfd0c15eb40b082430b11dec00020befe34c900a804e4b51c258ee45c5575a85d692110457cc01d6fbe502a2d988227be8ea2c941ebd705d27fb1f69a83b5ca2ad518837302d29beb12f9497fec972152f1b57468744606932c7431cb7253c459e79d59c53d566f9bfbc19daa04954ba80ea5ca6623ba0984d5c6f793a88e21a2559b6ecf112085ff5e27bd4206ee9bc10d2be490945980fc441befb8692ceca78e9ca100d9374a849550068de3a1d94330933a5fa4982a79d64018de2d3894d1a46d5408427f59de082ca63455d46fec361346ebbae4d88c1a5d22533cacc0791ff6cc48319948a6d1557071c186c9608e6d20bf3c27e14ccfe7ecafbd3320c1461c5edb6d431f4664dc5ba7a915ed847f6f97823bac0997f14d9b32ff86ada41d9cb4ed91c8de332e8ad84310cd519225b443bcc92658179ca916e7d6bbb5c4ef0dec3df685ec63e36db69bf6a981e53fcf1764cada9cda8fbd008197b8241b1ec57117a261996625de7baa4a5717cab028e362ebdf536177a65e3e250a86e562b7c7d496d18d4779c850a773a05bf54b7268ecc99be42a99c77620787062840944ffa2f7c77c32fca46a7f29847a4853915a95bfdaccf84f12c03aaa892d4ede1292232ff29fec2d5ebe1c7afec3ccb8665e8f22dbff38ed2c36f4217a54562b1006aa988606bc111856d60cc87e67990d16ba5ae13e9d0ad2fc202f77c519ebf6cbaa2783cf0fc7e53b03163153ec5c166ef36492361c664c40221023ce83aa88e069937bb7d437a93088881e67e3dc20ec187ebd26030fbb62b7bbae3836220c268556d051403d1fe9af647a6fc22d17b52da0d54d07dc5a0600d0e3577ff255ba57144d1ea8eb6d7e00a255b758e51f6e76fb577dbef4093bd01ff3b480ecc06e6022094f11b2a2d4f7c14cc814872bf8b3ac9ba30df97063d45d3dd6310ecee66bbf6486f723e24663b79ac354397ead74e9fe5ba8a72e70ddd3edde61e5ad5698eb2f75c8baedbcc5d0f5323cf4a979b5dd397674b224f266ab9ca01968263570b0a7da5d5fab6f3ce3bc3c62820fa09b0318824ad801d1bf02f9700d033b0df0f1a565d4ee1160dfc208bbf5ac2655704252fca64fdfc4683bab02f859b01eb073bd713f480c8196f77f0f0597f1739b4e6c07d13259fd6d35489786daa8681db2c663f859802d233e850fc6a443cb63ac381d212729cea7e3843cb6de8bf22270bf1cb1e43802b015be68d7ef89d7f5041de510f586a09e874ff9d4f5990dff3ed98aab48cc4c4b9d7186d9352f7d37877b21ecbac88aaab27710b7217369ef3898fe877ab00c5a7edf2316012532b0455c3e16b52464dd1bdcb5e21aab9550d58364808722d8bb34eab88e89c90f42783f90ed6e182be1cf56db94f3bb7e0f866b80f03d03cc66070691eb8cd113ff0b94d17324d5cbe8ad454145a781b298627f4b7fef4280fa447c41c49e5ed0cdcabe9db5e6af4b0a69ef5799083e498562e13e2a040efc3e67ff77ba5eb840408b72f55f6c7e01a2114cd63a159d9b0c22542919ea882f0936b3af3194f063c3fff0646eca55a15c9b039efabd70edf3e67c47e407632ce5d8367098cc4c7f56b5a7db82fe255b12d4e3411260d0f36b71bcf21cb9260f28bdee33d5f4e1b18bbc65dd9a67ab8308fad5a8a8e55bb5d407d9bb5e0ba477ee2522393dced6a009c485a0dbe181b0dd3dd55f156cbb7d46fe64042a8333240733d3359a01882190a752415989c2f2f8aee86aa54ff729314cc85043904210ed2e986a62c0eb6e2aab2a787a60a0d729a3de389fba723cd363928cf5566b388382709a7ac454f59b97be28f2ae601f54e822de2771f5f6bcfc408657a2a3751b009b2b4b4381f427bfd855f04ef774a7db0718e0e19428f0e865d0540adbbbe45f4dae584ab6389e25a49f011abb483103a6c1b36ca2e1546865c5537f2b35636556f84b2112e02f45e32297c3cbcc6890db2eca49ebfdf31326e6248e7fbc5292e3e9d803d36b41d7798d2475b793447055750d7e5dff6452205d371b94cec18d099c4debb1be610c24fae387da4c5a7261d818c9c1f910c9e0368414e331c59ba6ad4e9e43b18264e374f9b023d2ab572ca72a340e88606a32fe8a25d60d8f6934c29fd4cd2fb1ac6db40b0b1aedc3653f4f8cd529dba7c2aab1f22a6cfb5509c6f439c5ec23812fa2a84119bb4954603852b42559a4cb1ffc3eaf14861b533ea1b167f180386ffb8d2ef570ce854471db301f07c1917b923fc993f41a5d7cae6df3a5b1f4933485b9d9f42ad6c4682aa09355dafc4f9b1e71248e439bb58cae446b5f113d70ab13051aac02ca359f53bcf0008a6a984311830d27a5c00a336708968d828a2c8865098652a39022cd9e691eff759fe08d96009377aca5c1c9f820860afee120fe55b68e288cbcf06ac42c0459bdd8a4a5dd54080146b4bf2591e2faa4654817aeb7a56235aa6ff605a9dcb80d1f92af233e56ff2e1fc04c909a8a029c0be69a45c548cc6535a8de086512dda8fb89a1368a68ccbfb0830812e59f7c1e6376339f2c62859274da49382b68dc60f5423322e533cc2c753dc27c2795d2543d47ea4c1e6055c771077fca3ca946005f1bb284374cd0be3880bcb3dddc3df00b76eb3ca50bb92a34cb44015ae60dae18edc7f7c612af305f635a47d9c51a57aad098e6594663d2ef62f09eaf8c6cdc5508f96cec995dbc4f77e5353b7f0833827e91571b67745b1e1a67e53b80e87721ab7b14ee365d902e5f75811a4cc268b5ad3d06323501ad33f5d6c470b9d4f3acdf3688631a090e53c21f55c0bd77256c9e08ea88ffebcccd131c4f00bfac4490623b2bd59ecaf1b466c288e993b5bce18ad3879ccc7b75e5b305bce5109880f90a4aec65227fe7f9046a6b11015fc859baebad5a844b5499fdde7a74bdb746e05c87fc7f63e79a76a5a0e5ded8b77aa4a7c497055a2d7d4f48e919a8cfc00662c6a7547e1ceb7a9d7f97e9fffe491bcd8ecc5ff2eb58dcd9254421f22c681319e61daee656fee3972f214ec84e20d29a3b6ff6996e54c8eba8b7ba7f2c7a40b04f9bb7e297f578590bb62e3f60f45d5d8d78f4fa1b8ece8bd4bc57116b9e0ff414f92497e5fa68767c9616522f25996cb4df01cec72a8767f2c89f22ada29c6505485b7757c44549e8818509db19e5301c8b498e7ec70cd888627212b1be019005e1196d9526918cd7468357964c2fcebceba1345bf06d81d63361f108922a5bc1186a872f44281aa67dfddd6b1a96221a099fa3f44a0c0000000000004613449b3f2de29c91aceb6fdfea3de843aa668ea2967fdb603d8d2e54c04df4a6a7d2c24b72a8f9bbcf7a37b7bf548fb31b0ae08501e5007dac433108f71ab136e022de8f7cc20256fd6c2ee2334b762da152e0980d4e9a62d5f500"], &(0x7f0000000140)=0x1024) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x186, &(0x7f0000000200)={&(0x7f00000000c0)=@newlink={0x58, 0x10, 0xffffff1f, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x400, 0x10}, [@IFLA_LINKINFO={0x30, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x20, 0x2, [@IFLA_GRE_REMOTE={0x14, 0x7, @local}, @gre_common_policy=[@IFLA_GRE_IKEY={0x8}]]}}}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x58}}, 0x60000000) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) 07:09:34 executing program 1: 07:09:34 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xffffa888, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:34 executing program 1: 07:09:34 executing program 3: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_genetlink_get_family_id$tipc2(0x0) semget(0x1, 0x3, 0x0) semctl$SETVAL(0x0, 0x0, 0x10, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_open_procfs(0x0, 0x0) fstat(0xffffffffffffffff, 0x0) pipe(0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe(0x0) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x356, 0x20040080, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000300)) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r1) open(0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) 07:09:34 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xfffff000, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:34 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xffffff9e, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:34 executing program 1: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) fdatasync(0xffffffffffffffff) [ 826.285492] kauditd_printk_skb: 25 callbacks suppressed [ 826.285509] audit: type=1400 audit(1577171374.858:1105): avc: denied { create } for pid=20841 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 826.350484] team0: Device ip6gre1 is of different type [ 826.451036] audit: type=1400 audit(1577171374.858:1106): avc: denied { write } for pid=20841 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 07:09:35 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000280)={0x4, 0x9, 0x8, 0xffffffffffffffff, 0x0, &(0x7f0000000200)={0x0, 0x800, [], @ptr=0x4}}) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FIGETBSZ(r3, 0x2, &(0x7f00000002c0)) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) ioctl$RTC_PLL_GET(r1, 0x80207011, &(0x7f00000001c0)) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000000)={{{@in=@local, @in6=@local}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f0000000140)=0xe8) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) [ 826.501563] device nr0 entered promiscuous mode [ 826.501616] audit: type=1400 audit(1577171374.858:1107): avc: denied { read } for pid=20841 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 826.532848] audit: type=1400 audit(1577171374.888:1108): avc: denied { ioctl } for pid=20850 comm="syz-executor.4" path="socket:[81402]" dev="sockfs" ino=81402 ioctlcmd=0x8914 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 826.563441] audit: type=1400 audit(1577171375.008:1109): avc: denied { create } for pid=20850 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 826.629843] audit: type=1400 audit(1577171375.198:1110): avc: denied { map } for pid=20873 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 07:09:35 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:35 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pfnding_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) 07:09:35 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xffffffc3, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xffffff7f, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 826.735455] audit: type=1400 audit(1577171375.308:1111): avc: denied { map } for pid=20878 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 826.831307] audit: type=1400 audit(1577171375.398:1112): avc: denied { create } for pid=20885 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 07:09:35 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0xd) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000000)=@v2={0x2, @adiantum, 0x3, [], "07b90358a97a9094e9a0e41c0183851e"}) [ 826.878532] audit: type=1400 audit(1577171375.448:1113): avc: denied { ioctl } for pid=20885 comm="syz-executor.4" path="socket:[81455]" dev="sockfs" ino=81455 ioctlcmd=0x8914 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 07:09:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xffffff9e, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:35 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xfffffff0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 827.034935] audit: type=1400 audit(1577171375.608:1114): avc: denied { map } for pid=20900 comm="modprobe" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 827.048077] device nr0 entered promiscuous mode 07:09:35 executing program 3: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_genetlink_get_family_id$tipc2(0x0) semget(0x1, 0x3, 0x0) semctl$SETVAL(0x0, 0x0, 0x10, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_open_procfs(0x0, 0x0) fstat(0xffffffffffffffff, 0x0) pipe(0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe(0x0) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x356, 0x20040080, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000300)) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r1) open(0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) 07:09:35 executing program 2: write$selinux_validatetrans(0xffffffffffffffff, &(0x7f0000000540)=ANY=[@ANYBLOB="73797374656d5f756167655f650200635f743a0008000000000000000000000000000010401c8ce005b821c820ce2f87450c814611fa2148f880b5ecc6a95591959e49bda6364cc7b18f5248def504fac11bd4b70109b64594dbef1288b9aae76f8b7c1fdfeb236b5b219774728913ee79abafcd3a3d71f9bf9e94a8530da2419cd7f30d0dce0486b02ee2386aafbfa330b968f224cb5c79c815cad842fac50f26b9fca81134de094532ff83dcce8d3e04eb540fa2da97ef0c39ebb5de97b9f49614b59faf672a92d52ed3cb0d2145705069efa12073797374656d5f753a6f626a6563745f723a707463686f776e5f657865635f743a7330203030303030303030303030303030303030303031202f7573722f6c6962000000006570617468792f6d697373696f6e2d636f6e74726f6c2d350000000000000000000000000be40104c7a677055b11bc22788d157f8246d7aa7475bed19db1184fb009aff72ecd57c92d47358b42446e3a1b8424fd76647a1bb411315d59772f32ec9a548fa06577a2e82e6e22805e45beb83e68f0e0928e8be229e1a6632d991c01e7a412c49fb2ed186a6ec4ecc65e2fd2bf56997041634a470443014df824c1eebe18f61c1599b7d1d29c793ce573fd36c472b38549b53313337d6b8b9d7c"], 0x13e) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$inet6_dccp_int(r0, 0x21, 0x5, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x400000, 0x0) ioctl$SIOCRSACCEPT(r1, 0x89e3) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x1000026a) 07:09:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xffffffc3, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 827.282102] net_ratelimit: 6 callbacks suppressed [ 827.282111] protocol 88fb is buggy, dev hsr_slave_0 [ 827.292177] protocol 88fb is buggy, dev hsr_slave_1 [ 827.427223] validate_nla: 5 callbacks suppressed [ 827.427234] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f00000000c0)={0x6}, 0x10) recvfrom$inet(r0, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00515) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup(r3) readv(r4, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/74, 0x4a}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5) shutdown(r2, 0x0) 07:09:36 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r3, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r4 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r4, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r4, 0x0, 0x80001d00c0d0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r5, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:36 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/210) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r1, &(0x7f0000002980)=[{&(0x7f0000000100)="e9b60577be8506a0b1b5dd948d042fc3d7d21848612e5b4ad66440352d7aa00645c7600154f942080000009b91429be98fd23a7a77b4a5e91eabf94e3e131ff51ce86ee2101f06ab035ab9d46eb0000000"}, {&(0x7f0000000200)="b4da8a0e6ac62430a1794a01435b27b612a5228fb382e5baf7ec61d2388c150cddc63f683aa77971eda652820b92c76a0ee5194108d0988f1d59b8aee53cfb66a18004dc862c6874f04851e3b97b5613bb6ad4bf06233afcd0054f5a22487e2cee457a1d45c3accf675a84409ccfab59732b1b6328b3cb250f34dabecd5ed3615163695273ad03aa5e54c1b1eb96d3b16375c5885689d91f0fdcb5f7619f8f93b65d388d676233e8e56c651c20c350923c39cd4da334d215e1dba1014dfdacbb772ebdf839d3b10a23b0382ab3345e1a2a6c76ac6e4fbd"}, {&(0x7f0000000300)="f08e01c271e7682b319b70531d3582155ba485593988f7fcb1efc9505ea8a466ad785159758940709749d3b9d26d056ad7f2b392a6c1fd4d6b013428c80bee319204bc19795bb807d9cd1dc853e7646c739b17ef0e1a205f998be12b47921ea468a452d96a535c889b0df5733bd4334342c83d76e579d200d1baac939e9599198fe43a4e3d8acbd256cf81c2f8f42061c083738750f0df87026612e2028cfd99f5de8cdd11118e7a86d27f84918c17e5ffe738b76e649320cf05fc7ed1c9a4c571e2ff05215872813a8a7b86aec75ea5da388b33c5f9c7f46c"}, {&(0x7f0000000400)="b19ec74cef24ef5a2937ce085a33aa2551d56fbcfa2c66e98f6497955413e6d31d2b7aa5f2f3508863fc61d0d4f0122619a2358b49708f78f4296b7cf844883ae6a79c91a83a66cc7d53bc375b933c3eccd2cbd5b7962f57d1340e471149ffc94e5f72342eafc4cbda07f058984265745df5858f38d7cb1d1bce54fad604761864e42aff55026e526a85cec648b836da7a85541c967bc347f553c13e98ba14a076950e08b1f2c6704e9a545d0f3c81d0c33f0fe31ad33f61054f2fee"}, {&(0x7f00000004c0)="667cefe18134f80f88932db61ef03d0d8c54ef324f1b0070544820f6a8bb8fa21713afe6cf94e424331e10e498fd563264f3c112f5a82b5d5519dcc2464140aeb5827eccadfffd810a60b43e4211b218cd8b"}, {&(0x7f0000002600)="8d8cf39ab49c63e96c82e6754b610a4a7ac78a3a4ae1c701e8c7c0e97e7c803c57dd8a2339c77126582b79ec45297eea82ab101f0cab86a40a60a7bb22cb1301aec9fdb65eba8c8985ffc70e"}, {&(0x7f0000002680)="6dd60594dc134862cb3f4a1cb1d37110aa5fe2e323e60574660407912203dacf751e399a3d0483fa86964757934de6fa85a4db5ca7da61827fb5110895831fec0194e8d539d035c359886b74e60d7b00e5fa64856c314be8c05e436449dcb270a1e7d7ecb9bdbd5609bb7fd1a54ee05c541d4be81da2b48c50a9d168541f72939af46ddadba8a4a891b5b003ddec47f22897d15b0aadf010b652a9e9d0fa8cdba1dae27a9bdfe5af1915c203a7aa"}, {&(0x7f0000002740)="307284d1fb3f3b41a824941b5988b1ee2a1a6a05ac4217eabbeb06770162460932b27ff99edd029707e44692b32241f21f56e3ab7cac49abb1d3b127b3a3ce59230eded518d49ff3f92a1c585ae91803259d2326ee2cc3e7bc2f2518e3c369a89a3dee2340abdeb6df251e3adc4e16039eaf6a471f47d54956172dabc5386619e6adb28f667000f2cb1e813e3a"}, {&(0x7f0000002800)="c00aa7d9fb9798dd12f14fd4674ff4a498c440a76ddf7cd4a38734c2467faf2e95bf30607422a38103c3b8c23f6141a979b2f4078812b82d0d3297368a78e0b2578b9e52a2717ad408e0ace3da738e2a16b7b4cf2e69e2414cc9507973fb4fa31b5e42a9a4014e1ff2d37aac0f096ff6741a447fea0fd31122672980968b24148540fb18ffb25e2b7eb5b1e80a8cd8ccef9a6eb226a2ebd2795e021a27e832daed57e6", 0x36e}, {&(0x7f00000028c0)="76ffed39483953c518ea1e7dacfd883ef28aec5f8934a68051ce56a5193e895716b1a511f8a7705335a5901938d7c351152f69a2010000000de46f24773805086ee128d3a40f916c2d74cf0373d44323e9c4f7cdbe3bec140a5272daa3094eebc1059388201edcda00a38215bccaa92da053f0cfabbc000000"}], 0x2) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x20) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f00000001c0)='#^}em0*[\x00', 0xffffffffffffffff}, 0x30) rt_tgsigqueueinfo(r2, r3, 0xb, &(0x7f0000000580)={0x40, 0x4, 0x200}) 07:09:36 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xfffffffe, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:36 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xfffffff0, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:36 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x1}], 0x2) [ 827.621144] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:36 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xfffffffe, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:36 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000000)='\t', 0x1}], 0x2) 07:09:36 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="c714ec1b8d7c3f2701bc32bc3ba2161a928db7ebfb0f152e16abcf55b7cb88a0e291899511b44f7377e10194c6fae6075f0cb0808a3e84b28c851d6e3bfa42111ba93b4386fdd30d156fe67737a40b5f30044c3baf199d12ec45dcee07f7a7d11cecf89c7b408cd3df0ae440b153b96fc53e691ec5f86145526d42affe1f133a3b330207f32d40ebe9b2444e7bdc9be63406188d3e6e5238d8607e6c920fafb40c591f4eb25265a40a3e17325b3203dbf311293e96e2ce5bad2c5bb68210df16b03d866226d5609ac69caa7f2bb65276188d"}, {&(0x7f0000000280)="fb22ef245f9e58c9fd9aa81cf0f94bc77c5b02b47eef43a8d7b6d28968a6a00d1e95400c336b28b862a2253bd2f25a12b2528a987612b2ef66efada24974ddfc96fb866bff2501330d9909f664228db227e182df051da1f1289d9234bc7e638de112dafe2d46274a7d0ebf1fdb5a41af78ba6a6661adf541e6fa01efe87a9bbb3c75"}, {&(0x7f00000001c0)="a9710a83e5d3ee34f052beb355f1f874517a570d03e2b05ff0bb3e15b32f50f0a3fc29519633ccbe0b888b87c7358822366c3ad95ba3e73f6f042c2501e56c7b6eabd4e14c837997073d754a0146a06b"}], 0x10000000000000d0) [ 827.822357] device nr0 entered promiscuous mode [ 827.839718] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:36 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0xffffffff, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:36 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0xffffffff, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:36 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x4031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x3, 0x8, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 828.158275] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:37 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r3, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r4 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r4, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r4, 0x0, 0x80001d00c0d0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r5, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:37 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x120, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f0000000140)={0x9f0000, 0x0, 0x6, r0, 0x0, &(0x7f00000002c0)={0x990af5, 0x8, [], @value=0x7}}) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x8, 0x0) ioctl$int_out(r2, 0x5460, &(0x7f0000000080)) mmap$snddsp_status(&(0x7f0000ffb000/0x4000)=nil, 0x1000, 0x2000004, 0x13, r0, 0x82000000) getpeername$inet(r2, &(0x7f0000000200), &(0x7f0000000280)=0x10) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selin/commit_pendi\\\x00_bools\x00', 0x1, 0x0) writev(r3, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 07:09:37 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:37 executing program 1: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:37 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:37 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x4031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x3, 0x8, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 828.638321] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:37 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x2}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 828.681418] device nr0 entered promiscuous mode [ 828.807567] device nr0 entered promiscuous mode 07:09:37 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x2, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:37 executing program 2: openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) close(r0) io_setup(0x3, &(0x7f00000001c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x30bc, r0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2}]) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fb0\x00', 0x101081, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) close(r3) io_setup(0x3, &(0x7f00000001c0)=0x0) io_submit(r4, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r3, 0x0, 0x12f}]) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000240)='./file0\x00', 0x0, 0x400) io_cancel(r4, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xc, 0x1f, r5, &(0x7f0000000040)="bd565d9ccafdd27d54953f84881cf1ce8785302cacea8500d73039b0d19d56cc557aa4131ed5d1b32d49967281870da7f59a419be09d39c84b664401afb0beee04ca95f6c0c29c6bbb4186a67c7cf897178670cd89f56016e4bd67800bdadfe82c1a548dba011cf8a6d66e3ff4dfe03b37457921340a9b002b50efd0ee65653d64eb004a65092927890ca84be90c3fea52990308f4bc21c77f67a6a2a179589466d55693fae150e7bfb1db833939b535d8b8729d38d295ece482b917d58980e9497b7362a180966482b57e4f4551db77dce403d14dcbbe0523913d9770cd711e0584cc922de08f88625da0b5e8a47e", 0xef, 0x80000000, 0x0, 0x1, r2}, &(0x7f00000001c0)) [ 828.893053] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 828.962110] protocol 88fb is buggy, dev hsr_slave_0 [ 828.967289] protocol 88fb is buggy, dev hsr_slave_1 07:09:37 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) socket$netlink(0x10, 0x3, 0x5) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x1) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x2}}, 0x20) accept4$ax25(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x81000) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @empty}, {0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xa}}, r2}}, 0x48) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f00000000c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000080)={0xffffffffffffffff}, 0x4, {0xa, 0x4e21, 0x81, @mcast2}, r2}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x11, 0x10, 0xfa00, {&(0x7f0000000040), r3}}, 0x18) 07:09:37 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:37 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x3, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 829.299662] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 829.362091] protocol 88fb is buggy, dev hsr_slave_0 [ 829.367238] protocol 88fb is buggy, dev hsr_slave_1 07:09:38 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r3, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r4 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r4, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r4, 0x0, 0x80001d00c0d0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r5, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:38 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/\xe4ev/vsock\x00', 0x105000, 0x0) ioctl$SNDCTL_DSP_SETDUPLEX(r0, 0x5016, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r1, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) setsockopt$inet_tcp_buf(r0, 0x6, 0xe, &(0x7f0000000280)="005728977a55c21a19466b076cf0492e9e811f39afe692326f9e4c873e7e20e465bf259c90ca06c3413e5846d29ad0932262fc8ce083435db18d9c02630de93da6e57111dd3f3e0801618f7ad21966c852e88a7fd18cfd401829e0b300c03b190c9bc76d515ab79cd6d1dd7570a8a09cffede3286503dad1209d3111c989afc18a1bbe6540ff58d01915da68c7c32e0cff84524863db9b07e3acf74a1b65f753dc87556bd59bb8d19b95c54b512aa8d41660b7ccd967ba9099d69df03c0569d7a7daba86511ae1decb1dd56e3d62dd7b5c", 0xd1) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VT_ACTIVATE(r2, 0x5606, 0x0) 07:09:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x4}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 829.790879] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:38 executing program 1: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:38 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x4031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x3, 0x8, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) 07:09:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x5}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:38 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x4, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 829.956099] device nr0 entered promiscuous mode 07:09:38 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x80, 0x0) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x5, 0x8, 0x3}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r1, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x80, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000280)={{0x2, 0x4e20, @broadcast}, {0x1, @random="2fe82ab379f6"}, 0x2, {0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x15}}, 'batadv0\x00'}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={r5}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f00000003c0)={r5, 0x5}, 0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000000c0)=ANY=[@ANYRES32=r5, @ANYBLOB="7f42272861000600354bea3acf209602"], 0x14) [ 829.985552] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:38 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) sync_file_range(0xffffffffffffffff, 0xd, 0x1, 0x4) 07:09:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x6}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 830.286981] device nr0 entered promiscuous mode 07:09:38 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x5, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 830.370516] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:39 executing program 2: writev(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f0000000100)='7', 0x1}, {&(0x7f0000000240)='\t', 0x7f01}], 0x2) 07:09:39 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(0x0, 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x7}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:39 executing program 2 (fault-call:1 fault-nth:0): r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 831.173352] device nr0 entered promiscuous mode 07:09:39 executing program 1: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:39 executing program 3 (fault-call:22 fault-nth:0): ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:39 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x6, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:39 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:09:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0xa}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:39 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(0x0, 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:39 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x2}], 0x1, 0x8001) 07:09:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0xc}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 831.391503] device nr0 entered promiscuous mode 07:09:40 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x7, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 831.414295] FAULT_INJECTION: forcing a failure. [ 831.414295] name failslab, interval 1, probability 0, space 0, times 0 [ 831.415813] device nr0 entered promiscuous mode [ 831.442137] protocol 88fb is buggy, dev hsr_slave_0 [ 831.447343] protocol 88fb is buggy, dev hsr_slave_1 07:09:40 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x8}], 0x1, 0x8001) [ 831.556161] CPU: 0 PID: 21107 Comm: syz-executor.3 Not tainted 4.19.91-syzkaller #0 [ 831.557041] device nr0 entered promiscuous mode [ 831.564014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 831.564022] Call Trace: [ 831.564049] dump_stack+0x197/0x210 [ 831.564071] should_fail.cold+0xa/0x1b [ 831.564091] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 831.564108] ? lock_downgrade+0x880/0x880 [ 831.564135] __should_failslab+0x121/0x190 [ 831.564153] should_failslab+0x9/0x14 [ 831.564167] kmem_cache_alloc_trace+0x2cc/0x760 [ 831.564193] alloc_pipe_info+0xbc/0x430 [ 831.564212] splice_direct_to_actor+0x76c/0x970 [ 831.619012] ? __inode_security_revalidate+0xda/0x120 [ 831.624234] ? generic_pipe_buf_nosteal+0x10/0x10 [ 831.629104] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 831.634144] ? selinux_file_permission+0x92/0x550 [ 831.639010] ? do_splice_to+0x180/0x180 [ 831.643032] ? security_file_permission+0x89/0x230 [ 831.647989] ? rw_verify_area+0x118/0x360 [ 831.652169] do_splice_direct+0x1da/0x2a0 07:09:40 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x300}], 0x1, 0x8001) [ 831.656349] ? splice_direct_to_actor+0x970/0x970 [ 831.661237] do_sendfile+0x597/0xce0 [ 831.664987] ? do_compat_pwritev64+0x1c0/0x1c0 [ 831.669595] ? fput+0x128/0x1a0 [ 831.672905] __x64_sys_sendfile64+0x1dd/0x220 [ 831.677424] ? __ia32_sys_sendfile+0x230/0x230 [ 831.682022] ? do_syscall_64+0x26/0x620 [ 831.686016] ? lockdep_hardirqs_on+0x415/0x5d0 [ 831.690617] ? trace_hardirqs_on+0x67/0x220 [ 831.694965] do_syscall_64+0xfd/0x620 [ 831.698790] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 831.703995] RIP: 0033:0x45a919 [ 831.707196] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 831.726119] RSP: 002b:00007fc352881c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 831.733864] RAX: ffffffffffffffda RBX: 00007fc352881c90 RCX: 000000000045a919 [ 831.741162] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000005 [ 831.748573] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 07:09:40 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x200008c1}], 0x1, 0x8001) [ 831.755869] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007fc3528826d4 [ 831.763167] R13: 00000000004c925e R14: 00000000004e0f88 R15: 000000000000000a [ 831.842148] protocol 88fb is buggy, dev hsr_slave_0 [ 831.847286] protocol 88fb is buggy, dev hsr_slave_1 07:09:40 executing program 1: socketpair(0x10, 0x0, 0x40, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000100)="06bb9f2e59e817d80aa9fc8842f0daa997a89285e47956cf83496ab379ff5969529fcfe0166e4d334ab8ae3a5b759024d02ab0aff21fde606dfe05b6947cce42d55642dbf863c666fdf9fec9567816b17dc03c210a587ff3023ea99015227db8f17fd44f5ed623c5a965b4280663472a61ef4ef96e2e510b3a96d3f5f2d6a91c36b5a629d683fa12258b377aa1032a5a137049177e4eb7dd3bb01bac5a534410d5472c82f6c64a7ad8133132347132e6aa0ab76a0ca40ddaba7d333e678a3214a131be582526f93b2cf789673c4cfc", 0xcf}, {&(0x7f0000000040)="9767880c9d92ae56010c0d9806d54afd61c10c0a9db484fcac02bc1d32e64f1fec9605", 0x23}, {&(0x7f0000000200)="d6b2d836f4876b04c5e805f8f16a8e74daadcd3b033880a9b6d3f1d1d85c495fa02d8be2b6b429023e24a9a06d28be68e78b32f93292dd874664ac780de347f9b3498e0b5bfb667dd05887b60eb2efee8265c20808eca647eda4381d63391bfb862fcebf1df37384c5284089ea288faa11cb54550eeb36cf480e45597f6e713fcc92755798fa3d38007e9cca947ae8ecac2dba917f0113ca8d293be412ae662fbaaeb7c9025fb9fed58e65681246eb3346a880e20786193f32536de0270d860320c3a6a958915c630bd64d0c508536a510c1d67b8668fbfdb9e81c9b8359f4a94c006322d14d347d2e60cdb34a0143cb13f5ca6ca8d257e8", 0xf8}, {&(0x7f0000000300)="29d1e33ee320e3bf0455c4fc7771ab8bb21fe00a07a01cda776f95e3b59467f0", 0x20}, {&(0x7f0000000340)="5bf5eef5f6eb385a11d4cd8b2e7801a3b3e910e7bf4ad9266baa366603abbe036e46a1d3f8219c70622182029e6f08c07c1771bab48bc16cb3084e1422dcd3b8ae74a38c21803d5bbcad028cd392057a1125a582b711b0f79c0a2d57ae240240f813f37c7fcd546855886e18ee5bc7cca2bbf77accd0cd291e0d62b12d8fea73da", 0x81}, {&(0x7f0000000400)="e34e0d4e43e821cf043448d8146329b9770d42191137bf11b06fc19139ed72ef399505853e0abf06a2ccb64bd23069d5ebad0da0bbbe5359d0bc3aa290713ce3b6c8512f8531b25f12f31e7e6b1935837b0426fba748ee77784c0102df7f7c2ea125bfede22c30319217f01b5d17f65115f37687aba682291598572cbbc585d45b4101a2aa84e653c0167f41bd87ed785c333834f8d0f765f3b6849e36623f12f4cce3e0fcb5a798280fb65bb7f3424ed5", 0xb1}], 0x6, &(0x7f0000000540)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x1f}}], 0x18}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0}, 0x68) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x0, 0x400002172, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0xe000, 0x3, &(0x7f0000ff2000/0xe000)=nil) mprotect(&(0x7f0000ff2000/0x4000)=nil, 0x4000, 0x1000001) 07:09:40 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0xe}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:40 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x8, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:40 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x7ffff000}], 0x1, 0x8001) 07:09:40 executing program 3 (fault-call:22 fault-nth:1): ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:41 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(0x0, 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:41 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x2, 0x8001) 07:09:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x10}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 832.515529] device nr0 entered promiscuous mode [ 832.540005] device nr0 entered promiscuous mode 07:09:41 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000440)=0x1, 0xffe6) sendto$inet(r1, 0x0, 0x0, 0x20000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) getsockopt$inet_sctp_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, &(0x7f00000001c0)={0x1, [0x0]}, &(0x7f00000003c0)=0x6) ioctl$MON_IOCQ_URB_LEN(0xffffffffffffffff, 0x9201) socket(0x10, 0x80002, 0x0) socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000000), 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000680)={0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @remote, 0x83}}}}, 0x0) sched_setscheduler(0x0, 0x5, 0x0) getpgid(0x0) sendto$inet(r1, &(0x7f0000000140)="7c0d111317b1ff8ec8f29f81319ec5b10d0d000000efd9448dbef1ffb4e3a6af87131512da528f6235fe35d3053b5cb4877c1b89bbf83f6d749d5b00679601a3abdc204cf1ad797252bb0c7b43e3e9763221cb2c8d76f824f4bea338f53aa75703f465e50e434e2193900c39ab79d37cc0ce7a", 0x2fdf442dff3bb63, 0x401c005, 0x0, 0xffffffffffffff36) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000280)={0x879a, 0x1, 0x4, 0x800, 0x2, {0x0, 0x2710}, {0x5, 0x1, 0x8, 0x2, 0x6d, 0x3f, "29550dc8"}, 0x4, 0x4, @planes=&(0x7f00000000c0)={0x7f, 0xd5a2, @userptr=0xffffffffffff8000, 0x101}, 0x8, 0x0, r3}) ioctl$RTC_WKALM_RD(r4, 0x80287010, &(0x7f0000000300)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10811, r0, 0x0) 07:09:41 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x8, 0x8001) [ 832.598772] FAULT_INJECTION: forcing a failure. [ 832.598772] name failslab, interval 1, probability 0, space 0, times 0 07:09:41 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x9, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 832.651018] validate_nla: 4 callbacks suppressed [ 832.651030] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 832.755480] CPU: 0 PID: 21141 Comm: syz-executor.3 Not tainted 4.19.91-syzkaller #0 [ 832.763359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 832.772732] Call Trace: [ 832.775338] dump_stack+0x197/0x210 [ 832.778991] should_fail.cold+0xa/0x1b [ 832.782943] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 832.788068] ? lock_downgrade+0x880/0x880 [ 832.792249] __should_failslab+0x121/0x190 [ 832.796505] should_failslab+0x9/0x14 [ 832.800328] __kmalloc+0x2e2/0x750 [ 832.803888] ? alloc_pipe_info+0x106/0x430 [ 832.808139] ? alloc_pipe_info+0x19c/0x430 [ 832.812410] alloc_pipe_info+0x19c/0x430 [ 832.816493] splice_direct_to_actor+0x76c/0x970 [ 832.821176] ? __inode_security_revalidate+0xda/0x120 [ 832.826483] ? generic_pipe_buf_nosteal+0x10/0x10 [ 832.831341] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 832.836372] ? selinux_file_permission+0x92/0x550 [ 832.841229] ? do_splice_to+0x180/0x180 [ 832.845216] ? security_file_permission+0x89/0x230 [ 832.850159] ? rw_verify_area+0x118/0x360 [ 832.854332] do_splice_direct+0x1da/0x2a0 [ 832.858497] ? splice_direct_to_actor+0x970/0x970 [ 832.863364] ? security_file_permission+0x89/0x230 [ 832.868316] ? rw_verify_area+0x118/0x360 [ 832.872481] do_sendfile+0x597/0xce0 [ 832.876221] ? do_compat_pwritev64+0x1c0/0x1c0 [ 832.880818] ? fput+0x128/0x1a0 [ 832.884122] __x64_sys_sendfile64+0x1dd/0x220 [ 832.888635] ? __ia32_sys_sendfile+0x230/0x230 [ 832.893230] ? do_syscall_64+0x26/0x620 [ 832.897217] ? lockdep_hardirqs_on+0x415/0x5d0 [ 832.901817] ? trace_hardirqs_on+0x67/0x220 [ 832.906160] do_syscall_64+0xfd/0x620 [ 832.910065] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 832.915261] RIP: 0033:0x45a919 [ 832.918467] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 832.937381] RSP: 002b:00007fc3528c3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 832.945129] RAX: ffffffffffffffda RBX: 00007fc3528c3c90 RCX: 000000000045a919 07:09:41 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x300, 0x8001) 07:09:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x48}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 832.952434] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000005 [ 832.959712] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 832.966994] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007fc3528c46d4 [ 832.974273] R13: 00000000004c925e R14: 00000000004e0f88 R15: 000000000000000a [ 833.036330] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 833.070485] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 07:09:41 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x200008c1, 0x8001) [ 833.122120] protocol 88fb is buggy, dev hsr_slave_0 [ 833.127241] protocol 88fb is buggy, dev hsr_slave_1 07:09:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x4c}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:41 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x7ffff000, 0x8001) [ 833.239441] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 833.319260] kauditd_printk_skb: 23 callbacks suppressed [ 833.319280] audit: type=1400 audit(1577171381.888:1138): avc: denied { map } for pid=21159 comm="syz-executor.1" path="socket:[83004]" dev="sockfs" ino=83004 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=1 [ 833.522097] protocol 88fb is buggy, dev hsr_slave_0 [ 833.527247] protocol 88fb is buggy, dev hsr_slave_1 07:09:42 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x71) 07:09:42 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x60}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:42 executing program 3 (fault-call:22 fault-nth:2): ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:42 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xa, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:42 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) clock_gettime(0x0, &(0x7f00000003c0)={0x0, 0x0}) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000400)={0x9, 0xb, 0x4, 0xe5609e541d982eb, 0x2, {r2, r3/1000+30000}, {0x3, 0x1, 0x4, 0x77, 0x8, 0xf4, "d246ee57"}, 0x7fffffff, 0x6d256b90450149f6, @fd=r4, 0x6, 0x0, r1}) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000000480)=0x4000, 0x4) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES32=r6, @ANYBLOB="19000000000000001c0012000c00010062726964676500000c0102000800050001000000"], 0x3}}, 0x0) r7 = socket(0x10, 0x803, 0x0) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000008700)={0x0, 0x0}) recvmmsg(r8, &(0x7f0000008480)=[{{&(0x7f0000000500)=@pptp, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000580)=""/245, 0xf5}, {&(0x7f0000000680)=""/78, 0x4e}, {&(0x7f0000000700)=""/162, 0xa2}, {&(0x7f00000007c0)=""/232, 0xe8}], 0x4, &(0x7f0000000900)=""/177, 0xb1}, 0x1}, {{0x0, 0x0, &(0x7f0000001b00)=[{&(0x7f00000009c0)=""/32, 0x20}, {&(0x7f0000000a00)=""/212, 0xd4}, {&(0x7f0000000b00)=""/4096, 0x1000}], 0x3, &(0x7f0000001b40)=""/192, 0xc0}, 0x3}, {{&(0x7f0000001c00)=@ax25={{}, [@null, @netrom, @default, @rose, @null, @rose, @rose, @netrom]}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001c80)=""/169, 0xa9}, {&(0x7f0000001d40)=""/204, 0xcc}], 0x2, &(0x7f0000001e80)}, 0x2}, {{&(0x7f0000001ec0)=@can, 0x80, &(0x7f0000003440)=[{&(0x7f0000001f40)=""/17, 0x11}, {&(0x7f0000001f80)=""/137, 0x89}, {&(0x7f0000002040)=""/4096, 0x1000}, {&(0x7f0000003040)=""/55, 0x37}, {&(0x7f0000003080)=""/150, 0x96}, {&(0x7f0000003140)=""/205, 0xcd}, {&(0x7f0000003240)=""/91, 0x5b}, {&(0x7f00000032c0)=""/122, 0x7a}, {&(0x7f0000003340)=""/215, 0xd7}], 0x9, &(0x7f0000003500)=""/153, 0x99}, 0x842}, {{0x0, 0x0, &(0x7f00000045c0)=[{&(0x7f00000035c0)=""/4096, 0x1000}], 0x1, &(0x7f0000004600)=""/4096, 0x1000}, 0x9}, {{&(0x7f0000005600)=@hci, 0x80, &(0x7f0000006800)=[{&(0x7f0000005680)=""/228, 0xe4}, {&(0x7f0000005780)=""/85, 0x55}, {&(0x7f0000005800)=""/4096, 0x1000}], 0x3, &(0x7f0000006840)=""/78, 0x4e}}, {{&(0x7f00000068c0)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000006d40)=[{&(0x7f0000006940)=""/241, 0xf1}, {&(0x7f0000006a40)=""/219, 0xdb}, {&(0x7f0000006b40)=""/190, 0xbe}, {&(0x7f0000006c00)=""/59, 0x3b}, {&(0x7f0000006c40)=""/228, 0xe4}], 0x5, &(0x7f0000006dc0)=""/228, 0xe4}, 0x1ff}, {{&(0x7f0000006ec0)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000007f40)=[{&(0x7f0000006f40)=""/4096, 0x1000}], 0x1, &(0x7f0000007f80)=""/219, 0xdb}, 0x9}, {{&(0x7f0000008080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000008140)=[{&(0x7f0000008100)=""/7, 0x7}], 0x1, &(0x7f0000008180)=""/217, 0xd9}, 0xffffffff}, {{0x0, 0x0, &(0x7f0000008340)=[{&(0x7f0000008280)=""/166, 0xa6}], 0x1, &(0x7f0000008380)=""/196, 0xc4}, 0x800}], 0xa, 0x40000000, &(0x7f0000008740)={r9, r10+30000000}) r11 = socket(0x10, 0x803, 0x0) r12 = socket(0x1, 0x803, 0x0) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f0000000380)=0xfbfd, 0x4) getsockname$packet(r12, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r13}, [@IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x2c}}, 0x0) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r13}, [@IFA_FLAGS={0x8, 0x9, 0x3778bcbaae6b531f}, @IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x34}}, 0x0) r14 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r14, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r15 = socket$nl_generic(0x10, 0x3, 0x10) r16 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000300)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r15, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r16, 0x1}, 0x14}}, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r14, 0x80184132, &(0x7f00000004c0)) sendmsg$SEG6_CMD_SETHMAC(r14, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x42002}, 0xc, &(0x7f00000000c0)={&(0x7f0000000280)={0x64, r16, 0x2, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x4}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x3, 0x92f]}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x80, 0xff, 0x8, 0x1f, 0x1f]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x7ff}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x19}]}, 0x64}, 0x1, 0x0, 0x0, 0x296ff3f7bfdb8b8}, 0x4000) [ 833.706306] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 833.750689] device nr0 entered promiscuous mode [ 833.750821] audit: type=1400 audit(1577171382.318:1139): avc: denied { create } for pid=21195 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 07:09:42 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x68}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:42 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8002) [ 833.806566] device nr0 entered promiscuous mode 07:09:42 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000100)=0xfffffff7, 0x4) r1 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x7bf}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x20) getpgid(r2) ioctl$PERF_EVENT_IOC_ID(r1, 0x40082406, &(0x7f0000000080)) [ 833.849788] audit: type=1400 audit(1577171382.318:1140): avc: denied { write } for pid=21195 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 833.922614] protocol 88fb is buggy, dev hsr_slave_0 [ 833.928292] protocol 88fb is buggy, dev hsr_slave_1 [ 833.945424] FAULT_INJECTION: forcing a failure. [ 833.945424] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 833.964217] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 833.984257] audit: type=1400 audit(1577171382.318:1141): avc: denied { read } for pid=21195 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 834.008846] CPU: 0 PID: 21200 Comm: syz-executor.3 Not tainted 4.19.91-syzkaller #0 [ 834.016667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 834.026018] Call Trace: [ 834.028607] dump_stack+0x197/0x210 [ 834.032241] should_fail.cold+0xa/0x1b [ 834.036128] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 834.041233] ? __might_sleep+0x95/0x190 [ 834.045222] __alloc_pages_nodemask+0x1ee/0x750 [ 834.049885] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 834.054635] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 834.059391] ? __alloc_pages_slowpath+0x2870/0x2870 [ 834.064401] ? trace_hardirqs_on_caller+0x6a/0x220 [ 834.069332] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 834.074090] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 834.079641] alloc_pages_current+0x107/0x210 [ 834.084067] __page_cache_alloc+0x2bd/0x450 [ 834.088391] ? __do_page_cache_readahead+0x1c3/0x720 [ 834.093518] __do_page_cache_readahead+0x1ce/0x720 [ 834.098455] ? read_pages+0x610/0x610 [ 834.102248] ? page_cache_sync_readahead+0x1d3/0x520 [ 834.107359] ondemand_readahead+0x543/0xcd0 [ 834.111830] page_cache_sync_readahead+0x281/0x520 [ 834.116766] generic_file_read_iter+0x16b6/0x2b90 [ 834.121612] ? save_stack+0xa9/0xd0 [ 834.125235] ? kasan_kmalloc+0xce/0xf0 [ 834.129116] ? __kmalloc+0x15d/0x750 [ 834.132830] ? do_sendfile+0x597/0xce0 [ 834.136719] ? filemap_range_has_page+0x380/0x380 [ 834.141556] ? trace_hardirqs_on_caller+0x6a/0x220 [ 834.146489] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 834.151242] ? percpu_ref_put_many+0x94/0x190 [ 834.155764] ext4_file_read_iter+0x180/0x3c0 [ 834.160175] generic_file_splice_read+0x42c/0x750 [ 834.165036] ? add_to_pipe+0x350/0x350 [ 834.168918] ? __inode_security_revalidate+0xda/0x120 [ 834.174124] ? security_file_permission+0x89/0x230 [ 834.179049] ? rw_verify_area+0x118/0x360 [ 834.183213] ? add_to_pipe+0x350/0x350 [ 834.187097] do_splice_to+0x127/0x180 [ 834.190908] splice_direct_to_actor+0x2d3/0x970 [ 834.195576] ? generic_pipe_buf_nosteal+0x10/0x10 [ 834.200417] ? do_splice_to+0x180/0x180 [ 834.204397] ? security_file_permission+0x89/0x230 [ 834.209324] ? rw_verify_area+0x118/0x360 [ 834.213471] do_splice_direct+0x1da/0x2a0 [ 834.217615] ? splice_direct_to_actor+0x970/0x970 [ 834.222454] ? security_file_permission+0x89/0x230 [ 834.227390] ? rw_verify_area+0x118/0x360 [ 834.231536] do_sendfile+0x597/0xce0 [ 834.235256] ? do_compat_pwritev64+0x1c0/0x1c0 [ 834.239848] __x64_sys_sendfile64+0x1dd/0x220 [ 834.244350] ? __ia32_sys_sendfile+0x230/0x230 [ 834.248923] ? do_syscall_64+0x26/0x620 [ 834.252894] ? lockdep_hardirqs_on+0x415/0x5d0 [ 834.257473] ? trace_hardirqs_on+0x67/0x220 [ 834.261811] do_syscall_64+0xfd/0x620 [ 834.265626] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 834.270810] RIP: 0033:0x45a919 [ 834.274001] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 834.292894] RSP: 002b:00007fc3528c3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 834.300591] RAX: ffffffffffffffda RBX: 00007fc3528c3c90 RCX: 000000000045a919 [ 834.307864] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000005 [ 834.315122] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 834.322385] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007fc3528c46d4 07:09:42 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8008) 07:09:42 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xc, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 834.329657] R13: 00000000004c925e R14: 00000000004e0f88 R15: 000000000000000a 07:09:43 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000000)="d30000000077f8574c00000000", 0xd}], 0x100000bd, 0x8001) 07:09:43 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:43 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000100)=0xfffffff7, 0x4) r1 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x7bf}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x20) getpgid(r2) ioctl$PERF_EVENT_IOC_ID(r1, 0x40082406, &(0x7f0000000080)) 07:09:43 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x6c}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:43 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:43 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x60401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) 07:09:43 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xe, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 834.953405] device nr0 entered promiscuous mode [ 834.964991] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:43 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x100}, &(0x7f0000000040)=0x8) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={r2}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f00000003c0)={r2, 0x5}, 0x8) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={r6}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r5, 0x84, 0x19, &(0x7f00000003c0)={r6, 0x5}, 0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000080)={0x0, 0x100, 0x1, 0x1, 0x1000, 0x7fffffff, 0x6519, 0x2, r6}, 0x20) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000400)=ANY=[@ANYBLOB="01000000732f28ace211080bd31d16af4be4a045cf1a244e64aebdd64e1116b54ef34064ec7b95000045c44046909ba3318bba5f093580744c51c39f6b7be89f5ec6e09b37d7afdf2194d75a1ca878ff3e25f588c49410bc8fde82d4e1cdc9b56b2d6431a23d1aa3d69897b2816859c9a95aee1270f1aa534a776c219806d4a9f3acb2fe2dcecad95a564cedc8e845ae7810ef54a84f51735e59970015be6f6153b1ea331971ea013d19a2d2a56d5c512d0529ff1c9de130c59f631f2f4a9ee873f4f723c2d018b7d7d5928469b5e4cc24bf", @ANYRES32=0x0], 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={r7}, 0x0) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xd, 0x10010, r8, 0x2f2d1000) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f00000003c0)={r7, 0x5}, 0x8) r9 = socket$inet6(0xa, 0x400000000001, 0x0) close(r9) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={r10}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r9, 0x84, 0x19, &(0x7f00000003c0)={r10, 0x5}, 0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000200)=@assoc_value={r10, 0x57a70c36}, &(0x7f00000000c0)=0x8) r11 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r11, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r11, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000180)={r12, 0x6, 0x400}, 0x8) r13 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r13, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 835.121857] audit: type=1400 audit(1577171383.688:1142): avc: denied { map } for pid=21250 comm="syz-executor.2" path="/root/syzkaller-testdir619317636/syzkaller.nafePU/117" dev="sda1" ino=16507 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=1 07:09:43 executing program 1: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8008) 07:09:43 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f00000001c0), 0x0, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r1, 0xc0e85667, &(0x7f00000000c0)={0x40000000, 0x102, "66b371b0503131c3541282a673aff82787de94df14238b52da3eeb855e640b39", 0x8000, 0x9, 0x100, 0x80, 0x2, 0x7, 0x100, 0x7fff, [0x40, 0x200, 0x3, 0x10000]}) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f00000001c0)=""/82, &(0x7f0000000240)=0x52) read$dsp(r1, &(0x7f0000000000)=""/135, 0x87) [ 835.202096] protocol 88fb is buggy, dev hsr_slave_0 [ 835.207249] protocol 88fb is buggy, dev hsr_slave_1 [ 835.237413] device nr0 entered promiscuous mode 07:09:43 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x74}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:43 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x10, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:44 executing program 1: r0 = fanotify_init(0x0, 0x0) r1 = epoll_create1(0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000000)={0x0, 0x8}, &(0x7f0000000040)=0x8) r3 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) fanotify_mark(r0, 0x65, 0x1, r3, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) sendfile(r5, r4, 0x0, 0x209) [ 835.602091] protocol 88fb is buggy, dev hsr_slave_0 [ 835.607275] protocol 88fb is buggy, dev hsr_slave_1 [ 835.737879] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:44 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x80800) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:44 executing program 2: pwritev(0xffffffffffffffff, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:09:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x7a}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:44 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:44 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x60, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 836.037881] device nr0 entered promiscuous mode 07:09:44 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000040)) r1 = open(&(0x7f0000000300)='.\x00', 0xe900, 0x9) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SIOCRSSL2CALL(r1, 0x89e2, &(0x7f0000000000)=@bcast) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 836.126920] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:44 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000040)=0x4) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 836.269036] device nr0 entered promiscuous mode 07:09:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:44 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xf0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:45 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f00000000c0)={0x2, 'vlan0\x00', {0x8001}, 0x200}) ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000000)={0x20, 0x1000, 0x280, 0x800, 0x8, 0x0, 0x1, 0x800, {0x403, 0x3}, {0x2, 0x5}, {0x279, 0x7}, {0x1, 0x2, 0x5}, 0x0, 0x40, 0x1, 0x9, 0x0, 0x4, 0x6, 0x80000001, 0x9, 0x9, 0xffff, 0xfffffffe, 0x22, 0x100, 0x3, 0x7}) pwritev(0xffffffffffffffff, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000100)={0x3, 0x3}) 07:09:45 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, 0x0, 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 836.489538] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x2}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 836.757319] device nr0 entered promiscuous mode [ 836.804644] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 836.961107] audit: type=1800 audit(1577171385.528:1143): pid=21328 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="sda1" ino=16529 res=0 [ 837.237938] device nr0 entered promiscuous mode 07:09:46 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, 0x0, 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x2bf, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:46 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x4100, 0x4) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0)='SEG6\x00') dup2(0xffffffffffffffff, r3) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$TCXONC(r7, 0x540a, 0x40004000083) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r8 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r8, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r8, 0x0, 0x80001d00c0d0) r9 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r9, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:46 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x41c800}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x14c, r1, 0x308, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x60, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x4}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'hsr0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x26}}]}, @IPVS_CMD_ATTR_DEST={0x18, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x3ce1a00ea355dd15}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x18}}]}, @IPVS_CMD_ATTR_DAEMON={0x74, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @rand_addr=0x298}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="e361757c8c5ecc2d13619e98d80c62c8"}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x20000804}, 0x20000000) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000e40)={&(0x7f0000000d80), 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)={0x14, r3, 0x800, 0x70bd28, 0x25dfdbfc}, 0x14}}, 0x10) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x20) sched_setaffinity(r4, 0x8, &(0x7f0000000440)=0x961c) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000300)='/dev/null\x00', 0xa4100, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20010000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, r3, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0xc, 0x7, [{0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, [{0x8, 0x1, r0}, {0x8, 0x1, r5}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}]}, @NBD_ATTR_CLIENT_FLAGS={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000000) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) connect$bt_sco(r0, &(0x7f0000000000)={0x1f, {0x7f, 0x7f, 0x4, 0x6, 0x1, 0xb5}}, 0x8) [ 837.867368] device nr0 entered promiscuous mode [ 837.877469] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:46 executing program 2: pwritev(0xffffffffffffffff, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x9}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000080)=""/177) [ 837.989809] device nr0 entered promiscuous mode 07:09:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x4}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x300, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:46 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x8000) pwritev(r2, &(0x7f0000000500), 0x100001b3, 0x7ffe) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000580)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r0, &(0x7f0000000640)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x3200820}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x14, r3, 0x92fd5e5fbdbec71e, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x16010081}, 0x4000) write$selinux_context(r1, &(0x7f0000000040)='system_u:object_r:getty_log_t:s0\x00', 0x21) 07:09:46 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x105622, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L'}], 0x1, 0x8001) 07:09:47 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000c80)={0x1000, 0x400, 0xffffffff, "e308ce3bb6729880ca2f11ff049ad5ca48d0330c4a40fa761d66ea2f9b25d115af6c9adb0dae8b764251051f9ff1a9a31fd384d64e13e8857400752edaf989f281458d9bc0ab0bce39b5305b37fc49f101f1f66ccbf4f8c8ab28df76354c60a5d6381029a92ca1fe7d0d606e5e4c1063cea6d342bc8d487749a8f6df5c735cebf6a8e70cca68f7e3bf700e20abde1bd02158fe92572a472fcd7c4d07b12c22ae1aafef1e479060914198322a7cd6247e5cdc828b668e2e3cf344b15b44b9228c65d9e0c2cb9a48a9143cf016a02fc34e18a0e5e8edb1d478d62c9ff068c0cc05067df002582943cbb11116ff923d8ac86c89a0a3e7992f4a60b8c4da7c8327f9bd2c1d9b7c536cf5d889f54e38fa7148a774a76219cdd17a4dc4d6cee0a0ff2a1ca9b2cd13d5c0fa5304ef5ee9f23b7f588c0be295f1bfe8f89c8d88937812c9a36bc41934c9ab91965eb6735253362bcafd55c771f36e73840789b9aae317d314899b41c79e09918317f2a4a703ce5e24be51b955b74bd312060dac55df64c95ac0ead7f1fbf7069734493faa610489da13d98ffd8cd20c13fae590ad45fc480174a8f6b84400103885d21f565c3973cab12205709e6b9e04e3b594aae1cefd56a14b7eae2bc50b2fddcdf160f148fb6fe04d11506910813e40c1e4eb8a0f7387a1e907c19e3760024aac572d61c5f95ab1bca974567daf7383cd8abb68feeaaffbdb0c1b79c2f9cd8ee0bdab9e1b45200927350c5cde0943d7264701631edb3edccea08c6831fc4e5c97775fe2286ffd63eb7bbb58a06a9edcf5111d9e0a3ce6fc54df019242bdcd6042230dd5912c9bc07de46baf8e3b52eab6f75040401a3398390c3a097338a295078e547fad5fa44895e681c21426f76d478dc979197dcbbf9a5e67e12e8d241826ac9dfe83849cde9639ebd9806c060c622438335386ce68ae993b095a0cc243561c8cf736fd39f8e173eab10dac3918fc086bb6010facdadacc32129de9ac655113e1bb449da42ae4070cf6a20eb325bd2a65bcdc3ea357ed1879474dcff24d616dc3065a31cb8634413108cd04dc4f525d83500fe0a84acf0439d5e8bf47a6ae4960e0e75bc73286419a4ab5b53e7fe92476cd2a801e01cbf3d05406f24633edc776c4b2377c24c4bc5160e10729ed4cff372ce72eeded6543a4ff24517cb5dc884fa86677c6869f3c7830dda376923abea635ce4e59b95bfa37d8a467c44739eff1c288e78fdbfa52d90c84c0fd7964e72e53aaca085615a9bb42bd682ae6cb308005f87109d6a22f5027ca2629b2a1b924b0c826ef60f8cb02966b17cabd7fb5776f5e1d84242f208ca97cdf144bfd00ffa4cb4b87d53aa811f34290c32bbca40b391526cefd942f837de5afefb912a6f246849e5d8f01d50203fc3943fd65678b6945b6517de6eba44c5360c9d7dd0fb2bf4f5ca5737ced853219058aaf6ea8b9bdc3da91ca4f3fa3a574eca2fc3b592b2fde3efc12b0346d5f55e4920b704a16bfc89a616c121b5ce0d545330718d951863839d9652b855a89c0e351d5447a61fd2542dfaa97da9a22af97d4494097f14e921672a193bab53b2aaa31574fe65dc27aef5780ee685615e1e73fea8f3a53109dc7c45e7b87bb0a09d21d94f0c3ca57c3a82df4d1d1015bac5b4420f8e9ce8a41df6d5eb6a3c293e598876cd5ae8fb6dd64e76d45637a91d2bd0181b4d0f6b88a92b5bd30692a00e21f741bd95280ad0370931dbbbc6a261a3afe0ab8861e25b7e0e5685cfc11b10a0ac81666afa575ca217df4c8edaf83700346a5229e9bdef0141e001722f4ff5815a41ff46a07e9bd895586e7669e93de521d87b7d95fbbcc70b46c978251408e2052f40f1c1570cc8368e01abc2b106e080a5035d506f2fd6cf14f858c63a9afc8929475dbdfacb704c00da65d8e278d9d33a332c8ca70ddcd8cafafd0af83e1f63e8393a178d8a95948f9e32d046af0682a1b7bc6b3874299f02374bfbc5c08281a2cb206fe054719eb881acde79d1132bf6a9327f0b185b195933876d025ad281120a94791350208650c9a2fd39f365c2ac22b7be45d05361d43677c3c1ef896053a70a5927e9f196eb0100975aec1df98d80307a52a770cc6a9c677fe278e4420ca3b388b1796c0b68797ac23dbd834bc69cf8b606e9cba8275bfcb831b9a3ac0c65b9a0df9fb74394e20a4cb71de6c60a220f40ed234455f902ef85ae024a17dda2bc31274e19a6d489c1b0037f07eda649b02629a0f29126ab61cc0284ab10670b7c03f4ca94fead83a2ad8b60a799f70a3279a2f095d783cfb2c8fa72d184ca14cec858e4b6f98dcef5375247084f379dcbed05616a56cf92e518d5a4e83739b6591857b21a406023fd09f92a23b303205038d373e217f170e7557a880630704e5f42415f3655b2d6dd29880bd817251b89a96234c74aaf9c74f6afd4a67b37aa8883d5e4d5db70cabbe911d0537819475c3b530466478ea38cb147f80de74889ccd5f69d3a501987bc8d3ab83d26519b30ac3cdf6031f6d2b594009745fa091185e413dd28327c7d9395c55d89cbb75965152988cb13269b74ba5ae9153883af4a0a11242c8621b4d991f741a22ac366049e8c954c703ca44adcd0b42b994411340782dbb8c1ddb5766a0302c9057280e529e3061c84f01fa2f2a31ccae9994daaa1058b95ee35fa399c06df94a9f047baba752feffdb2f5e41940445c2780395f22e9cd97f8686b65961fc6259d3a8706c8483e813f38c8ea27a4f5a34d0a50ee5af453bff2f26759d9de445b4073acdaf6502e280150bfe1d557a76fb0506f230723f7d946e8e27ccba5a6674822f415b0f80f83d802bcb671b9a462064339a73c8fd4931ec92b81f6926b1404908b08c7ee51a6938390f4cee80d494f30e614540c5d55c10ba9cfef976659e22cb0dfcbc4773f0c68f43155754ecded72c1a29d0f1b1fa6242732df9668d292c8b4299cb191f097229934bc1adb93bece86eeb607f8a0a4f9a766889a53ffe2363cc74af14e73d02dca6db813a6bed57b2c21c4c9aa49a1770a6c6a0099e2c50b988e97d459d18ef1258fd79e50f7724cbc78d1f89ed6c48774b5f78858220261306f88c3dc6ece93ca37782abad69c98b69b0b82ed2d2eb2db6665984c9faa474cda915b8a2b33c2a530544cafd92555427533eb0717a5c045e7341c5ff6a75e2c4c38789e5e98e9cdfb42608ddd90fe7c1c6d73125ff3fc0fc6bf9bdd576536a3727ab071ec949fb080fc8ea8ab9452efdd5a2724b7696a50ca7ccab0247e6aba8f7688c3a8055d70a06fc43de1919ca544b5b09a42bfc714ed5335d8c6e734cefd059165629e59a0e88ac7a4502b2c958a1029ebe20a2edf166f744801e55a0f332b85782aa777af4b772fd05e0903bc20eb181980f05db1602315ad62662ed0314b4d94bd704cfbb4b74325c276744592afbc00dff333cab77729408bcad8414b0577350f0368d25186aba3e16613a547e2647cae4c841a243a8ae3c0491d7de08e01af721d4e65ce1982533628e7f1fdd01ce178513dfc314733e149d96d0ffcfa53db04daabb45f3788787786e0bd4f36061086b6f44f640b08962b1828053464ac044188bcd6276bb53f1a51c6150e66ce6064ef0be98a5f40d9e91f312de62d784f3608194c3622243a7084dd9dc1b36e621a90e7ca4c46163b860485a2663cc53462457c8d9696f7a7df0a10dc0b8cea24843bc9dba77ae5ebb8e0a6356d7861d07f65ab139dfe7ccd9732db6e533f88db393641478ed2dd89c28ac9e377f5525725e9f49f16d571e38ae527d16d40665d4ad1977fdb5b1025b89b2a9de25431bca8029c6886c252bd0f4a41c70752fe27e9f8aadf6aebea9b9617a2dae03930e85ccc16e1d247d139b93b753f32ba285b40f927aacfdea3752841b17689c239fe606986bdd3df982b639685e5e1f5892aaf9c4f51abe78faa7ae8c74046030264ef2a713bc78ec5ef22b3cec300c741c9230464234bbfb844e961ae90a659f0f9a427843c3dd6ff1a0f3e51b651d1349ff4f65e008042822ad1cea119c64a41bd0af46ed31cacd3e3cc8480921fd95f15386e45333d32645f0d05ad8356bc0ed6c913ec4ac8261381700bd0738f84ad1939d9b6659058bea13c01fd5ad4ebf330e086a6e1a75310cf1b5f200e99388f9506ed0ed1e25cae38cabfa424d70ea5c8fb9482800aa2ff7040e520b4ae1c3013b6c6d1a2d80b1a54a2595974e28ccb28cf6197f6568abc48a499d3c3c5f852b1e8ba8d7714e7e543afd81bb68a804ed5cb8de4dc6212f465eb9c97541635d319f1a4343e34fd1013f63be7d0fb692a982e186ea0e8479b61108e8e0f22aa8fb0a16344a566427296384031bf411266c3e6716a323cce02fe6dc1539c70c33b694ad223b57361c848e36c4e5ea0a5ac497aa0babd3808caf9a1b28be04fcc6ad8640f43c2ee2542ff0bf489c4f6cbdd90adf5347caef2718eb0d31aabfa252c63b5c50d76aa090ffca0b129c6a107c3d3215325fc87c4933f26099fcf0e434e0dc1c840f327bd8ea6c39101864b5e7cf1ea836a9578e9f47d42eb9bafb1c13329f4c56029fae08ea860e72a8e3d1fecbf7951ea7fa144c8b1977db7acb47b67f45f10b926d924148ec36e7d4bb9184f889bdd49945c86db7028d7a988f6f0dd89b7630db0278238bd01162a79a847e27b1c8e1cbb0087aa1f6e4802ef23e9811490d8f7d98cc2e32188b3696e485382dc7cc84516ed378c2bd1ad7f7469697db7bd0e2c3a00d0332b302f37dd6eaab1abd2c18007850b9d2bdf7952304439d05bd5ca026694b7b335e268f2c1e352214a02e53b1b51a40465b2cab79a9c488500950218802c67475ae05f63c0f5eb1ec09b3a014b4d99230f3b02678b97e5a7c8d97f63a63f09ef650dc72356195ff04902209b5d900ba15b2b5433216f9a73a5502fb6a7d7dd390182e07ef26bb097fc4de11038401e71fea4315aba02ea3926993fb77ad85fe604b394c88c98a7ac488b05f25089f9e32fede36d168448bd5665aaaf3be0facf963fdd0c80879cb9d91e39e3085326f289a221dad895e85ba941ee20e4c62aec5c68b7bce56bff12508628df4e64490b97cb5c772f56ab156b86fa3f6a0ed28b3bf3ed5409f4a84f4945a1ea8e4d05462ec7d7734e1331b4b350170fc4f4a52f8367b74a4d997ec1fe64446aeabe3028c3c46078256c6302d2bd478a915dc43a3ca5f48a08bcf31c6b71ff34554e3f55b52c33ebe48431546992ceff84bd05d2166b89511831442f1269942c9bbf0a03812789a773127428645845f38982d2faad5fa52929ed4d2b119a94ac65aa496be9d4ad9c692788245dc15b57ba41401b12bfde080bc1d6cd5a89bf2c4f3f6b8f0c1e4353d6cfe6b56e00cbf92a1e0890b6b0ff79a874f14a97d9d0401815e5780271db8cbe51bac6beae8e53edf8d1df6360dcb007f872a7d50b2c5dd2398edc73ca20646160c3f371613f5fa87278c7cef648a83047a623b148d09e8bf0ea42b403ad764afad231f6ac4352121085c24734f2512b95f5bcc1316cd2104caec48dcb6aa67e272a8352d76c2de7ada161a1772dceb088ff4f8f9b026e77d8e9e00bea2578e3622aaac979ae394525816a95d454114a8f45ed373b22c674805a31b18fbdb99542019004ec6bfac153623fe5ea2a4b9ad543ce2b598351453d8748bd78174fb572724dc023b314c8cce1944c49486e92543658cf97c2a69553644f561517699fe1799fa6c9ed656b491ed09cd331996d26c03fb79ea"}) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) ioctl(0xffffffffffffffff, 0x0, &(0x7f00000000c0)="1feba149ca04912cee1d31a7f1c169142f3a74828d991e2d315350f726edd6c809b856d14eab0c501b9673165156db3e72a11c628065f7d9d7456efb22c436dcf3ea883f04ad8ed9e37b74308d9d7539942c84f4d5e9e0b039894921d9b0858b897480b83df9052c55aa3eb972fd546ba7d2bc73bcd5c15fe78e516b789128ca832d27f8d022971d274bfa1871df8b9d4eff9c51b22b2469f63459f82a4f632ad30fd2a090228870d34742c8ed44caaaa389f1223f7e1722f838010166a3c8d41efdee70af2f0cde86ee9b714afceb6a40c6ad08394cb86b2f") 07:09:47 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x280000, 0x0) ioctl$sock_bt_cmtp_CMTPCONNDEL(r0, 0x400443c9, &(0x7f0000000040)={{0x9, 0x6, 0x1, 0x3, 0x90, 0x9}, 0xf31}) write$P9_RWRITE(r0, &(0x7f0000000080)={0xb, 0x77, 0x2, 0x8}, 0xb) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0)='Cd\xce\aam\x13\x00\x00\x00\x04', 0x8ac00, 0x0) pwritev(r1, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 838.715904] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 838.815385] device nr0 entered promiscuous mode 07:09:47 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7fffff, 0x4002012, r3, 0xfffff000) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) r5 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) syz_open_pts(r3, 0x300cc0) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) setsockopt$inet_tcp_int(r5, 0x6, 0x7, &(0x7f00000000c0)=0x80000001, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:47 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) ioctl$VFIO_CHECK_EXTENSION(r0, 0x3b65, 0x4) 07:09:47 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x500, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:47 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, 0x0, 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x5}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:48 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) setsockopt$CAIFSO_REQ_PARAM(r0, 0x116, 0x80, &(0x7f0000000000)="1341e0e166e0a313f63f632516138bba88f59e5708347786ff778f7e4277d8051acc74899bf7c22f04101e691b13b91c36c698ce3ce7b2d4a808dade2332c59952c1be41dc38ce679ac1012750ec2f25e1dbe7fc8ae7359de848d5487186660312917c369bbc6aa3b1d349b1707acb55da9f9b0e660baec48db5f1cfaf8882f75962ea4db9f4fa3a728665d578d1819817f892a4fbda81033cd763cfc1cc2e514be73382a39152aaa205b3479ee3db", 0xaf) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 839.400605] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 839.451919] device nr0 entered promiscuous mode 07:09:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x6}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 839.527820] device nr0 entered promiscuous mode 07:09:48 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x600, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 839.681567] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:48 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(0xffffffffffffffff, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 839.762100] net_ratelimit: 2 callbacks suppressed [ 839.762109] protocol 88fb is buggy, dev hsr_slave_0 [ 839.772134] protocol 88fb is buggy, dev hsr_slave_1 07:09:48 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, [], 0x15}, 0xfffffffb}}}, &(0x7f00000000c0)=0x84) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r2, &(0x7f0000000680)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000640)={&(0x7f0000000c80)=ANY=[@ANYBLOB="2c045500", @ANYRES16=r3, @ANYBLOB="100028bd7000ffdbdf251100000014000900080002000000000008000200fcffffff0c010100380004001400010002004e20000000000000000000000000200002000a004e2400000093000000000000000000000000000000010c00000008000300ed000000100001007564703a73797a30000000002c0002000800020000000000080001000c00000008000100020000000800040000800000080001001c00000008000300faffffff100001007564703a73797a3000000000380004001400010002004e24ffffffff0000000000000000200002000a004e2400000040fe88000000000000000000000000010100000000100001006574683a73797a5f74756e002c00020008000100040000000800010001000000080003000200000008000400060000000800010003000000dc0001002c0004001400010002004e200000000000000000000000001400020002004e207f00000100000000000000000c00020008000400030000001c00020008000300aaef000008000200ffffffff08000300050000000400020044000400200001000a004e22000100010000000000000000000000000000000140bd0000200002000a004e2300000008ff0100000000000000000000000000018b04000008000300020100003400020008000400ee0d000008000200faffffff08000100190000000800020005000000080003000600000008000100160000003c0007000c00040009000000000000000c00040006000000000000000c000400ff7f00000000000008000200070000000c0004000101000000000000b000010038000400200001000a004e2200000007fe8000000000000000000000000000119afd00001400020002004e230000040000000000000000002c00020008000200040000000800010014000000080001000a0000000800010007000000080003000000008038000400200001000a004e2400000003ff0100000000000000000000000000013f0080001400020002004e24ac1414bb00000000000000001000010069623a64756d6d7930000000c00001000c00010069623a65716c0000100001006574683a766c616e3000000038000400200001000a004e230000000500000000000000000000000000000000ff7f00001400020002004e22ffffffff0000000000000000100001007564703a73797a320000000034000200080002008100000008000100130000000800030002000000080002000300000008000300f15a000008000300080000000c00020008000300018000000800030002000000100001007564703a73797a31000000002400090008000200000000000800020006000000080001000300000008000200010000804c0004000c00070008000400050000003c0007000800010013000000080004000700000008000300020000000800020081000000080002000400000008000300000000800800010015000000"], 0x42c}, 0x1, 0x0, 0x0, 0x40101}, 0x2c000824) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/sequencer\x00', 0x200, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r4, 0xc0045009, &(0x7f0000000700)) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={r1, 0x3f, 0x200, 0x81, 0x8, 0x20}, 0x14) 07:09:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x7}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 839.956688] device nr0 entered promiscuous mode 07:09:48 executing program 2: openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/access\x00', 0x2, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 840.095555] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 840.162110] protocol 88fb is buggy, dev hsr_slave_0 [ 840.167259] protocol 88fb is buggy, dev hsr_slave_1 07:09:49 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17ffffe, 0x4002012, r3, 0xe2eff000) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x700, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:49 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x14000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x120, r1, 0x118, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x78, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2e8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}]}]}, @TIPC_NLA_NET={0x30, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7f}]}, @TIPC_NLA_NODE={0x20, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x50d}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7ff}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8000}]}, @TIPC_NLA_SOCK={0x34, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffff}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x44000000}, 0x40090) 07:09:49 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(0xffffffffffffffff, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0xa}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:49 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mISDNtimer\x00', 0x40100, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000000)=0x7fffffff) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x80, 0x0) ioctl$TIOCNOTTY(r2, 0x5422) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, &(0x7f0000000040)={0x5, 0x1, {0x53, 0x5, 0x4, {0x3f, 0x6}, {0x8000, 0x4}, @rumble={0x6, 0xfff8}}, {0x54, 0x0, 0x7fff, {0x6, 0x1556}, {0x5, 0xf15e}, @ramp={0x68, 0x7, {0x7, 0x401, 0x7f, 0x7}}}}) [ 840.839070] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 840.881751] device nr0 entered promiscuous mode [ 840.898644] device nr0 entered promiscuous mode 07:09:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0xc}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x900, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:49 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40), 0x0, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) syz_mount_image$btrfs(&(0x7f0000000040)='btrfs\x00', &(0x7f0000000080)='./file0\x00', 0x1, 0x3, &(0x7f0000000340)=[{&(0x7f00000000c0)="5e9c5655c5bf74a84df2dee41e62f6773130d21186c835c329fd9547bc30d75bb0cf869ec0eff7f336b64e4955b818bdaa222ae21b26080d6d1cbc066522d06a2ace77ddda3f5f69e9ffcf1d7c16bd5471c19a3d3c1cb45e29a8c07ff4abd0816095f0b7045eee14ca51906125ae5d030a786fdcec36d8e4fc1549e4bd8cd54d50f08b5a0c3a7823d7e70d935a0547664267180041c46b506588468881e53448f04bac1d2ca6b3e35ce98d141ac269e252d50958fc9a132e94e7f0a69bc4bdf1716b19651c98fe023a49f50e47ddcb1bf35f4ebd9039d780466da5", 0xdb, 0x4}, {&(0x7f00000001c0)="a9e0216b2c00cff00b0fa35674744227fb6299c7cf3efaecb4", 0x19, 0x5}, {&(0x7f0000000200)="7bcd431820d36ba8abfe35c78568786c8bdcfd0c6d1a0f71aeda8079286eb67c2b4df37cfe92215c35f4a29e921b969961b7606811a378db44a6c7754b32ec331a05a58a5728b60d4e9e2dca37dce2ebaa7f7f1013c1517951c38c3d5aecb0725428e3579dd5d0118ce206424138057a3d3718fa070ecdab87064eaa65c76482d77bc22ef0279049b6369e9fbd51b5a6324185431858c038c7af685187ef60", 0x9f, 0x1ff}], 0x20, &(0x7f00000002c0)={[{@skip_balance='skip_balance'}, {@flushoncommit='flushoncommit'}], [{@dont_measure='dont_measure'}]}) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/video37\x00', 0x2, 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000400)={0x3, 0xff, 0x2, 0x6, 0x8, [{0x20, 0x81, 0x7ff, [], 0x602}, {0x4, 0x5, 0x2, [], 0x80}, {0x4, 0x7f, 0x6}, {0x40, 0xb8d, 0x2, [], 0x1482}, {0x80000001, 0x2, 0xa0b, [], 0x1}, {0x4, 0x0, 0x101, [], 0x89}, {0x8, 0x7, 0x9f5, [], 0x3000}, {0x1ff, 0x5, 0x8, [], 0x18}]}) ioctl$IOC_PR_PREEMPT(r1, 0x401870cb, &(0x7f0000000000)={0x8, 0x8, 0x69, 0x82a6}) [ 841.124513] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0xe}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 841.442721] protocol 88fb is buggy, dev hsr_slave_0 [ 841.448402] protocol 88fb is buggy, dev hsr_slave_1 07:09:50 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xa00, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:50 executing program 2: openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x28, &(0x7f0000000040)}, 0x10) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0xfc3a30b2cea72653}], 0x0, 0x8001) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x20) getpgrp(r2) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) [ 841.584121] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 841.662732] audit: type=1804 audit(1577171390.228:1144): pid=21479 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir154753035/syzkaller.NzicsO/418/bus" dev="sda1" ino=17199 res=1 [ 841.771116] audit: type=1400 audit(1577171390.238:1145): avc: denied { map } for pid=21441 comm="syz-executor.3" path="/root/syzkaller-testdir154753035/syzkaller.NzicsO/418/bus" dev="sda1" ino=17199 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 841.815957] audit: type=1804 audit(1577171390.238:1146): pid=21448 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir154753035/syzkaller.NzicsO/418/bus" dev="sda1" ino=17199 res=1 07:09:50 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(0xffffffffffffffff, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x10}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:50 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x3ccf23f4f19642b3, 0x0) pwritev(r0, &(0x7f0000000000), 0x1, 0x8001) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000000)=0x5) 07:09:50 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xc00, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 842.208555] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:50 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000100)={'broute\x00', 0x0, 0x2, 0x12, [], 0x1, &(0x7f0000000080)=[{}], &(0x7f00000000c0)=""/18}, &(0x7f0000000180)=0x78) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x6, &(0x7f0000000000)=[{0x5, 0xfb, 0xb9, 0x4}, {0x3, 0xc0, 0x20, 0x5}, {0x691, 0x81, 0x7, 0x7}, {0xfc01, 0x5, 0x7, 0x1}, {0x4, 0x9, 0x1, 0x4}, {0xbf10, 0x3, 0x80}]}) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r3 = socket$kcm(0x10, 0x2, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x68, r4, 0x8b8e0eb13081c495, 0x0, 0x0, {{}, {}, {0x4c, 0x18, {0x0, @media='ib\x00'}}}}, 0x68}}, 0x0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2804800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, r4, 0x2, 0x70bd28, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x9839d052ee03d080}, 0x8000) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f00000001c0)={0xeeb83c4cd95af24c, 0x64, "60e619f2c55e5b1d7069e978fc78061b2ca8e2503ec8bde7e8161dbc6fe315740c360fdae2d5fb92a6592f659375a09cd0f38693da32107a3eb158a091bec4cec411023cf7c7586b0f68b8745f170e25b1b835ffd0d182334e03f50c659bddb7560251bd"}) 07:09:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x48}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:50 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcsa\x00', 0x6001, 0x0) r6 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000b34ff8)={0x0, 0x0}, &(0x7f0000b34ffc)=0xc) setuid(r7) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) fstat(r8, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000b34ff8)={0x0, 0x0}, &(0x7f0000b34ffc)=0xc) setuid(r11) r12 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r12, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) fstat(r12, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f0000b34ff8)={0x0, 0x0}, &(0x7f0000b34ffc)=0xc) setuid(r15) r16 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r16, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) fstat(r16, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$NS_GET_OWNER_UID(r3, 0xb704, &(0x7f0000000140)=0x0) fstat(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r20 = msgget$private(0x0, 0x0) msgsnd(r20, &(0x7f0000000000)={0x2}, 0x2000, 0x0) lstat(0x0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r20, 0x1, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, r21}, 0x88f, 0x0, 0x0, 0x0, 0x0, 0x4800000}) write$FUSE_DIRENTPLUS(r5, &(0x7f0000000980)={0x5e0, 0x0, 0x4, [{{0x2, 0x2, 0xffffffff, 0x0, 0x5, 0x5, {0x1, 0x800, 0x7, 0x8, 0x101, 0x9, 0x9, 0x5, 0x4, 0xe5, 0x35ce, r7, r9, 0x8000, 0xfffffffc}}, {0x0, 0x3, 0x5, 0x1, 'nr0\x01\x00'}}, {{0x5, 0x2, 0x10, 0x3, 0x2, 0x4, {0x1, 0x2, 0x6, 0x62, 0x3, 0xfffffffffffffff9, 0x76e, 0x7, 0x7, 0x2, 0x5685, r11, r13, 0x2, 0x6}}, {0x4, 0x4, 0x6, 0x1ff, 'md5sum'}}, {{0x4, 0x2, 0x7fff, 0x2, 0x81, 0x8, {0x5, 0x7a86526f, 0x4, 0x8001, 0x1f, 0x3f, 0x3ff, 0x8, 0x79d6, 0xff, 0x1, r15, r17, 0x4, 0x7f}}, {0x6, 0x0, 0x10, 0x8, 'posix_acl_access'}}, {{0x1, 0x0, 0x9, 0x2, 0x6, 0x444c, {0x5, 0x10001, 0x8, 0x100000000, 0x1, 0x9, 0x101, 0x7, 0x10000, 0xe451, 0x3f, r18, r19, 0x6, 0x5}}, {0x5, 0x7, 0xc, 0x20, '/dev/audio#\x00'}}, {{0x0, 0x3, 0x1, 0x1, 0x3, 0x5, {0x1, 0x6, 0x7, 0xfff, 0x3, 0x3ff, 0x9c3, 0x10001, 0x8, 0x9, 0x79a, 0xee00, r21, 0x5, 0x7ff}}, {0x1, 0x8000, 0x2a5, 0x6, 'nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1'}}]}, 0x5e0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r22 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r22, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r23 = open(&(0x7f0000000300)='.\x00', 0x100, 0x0) faccessat(r23, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$KVM_IRQFD(r22, 0x4020ae76, &(0x7f00000000c0)={r22, 0x1, 0x2, r23}) sendfile(r1, r22, 0x0, 0x80001d00c0d0) r24 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r24, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 842.426538] device nr0 entered promiscuous mode [ 842.447845] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:51 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xe00, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:51 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) bind$vsock_stream(r1, &(0x7f0000000000)={0x28, 0x0, 0xffffffff}, 0x10) 07:09:51 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, 0x0) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:51 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x4c}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 842.602457] device nr0 entered promiscuous mode 07:09:51 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) setsockopt$inet_int(r0, 0x0, 0xe, &(0x7f0000000000)=0x800, 0x4) socket$inet_udp(0x2, 0x2, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0xc6c6d3fdebe70907, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) 07:09:51 executing program 2: semop(0x0, &(0x7f0000000200)=[{0x0, 0xfffffffffffefffc}], 0x1) semtimedop(0x0, &(0x7f0000000040)=[{}, {0x2}], 0x2, &(0x7f00000000c0)) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) prctl$PR_GET_NAME(0x10, &(0x7f0000000c80)=""/4096) 07:09:51 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="d6d1c203e93e", 0x6}, {&(0x7f0000000040)="e35b7c65dec17c69481e20f718e08b3e1c8701f0bfa02eee556b977e32c76770786a71585550c6d45c631a1dc2", 0x2d}, {&(0x7f0000000080)="1718d0fa7729b18794d49af0c1020f057e00607088d4a688852fed01c3", 0x1d}, {&(0x7f00000000c0)="90d694d575621c2b8ff947c6d837bc70f917d2f30357264163e12deb3694aeac2fb4570f863bba8a6542b87fe49643", 0x2f}, {&(0x7f0000000100)="80951671cdba090bdcbfe3c73039cc73ae7611e86ef54e5966d9f5cd2b9dc7c4a6cba8cc9ff190d9784eeaf11fa15adbaa192f2a2bb2992a3bd98e6b1a160f66eb3f727a406d54c15462bf009d3eb016b5b401fd1e4bc2fcbd8e5ba82f48e1d94016a0b15368507fa4ab1efdcced89645cbf9c1c09e2878715eb8219a94db966854f366bda66e9fd449ce1d731a85e0af5ba8c0beeb228758293f0188ac98ed98cf6409763", 0xa5}], 0x5, 0xffffffffffffff7f) 07:09:51 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x5078dd92ab7e6a95) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$UI_BEGIN_FF_ERASE(r2, 0xc00c55ca, &(0x7f0000000080)={0x0, 0xd0, 0x1f}) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000000)={0x8, 0x5, 0x4, 0x2, 0x1, {}, {0x5, 0x0, 0x6, 0x8, 0x0, 0x3, "e00f3081"}, 0x7, 0x4, @fd=r3, 0x95b1f7a9, 0x0, r4}) ioctl$NBD_SET_SOCK(r0, 0xab00, r5) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r6, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 843.171413] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 843.209812] device nr0 entered promiscuous mode 07:09:51 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x60}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:51 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x101000, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000040)={0x1}) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_DBG_G_CHIP_INFO(r1, 0xc0c85666, &(0x7f0000000080)={{0x2, @name="31ceeb483f31b127c3b02ef13bf27604e21714a2031af046dea54215f19c18e4"}, "0c5f2430163d59e718b808519321514c3102fc49de920439fa6e63317bdf33e5", 0x1}) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0xe) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = gettid() ptrace$setopts(0x4206, r7, 0x0, 0x0) tkill(r7, 0x20) ptrace(0x5cbae6aea13d3c33, r7) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700000000000000000000e1c0", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="740000002400070500"/20, @ANYRES32=r6, @ANYBLOB="00000000ffffffff000000000800010073667100480002000000000000000000000000000000000000000000000000000000000000471a00000000000000000000000000000000000000000000f3aff151ed1e4a08c07fa96752c88f8ca2454f9c9ed6974ba345296ca6ffafecb3ab42207c5c129c70d7ffb1202624af00"], 0x74}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="7c0000002c00010700"/20, @ANYRES32=r6, @ANYBLOB="00000002000000000300c4c1080001006270660050000200080006000000000004000500400002003c00010000000000eeff0075da891600000011000000000000000010000000000000000000000000000000000000e4ff00ddffffff00"/116], 0x7c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2750000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xffff, 0x6}, {0xfff1, 0x3}, {0x6}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x101}, 0x8000) r8 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r8, &(0x7f0000000c40)=[{&(0x7f00000008c0)="9c", 0x1}], 0x1, 0x8001) 07:09:51 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x4000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 843.390699] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:52 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, 0x0) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:52 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000802, 0x5f) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000200)=""/239, &(0x7f00000000c0)=0xef) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f00002c7000/0x2000)=nil, 0x2000, 0x1, 0x100010, r3, 0x2000) r4 = open(&(0x7f00000005c0)='./file0\x00', 0x0, 0x8) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = open(&(0x7f0000000140)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendfile(r6, r5, 0x0, 0x100) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) execveat(r7, &(0x7f0000000100)='./file0\x00', &(0x7f0000000580)=[&(0x7f0000000380)='ppp0:,\x00', &(0x7f0000000400)='/dev/net/tun\x00', &(0x7f0000000440)=':$[@cgroup\x00', &(0x7f0000000480)='\x00', &(0x7f00000004c0)='.em0\x00', &(0x7f0000000980)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1', &(0x7f0000000500)='nr0\x01\x00', &(0x7f0000000540)='.em0\x00'], &(0x7f0000000680)=[&(0x7f0000000f00)='\x11\xe4A\xba\xfe\x8a\xb684h\xc7\xac\x92\x1fg\xb0&&\x00\xc8}\xd8\x1d\x8c\xf6l\xa3 \x9c~Z\xdf\x161\xfc\bL{\xf9D\xb0\xc6\xa2\xc9\xdc\x0e\xd1c\xeb\xecAr;\xea[m?\xe6E\x94\xe4W\x89\xb3\xc3F\v\xc8\xc4\xcf\x86\x83pbf\x02\x8d\x1e\xeb\xe24\xfb\xa85{\x90\x9f\xf1\x93\xac\x96\xcf\xb2\xa9\v\xe9cG\xcd\xbar#\xa4\xab\xac\xea\xf5I\xe0\x9fA\xf7Z\rKA\x16\x83\x85G\xa9\bE\xd8O\xbf]\x1c\xdd\xc3\xbbIr\x1e{\xce\xfe\x1dw>\x99WiH8L\xbaQ\x05\x82\xf1\xbb\xbaZ\xf5\x12\x15\xd2\xda\xfa\x00\xe7\x98;>%\xcaG\x87O?J\xbc\x8fN\x99~Q~^\x8d\x85\x0e\x00\x00\x00\x00\x00\x00:\x0f\x1d\xbbc\x9dy\xae\xac\a\x9aD!\x83\x05)vp\x8f\xb0\x7f\xd22!%\xb2\xe4\xf4\xc7\xcf\b\x00\x00\x00\x00\x00\x00\x00\xc7\xb8\xb4Zd\x93\xb8\xad|\x9a;\x92\xad\x95\xb3\x18\xbc\xa6Q\xe8\xcc\xc4\xe3\xceW\xd4\xb5\xfb$EPI\x83\xfdr\x91\xcd\xab\xa6\xbb\v\xcd\xebp\x05U5kGU8C0\x10J\xcfM\x8d\x05\xb78\x1bb\xfe\xa5\x17\xf8\xd4\xf5\xb9*o\xe8\xa918\a\xb3\xd3\xc7q\xed\x02\xedl}D\x0fFA\x98\x0f+O\xcf_\x87\xbd\xc1Cs\x903\xa5yI\xbb\x8d\x8dC\x8f%\x82>}uz\xbdz\xe5\f', &(0x7f0000000600)='/dev/audio#\x00', &(0x7f0000000640)='keyringmd5sumcgroup\x00', &(0x7f0000000c40)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1'], 0x880) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:52 executing program 2: r0 = accept4$rose(0xffffffffffffffff, &(0x7f0000000040)=@full={0xb, @dev, @default, 0x0, [@remote, @null, @default, @null, @default, @rose]}, &(0x7f0000000080)=0x40, 0xc00) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x401, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$sock_void(r2, 0x1, 0x0, 0x0, 0x0) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000100)={'veth1_to_bond\x00', 0x101}) 07:09:52 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x68}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 843.629878] device nr0 entered promiscuous mode 07:09:52 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x5865, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 843.697002] device nr0 entered promiscuous mode 07:09:52 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r0, 0x541c, &(0x7f0000000000)) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, r2, 0x0, 0x9, &(0x7f0000000040)='vboxnet0\x00', 0xffffffffffffffff}, 0x30) syz_open_procfs(r3, &(0x7f00000000c0)='net/ip6_tables_matches\x00') pwritev(r1, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 843.749738] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:52 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x6c}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 843.922088] protocol 88fb is buggy, dev hsr_slave_0 [ 843.927236] protocol 88fb is buggy, dev hsr_slave_1 07:09:52 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, 0x0) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:52 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000100)="ab8f04af7182368c113106fc56d5ad8a8e43660e2a70d04147061c4f69a9bedae0246cf9e8d4e4ff515cf7848e1fec0e246d12", 0x33) r1 = open(&(0x7f0000000040)='./file0\x00', 0x102000, 0x20) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_LOCK(r2, 0x4008642a, &(0x7f0000000140)={r3, 0x20}) ioctl$DRM_IOCTL_NEW_CTX(r1, 0x40086425, &(0x7f0000000080)={r3, 0x2}) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f0000000000)='H', 0xffffffffffffff69}], 0x10000238, 0x8001) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000e40)={&(0x7f0000000d80), 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)={0x14, r5, 0x800, 0x70bd28, 0x25dfdbfc}, 0x14}}, 0x10) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000240)='/dev/btrfs-control\x00', 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80800}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x74, r5, 0x0, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x32e}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x80000001}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1ff}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x38fa}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, [{0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x4080}, 0x1) ioctl$VIDIOC_DECODER_CMD(r4, 0xc0485660, &(0x7f0000000180)={0x5, 0x1, @stop_pts=0xe0}) [ 844.235364] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 844.322095] protocol 88fb is buggy, dev hsr_slave_0 [ 844.327340] protocol 88fb is buggy, dev hsr_slave_1 [ 844.388222] device nr0 entered promiscuous mode 07:09:53 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x6000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:53 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x74}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 844.423474] device nr0 entered promiscuous mode 07:09:53 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) accept4$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000080)=0x14, 0x80c00) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x937a5d12bbc17078}, 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="54f00a00000000000000000000000000003a02ab0dbeabfa71bbce95804df739f6871aee48e07c3e1d75d33a24aa6e53390ab31ce9bd623f5553b995cd0bc23e1dfba19b38eca0b34240102e746ab95b7142792f38974b32687b517925e61615fc013d071a07cc0052e3ecb4e63433426bd023bb1eaef4e6c4c158d7d8d46ab22da6d49c01b60f155a97b12e18ad27d65810794a3217de8a8a2d4f399354d93a330bc4510ae02db5117dc36bdb7e279dd92c9bdfc0ecefacd493ce40cebdb7e5c0929201d6dd2822295f20126b803b0000000000", @ANYRES32=r1, @ANYBLOB="1016fbd053bd8000f2ff07000a00f2fff1ff08000b000104000008000b000208000008000b000300000008000b000500000008000b000200000008000b0009000000e94e561619fce5239e1723ead26c0cc3a3ba736cef96beb00a986b58d6362b3fb2124b5dd2ef046eb91fc14e0c22de889f156f605efa4ebf17d8f04cca21990c2870678f42817f9ccffbe34c39331ef4ad03ed3385870f2cd94028bd27adbd2cfd1eae500fe594eea98cff"], 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x10) sysfs$3(0x3) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x20) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x20) sched_rr_get_interval(r4, &(0x7f00000005c0)) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x2) r6 = getpgid(0x0) r7 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r7) r8 = gettid() waitid(0x2cb7519c1f14dff9, r7, 0x0, 0x0, &(0x7f00000009c0)) r9 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r10 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x0) r11 = dup2(r10, r9) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0xc0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000018c0)={r8, r11, 0x0, 0xd, &(0x7f0000001880)='bond_slave_0\x00', r12}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000480)={r12}, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r7, 0xffffffffffffffff, 0x0, 0xe, &(0x7f0000000000)='ppp0eth1]*em0\x00', r12}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={r6, 0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', r12}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, r5, 0x0, 0x6, &(0x7f0000000140)='ppp0*\x00', r12}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000200)={r2, r3, 0x0, 0xb, &(0x7f00000001c0)='/dev/nvram\x00', r12}, 0x30) readv(r13, &(0x7f0000000500)=[{&(0x7f0000000240)=""/128, 0x80}, {&(0x7f00000002c0)=""/37, 0x25}, {&(0x7f0000000300)=""/57, 0x39}, {&(0x7f0000000340)=""/57, 0x39}, {&(0x7f0000000c80)=""/4096, 0x1000}, {&(0x7f0000000380)=""/101, 0x65}, {&(0x7f0000001c80)=""/4096, 0x1000}, {&(0x7f0000002c80)=""/4096, 0x1000}, {&(0x7f0000000400)=""/2, 0x2}, {&(0x7f0000000440)=""/151, 0x97}], 0xa) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:09:53 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) connect$bt_sco(r0, &(0x7f0000000180)={0x1f, {0x5, 0xdc, 0x8, 0x80, 0x87, 0x8}}, 0x8) openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000140)={0xcc, 0x1a, 0x3, 0x7, 0xfb, 0xc2, &(0x7f0000000040)="48a39d211846cad357dea28fff7a4ddcb7e393c2648d2f5db220dba7b6a4f375ff2ccf7649ca776effc729642062cdc206625649c74ce7738d6086709bc04681a45e4805f5aa84b9a73088ac1fb5ca97d6d4f90ef789e6ac618c43988bf89b269f3e5f6d739885ec18621e33bb8e21fc12c9d669239ce4b31857671fa608dcc0738280709f4a1a705b8c9d6361ad94eda61dd1fb76487243333dd103de3ee8c1ad9bc4ee05e20ffec49b13e8354efc6b485927c2a79de26ab45830bcd5f3b2c0e7f0f3fb7376963f447e4950c358f0253397b69996c8a1de480bd4a5ff85c6597501bbaa9f40f04d3288f95cb81bb36ac6fbe87e8547f268ea7f34"}) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pwritev(r2, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 845.235058] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:53 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f00000000c0), 0x0) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:53 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) signalfd4(r1, &(0x7f0000000000)={0x7ff}, 0x8, 0x80800) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x800, 0x106) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$VIDIOC_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) 07:09:53 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x7a}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:53 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(0x0, 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:54 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x6558, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 845.433259] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:54 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000000)="688026e708aa6511014785bc9ba7e317", 0x10) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x80, 0x0) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, &(0x7f00000000c0)=0x7, 0x4) syz_open_dev$ptys(0xc, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000040)={0x1}, 0x4) pwritev(r1, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 845.555052] device nr0 entered promiscuous mode [ 845.565630] device nr0 entered promiscuous mode [ 845.602102] protocol 88fb is buggy, dev hsr_slave_0 [ 845.607245] protocol 88fb is buggy, dev hsr_slave_1 07:09:54 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 845.798579] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:54 executing program 2: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x20) r1 = syz_open_procfs(r0, &(0x7f0000000040)='net/connector\x00') setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f0000000080)=0xfffffffffffffbff, 0x8) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_GETVERSION(r3, 0x80087601, &(0x7f00000000c0)) pwritev(r2, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_GETCAPS(r4, 0x8004500f, &(0x7f0000000000)) 07:09:54 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x8100, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 846.002108] protocol 88fb is buggy, dev hsr_slave_0 [ 846.007223] protocol 88fb is buggy, dev hsr_slave_1 07:09:54 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:54 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000240)=[{&(0x7f0000000040)="c7c3c436e928f2734eb554df7feda9246a43cf1358797235783f49065bd9f67881851c5756989bf9711e2ceca739d6edbd1f024e84ec48b685323723c33110f505fc3b1842a70225655c64ab488af6d5d0c95a631f4be2db7e150a1fb385f0367687064c6b58838a4129cd57565e77ba4029f05e8177b7b46b3a2bcad1de65755dd95b52053446bbc6f46c4e3fe65f9f08ef7ead6e501c4e5a046c1bb604a86877401e4a69a7417da08c0b04c6eae6f9814d278f2ec157df008435dfad88f244d5813612c5679d987b1a36", 0xcb}, {&(0x7f0000000140)="1a51c3feb8afb436b9fe8fd68f4218adaf675bc9e6469877675ca9869195337f79c9e70e05074dd6a6dc9e5a83ce3f94c9dc31e788d84949d44b26348f717389d69d4796092d4fb657181955ec38cf54162f828099dabe031370c20ab2eab27f5e184093c56be3c70af2a3e543fbf8c1af9bf87a5f15991b4869f76f276a622598ac2465a749886846234e4c659a42733a469193d1dd710c1f4aa4979553b7b73b3ef84534d94c5c26a46b6759cfbec4f7e6e0f06ea6542cf2310274f95247c58db39889c5f37b414ed90e6a873fbed16c77e69202b3ca12d260a1b56279", 0xde}], 0x2, 0x4) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000000)) 07:09:54 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, [], [{0x2, 0x7, 0x10000, 0x80000001, 0x3, 0x2}, {0x10000, 0x0, 0x4, 0x6, 0x1, 0x200}], [[]]}) [ 846.402113] protocol 88fb is buggy, dev hsr_slave_0 [ 846.407268] protocol 88fb is buggy, dev hsr_slave_1 [ 846.637568] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 846.693704] device nr0 entered promiscuous mode 07:09:55 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(0x0, 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:55 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/M\xb6\xb6\xfb\x1b\xac\x11\r;\x00', 0x48481, 0x0) pwritev(r0, &(0x7f0000000c40), 0x0, 0x8001) ioctl$SIOCX25GFACILITIES(r0, 0x89e2, &(0x7f0000000180)) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r2, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x1}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2d, 0x28}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x11}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x30ea8de1f50994a0}, 0x800) 07:09:55 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:55 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xbf02, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:55 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) faccessat(r5, &(0x7f00000000c0)='./bus\x00', 0x3, 0x1200) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r7 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000b34ff8)={0x0, 0x0}, &(0x7f0000b34ffc)=0xc) setuid(r8) ioctl$TUNSETOWNER(r6, 0x400454cc, r8) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r9 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r9, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r9, 0x0, 0x80001d00c0d0) r10 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r10, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 847.251845] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:55 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40), 0x0, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x1f00) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) fsetxattr$trusted_overlay_nlink(0xffffffffffffffff, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'U+', 0x800}, 0x16, 0x2) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0x10) 07:09:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:56 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xf000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 847.463634] device nr0 entered promiscuous mode [ 847.481138] device nr0 entered promiscuous mode [ 847.488945] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:56 executing program 2: creat(&(0x7f0000000280)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000240)='./file0\x00', 0x201, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f00000001c0)={0x9c0000, 0x55fd, 0x80000001, r2, 0x0, &(0x7f00000000c0)={0x9f0902, 0x610, [], @string=&(0x7f0000000040)=0x80}}) ioctl$VIDIOC_LOG_STATUS(r3, 0x5646, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) write$FUSE_INIT(r4, &(0x7f0000000140)={0x50, 0xfffffffffffffffe, 0x2, {0x7, 0x1f, 0x2, 0x50, 0x12, 0x3bb4, 0x5, 0x4}}, 0x50) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r5, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:09:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 847.682128] protocol 88fb is buggy, dev hsr_slave_0 [ 847.687304] protocol 88fb is buggy, dev hsr_slave_1 07:09:56 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xf0ffff, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:56 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(0x0, 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:56 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x80000) ioctl$KVM_GET_REG_LIST(r4, 0xc008aeb0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x30040, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r3, 0x80045006, &(0x7f0000000040)) r6 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) write$fb(r6, &(0x7f0000000980)="168689fbea1faa9ac5b39bc918929c26e92a2fb5507dfae4d3f31f51b4a9b48769c124e858ffab4294d12076930e9827911c84658af454fe2c691d839c919e2aebb33009c9a22c36ac88bcbcd96a16227d2d944f2153990076752edcf5bd910ec93cf745e055e9d8cc742a56747a29c69c8c526fe55885fcc8b3758cc9ac486af54a75624ec18e5ae96f70413075e26439dc1d4492feca1cebeb747c9a077abae43234a69fe63e37231fa3b625b1814d3a9e2de8bcd2539893e553a8afafbf492110ef5adcabad10e499f37964686b74341f60f7ebffc9b076b0b04f1f496f302f2aca74d802f27f4981e928e383dbf1163a55e97326667c9c9c236b83e365a1975fa72f2666dc4ad8e53a19d178b35d2bc93a389ecf4f55659a64e235b4a4557b080a956bf1a9cbb68afb0ec1bf318c963128bee4633b343fd5657c3c3adabfe2284c655fde1e63acdb24e99a4280c535e4c9528d2815143ed6f77275a2e1c4cef558a05311850393d9e8853833c4b7a6d44908a2bab33e15ced7feb8e3139de08ffea7bc28b5150c4e2693dedd1031bb398d361faf60a9144c2b03e6cdc872d4bdc42e1e3f9ce11aefee18468905cb74ffd7e4b2b40586b897b319b9e30ef17a5f986b5e09bb9bc55c38c77f801797bcb3263d4557607b7a9e9d608e5d948720b0754847df0f802cd756d42fb09a4aa3ccd0f740c5008a5577f6a177a7add5e0d7e06b85c50206ab1166949e0acf7a2da9567e0a33e6e739a7ebee4c2e1199a8c9fa1f181b631ab9d651d2971fdad4af75e0f40009432721fbcd0313f1fa25cc99d8dbc87ebeede02b81faf593437bb73a8dd16824114eace066350ab9b8964bbfdfb47137c3dac7d99f0f0411c8cbeefeaba91e4ef558f7b32b9d2eedba2e79cabca2084efc470f35446b0d500aa4b965f5899c1026e27f2ad2c3257c08fbe5eb4256d94ce60c32d108056dfcf045a0690de582b83f125649cbe3d5d897cf086b45b73a9c8dd2fae2ee2794e3a9ab7ecdce7ec3e405844e3ae90273c8ea0ce2321575fed3b14aebebe0cdd571c1ce643ef4074611fcfa6ba053f1dca96b7f7dd77270de7efc24a9f82e1b53f9f5e7740dc09c3ed95d95ebfeb916445d53f18b1d043229b743cb802d205057b7a346b809c0e51fe2ccdacb6926701c074f09ff7aeab9f7f3898ca90b24b186efe2106022824b012efb5b89039705de5b35dbda5f69b437446ee933e7fa38aebe16e36086f87e84c18c28742bbcd4c3a86744d4f893179ac819ace2f2c1ec5c6079505fa189a10644823c1d74b280a5e710eccd06ca5567ba74d3bea4146c05a6423ee0af3ecf7fee6024e32a437da74ec1be3bf80a60f707bcd3ec3fcf0416998f3ea35274e871eddaa2a0d2e0a70ba7818a3a7c758aa679fa12d375cec7e083faa6456f6835245f7dc69617eec69a9ee4968b286d1347e3f317e959b89a7ae175df7e54bc2424e305b4bb5d12e8ff62eb70460d791fa6f97423f124c539975bf410a4b25a498a8a33be6a1e8dafadeb3fc3f62e5207c52e62f8b1213e5521b652f3d6cf712a7ef77dde04a0ad9b5933c5c3e8408d07110434a66df0983510add6638530dd74e81d2ca8911fd64766bf57bfad5ba5109ae8db46fec6fe54f49e7d17b9b4ed9320def03ba8b0f6d5de578645e9387c5220c43163679f6fa714e962c8275ad73379790821b425d91f25bd3d8efebf64b00742c827fe8339478f6f1aafbde6a229afec60b38617dcfdf1d1c7080960f47d376e35e9d7e53eeef8154b3bef3005119bcc5c793da539f444e97fe09288c541810b6cb0979f1d5bc38ae384ff980eefcb86f64a61b43d8d7212b07d4bc40cf6c0b1b60097aa84a6cba80d693e158b3d03ab7dc35dda2639028168d642b927591d3cd41ea94aec62206fb9a402ea369919c228cd9905131aff8d35d0cb484050a97a1b27d732bc01954e1b39d1a9ddcbe16f9a20a52607dd92639f62808a63062b2be9add5b16f2dfe0a0510c96d41c5f266c2a6b025371b5b44a77c91a36de487aa6b9a46cc617dc4c068e6676c847e811b20bb66fea44d0349c43d27900f0e77e8633c08ae5d88dd3ca19e14f63ee971936b3d53ba57fdf0f6b3eea850fd3df1c99942a64804395e6a2226aa9202fac1baab535e8a66e3d508021841ba856dcc10a01a1d51113e9a87285f8fd1584430e1304fdada1dc4aa84491f7d09f905f7875ae28930b95426015054cfbfad7ee39a5456d27852904d4c3348e5b3a032b7fdbe50392ba207bdfc28ae45abef4cb89b026b3697118701040545cc6ffd7d7c0dd91127529f8dfc756cb425876c6533ae2fd784ea1bbb6380be61474bc883c455928b446b609e3887744314dbd4ee915ee953cb62611d193ecdfc3f1b7507f3555f74c8ee7b58d1ae377d4c03ceebdb05896f3af368bbb18a835127f5739583b6c28dacff34b4fbd9ad4a6e0404f72ca490f45bdef5c44835fb4ef9ba07d8d14dda6a03520f4c9b6d0d6da395e41e1be10441f39c1de291e4b00c5f26e522bff31d12f2cd317acc38d0297319eefee7d5315440f77037fcd715271ff4815f86f8092ed21422ac34c43306061f32a8f2573ae0fa662eaa26ee0a59b5c43ce4ed19832c3b10664aa599872378ebc53cff1477fbf6721fe7f13cddbb370bed7157244b9a0a53f3d412e48805dedb5ec90473573ac665e012a0adf2b779317d2c17e9aec7810991e66470e9fc76d388cc2f4219ef666ba46320a15eb7fd3c34f12a667d939eb7c5818dd3e2d0e675b58fc91c23f979db097be6077e03c68c537766f62c61a2f7f4fd09ccc355fa04c055041dd668b4b4dcc7189a3b2dd4d20b3022155166a6cb0cf4ce4e45c4bc3b7ffa3e94f38a8f3a6d6a9043e99f1110796bc8867b4b0e551ae2a3f9cb1878e3a5663ee0af8411961a35c49176f8ba822765e74a113a029d804e739d762a1d5dddf2f3f2355ce92a1112a3e8b3dc57045c23718c9ae028fe9f8c144814b4ecb7bffe9f986ce1b6a1f43c52a7b2c9defd58914c9f2f954d07b1b96e199c6d8c904f1d528874257528189d595b04050fd7e156505e56e06b80b90714f001c27726b061c76b40813fd399df3398b8cfb0160540caed93531a097261604950a462ec89ed8c2cd1b42baf3fc6869218af3fe4f2319ca22e4a4b196905f052bca38a32f2872695ceb04bbdb3587dc82e0ba0c38885ab96a91ad31553154e8cdd5009a8c09d8f0c691dc807e925339c4a84e03242724f9e08bc780a933e19c8c136a2e0fb557152f5b63f7610cb6c264af30dec78281c016d5c83454b150e71dbe4fcbf795409773f6d19f861c8836fec70e42535af3fcd5c38aef877ad80b15556713b22770576cd8d7d45e13071c55574dbd2d97ef1bcab5eafe81cc17523d126e2ccfc40667ef36f8dbe3fad918340bc610defd6155cb6463998d44c618d620a254180d4ad8b3e5046992ae0f51e4ab686b30b9d7a4a977c92a61d3e78bbbc30bb7552045542e889c53af0649e3d0487af4f5de111d7c7dc071e8451ab0f98f68b9eadf6a5f3ddf4b02b2b09b2e30a35d5085f0970d45c4fb9dca418c867c5a4de288fb7c8c4860f86787873b6ac44db8c3e99ea030ca007d58e8976f8166c31fa95c10c8e729781978185794697cc87c2f658614c9db398ad33741a97307b44f8ce417d46f36921105f0c63b04a9fafb608ef9c695bdde53825ed2f17c834a9ab631f74433358eb731c6307f169506766eba7ebfd80c1dbe39728842a3dddcd578138175fa140bcf5c91de052eb1b8ba80a32e38a78b8f60d0e0cb24b07ad5e193f00e3c84bb9a0714baa78341569ba0e8165f260476c674fe6263f280ad2376d45b1aa36e72c4d1e86e270e62b859a2d14079fa384d7369177f45e7d3baa9017ff6cb06985fd3c0420bbddacaf15a7ce6cf4fe54fbd448746a323ffab4a5815c856a2674b1569c2353bbd7b0803775bbe46959a45c17a119f9dad8bd0650a6c7162b2617d4c0cbb614550f0911c5ab15ecc75eaebcbde29a018776cc023a56bab57d7ef71a4efe55608cf2e2c63b1c078053ec14ef0d3d3764745bf08d9aa85877a57ea9d378a6ed224b20cc614d14dbeed56e134befd1f6065a7cd0b3a0f3476240193df3370052f36394ab7430eabad0aa5519ccfdc30240df2b512ed0184a225e3c5bc9e5d1ee6ed68f21387792834fee40b125846899e8f92b298a6bdaf531f86a682ed5eaad311797047d7eae0a47c4a367e145db353a475894b85167662a546e1d96f465f4d02586e2bef70c9e07d6820d20cc37d4d96d1d6a0fba3ae84f40a18a934c1be19f4a275d456b2c356823e5710b2de842419234936cb0f2eb0ee8be9b8de5dddb095d7815c18e00f625f73cfedeb0c8e93b65001ea108504ac3e36c528cb16d0ec60a3959d638105f19beee53546908dbfa785459a76a1a4497371cb19aff94b5afd82b07346826e7f261a98b49da4d3476984336389247aa9dfa64e0aacc87537b7fa1149c3b63e99fc38cb6f08be434c60efbc427b928b9fb4df04883ee0e230fa38f75f0dd862139bfc89738af1ef7dc9eed5856e223f5a3c431740910f784fdf0ea957af2d2c59d1df6eb290ab881d5b541d4e14bd52f425f2444a79e3aa5521a9a43b043fa72990ddee6d58d01730083708d901d114b9eea9ecdc6c03e837f51a232d4c9c8bb4e41a1e9f6fa9b0108de7232307dd872e7125acc9d594b6f25b279601807de06f2ad8c4273c37754d068dbb3c052a5ff63d660c2fb1ab5e9a41812b03348d6bd3ec2376826d426d7410505edff589495c93f339fa9f08d5b97d129d4901d26feaef1dc78c93b188d8f88953258db303c1218787d4c1491628a86a154fce4a83472fba9219e8d6789daf14ca34ff3f518671ebba605efe145c0b9f1c10043c1a90ce861df56c02572986a941d109936fdc6b8689b10df9c4042fc6a4fa66abe11cb11d77c64da06fdde7ac19e356e393406b65bea222a5dace56961b605cc05a5d99878f0426ba17b847e6cc813c88e1cd0d568a8cca77b6f4a8fa5a90522a1613adf9cc3512e5a267caa7b2c9eaebffab4b9a9cfbee0a7cc189fe3f0b0de8720378a7a3c12798e85b67e4631b1806e085a61cb2336d8b7477a564b99abcdf0add5e5e3818f32ef8e56c283226a6e3125fee04ccbb442b6c62168634a582c8dfdb9aeb03ecc9133cfedcc659685830835e76d8d695da61722ea089d56c058d156344f16562e15feccc78aa4435d4d2e6c17df4d35d30b9b2d93144b22dc5f530ed655710f100dcbdbbe1412982c1b8858e02899fcdfea76d54ac372c8863680285f6f43b2765e1413d98633a3e2ed155b0c30f28249eb2d827d808e5ed99858d9f8926d4c76075e24bae02e886f2e8500f3c9e0fbdf508eb01f14f45da69ae9c7dc996da158eb9f580e37e8fb8b291844266c53a5d448b25717673ff51f70745d17aba5d2da77627d825a74c53b860eca7f5bcf21da4d1ee1a051c1f674abf207163948a1b0384cb7caeae4dbb6bc198f9874b3a942cdb66edff8f557ec332980669fc942c55044bea4949a94c7319e7410137b4e9818005981662c7d9d6489fbe273b0002cd5fbe88bc5bc5ea96658352d95121271e4fea3e5d93bd88c340a6c2e4f47740afae2dc3399014a7a71f51d4e09f51a009e6962ade8e9a3b65219364abda06238f877055ddff5cba4b7739341d7ed8fc707c09e997bdb2f878b228857b551900fb0750874c923de52ceb0bff7b439723b584d1fddaba12fcc30d7", 0x1000) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r7, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 848.235405] device nr0 entered promiscuous mode [ 848.259931] validate_nla: 1 callbacks suppressed [ 848.259941] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:57 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:09:57 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x1000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 848.482113] protocol 88fb is buggy, dev hsr_slave_0 [ 848.487276] protocol 88fb is buggy, dev hsr_slave_1 [ 848.498280] device nr0 entered promiscuous mode [ 848.519819] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:57 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xa}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:57 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f0000000080)="ffd2f934c412535830b5c1c62501f0546a68c5fbe4d4948b3ca7fe18cb9ab09bdb64b896f016dbbe285a9b9f6d8317f98df905e2f46f49116ebfc49e0314deee0485c04b50bf6b9dc6855626373ac595384894b964f8c0746e35780639a78bb282bc916535a4dc6eecc110f8e4b065532122aad7e5c520bee7347261172912e1be6f9d4b0c55ceb99d56207cbef80c6c90412b08debdbfda66a3a6ea", 0x9c}], 0x1, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x3, 0x5, 0x4, 0x1000000, 0x5, {0x0, 0x2710}, {0x4, 0x0, 0x32, 0x1, 0xd7, 0x2, "8e3f7289"}, 0x1000, 0x6, @offset, 0x6, 0x0, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x80, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f0000000400)={0x4, 0xd2, 0x6, 0x0, 0x0, [{{r5}, 0x8}, {{r1}, 0x2}, {{r6}, 0x4}, {{r7}, 0x3f}, {{r8}, 0xe}, {{r9}, 0x3}]}) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x94, r3, 0x300, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x58, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x23}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3e}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@rand_addr="6e3ddb467240abe74213cc2f5a073c77"}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xb40bd5a5f29a13a7, 0x20}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x81}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast2}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4000}, 0x8000080) r10 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x2, 0x0) faccessat(r10, &(0x7f0000000000)='./file0\x00', 0x80, 0x0) 07:09:57 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x20) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x2000, 0x0) r2 = syz_open_procfs(r1, &(0x7f0000000000)='smaps\x00') getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000040), &(0x7f0000000080)=0x4) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:09:57 executing program 2: syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:09:57 executing program 2: socket$alg(0x26, 0x5, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x0, 0x0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2000000}]}, 0x1c}}, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, r2, 0xc6b94a0c4b0090db, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7fff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x31}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xff}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0xf182542261070278) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-sse2\x00'}, 0x58) [ 849.230930] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:57 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xc}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 849.382132] device nr0 entered promiscuous mode 07:09:58 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x2000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:09:58 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 849.861557] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 849.910712] device nr0 entered promiscuous mode 07:09:58 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0xfffffffffffffd15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x7}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:58 executing program 2: lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)='trusted.overlay.redirect\x00', &(0x7f00000001c0)='./file0\x00', 0x8, 0x2) getdents(0xffffffffffffffff, &(0x7f0000000080)=""/206, 0xce) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) readahead(r1, 0x3f, 0x5) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:09:58 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xe}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:58 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:09:58 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x3000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 850.028034] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:58 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000000)={0x0, 0x7551, 0x6, 0x6}) pwritev(r0, &(0x7f0000000640)=[{&(0x7f0000000100)="61e68258d7b8b4eb5430184fe3ae7c5cec7b92306d4387cff42d5fc1f83a0fca2a353c5582960386e41891b703b703e393f1bcea4d866ce827877b7d4d366efd03542b93", 0x44}, {&(0x7f0000000180)="de67632bac667ab3a387e587154c2d0f1480cac71e4fb460012372cb4d3f10565cc081a60b1cbef93b3501f74a7e5d04690b71036c79728070dc4ca3ad3e4d4461703f40a2ac4323044fa111d728447abe5447246b9c00c1423beed5a05610a04b8e88568711f164ce0c336a69fb799257fe638f658facb9962c2ead4803a5e5ef070557d541112909ea51d5a68d7087f0bb60e5df2e4b1206b2db6ac5d874521ec530cded571c7bad9c17685a58a970ccb02044053b313cb11507bc2024af18b1452cb1594229869e6c77be82f165c22cd5b13e067fb82a2a41e05bd63de2eb0224f0eb2d166b70f2697b67843a32d985e5ad13903e9b26", 0xf8}, {&(0x7f0000000340)="b8bb14bffc2e694178c90ffc5e516d21ee9702384221311457d9a893923c892f4fed41913d3f624f89feec375e4543000d6c877a61802e9abc8e2174498c292b8f6e94e73822161da92276eba09d230179fe4221147bebe25a6604593b0ab1cc8fc7caacfd3452b4f494a843f911525e68986f28557a629f9554fc412145e34df1a1f3a2d2ed5fc763ac5dc62f9bafc4481dc3a8aeb235a68caeb670d699b883d0292bad85aa2ed79a470940e2e78ceb8203e2440e379dd3ff9619168a16d5c8bcf0dafbcd5b182a54084777cb4e2fd1d990bb2b68", 0xd5}, {&(0x7f0000000440)="e9a6d47f8a7e78c03e31a4e810201d6eebb70d230d0d32e95a4d23907f80477acc3d33983d1b55f5f2a42bf849195ba313921cfe92198bf43d07bbb04a01fcc79b27515940bf38f07ac650b72397524a643a8824f07eb71b5fbd31c860316cc1118239fc01897b7f5590038a014598bf51bf452457dc7de615ddf501d060a9929af759e5e9a4f14f95845b3aff7bde178ec1e0b7fdc3ef38e1dcf4dac07eff1ad2444908451d831daba8a8c68416fb08aab112f57d5646db9870fff70cdd5e6333dd1edd370ce75271866a070a1ef1754938", 0xd2}, {&(0x7f0000000280)="263ac95af96da66bdaf153423647cb831dd6628bd913838f9cbff45b10877de496493f31b8696c52cbbea78fe3b5010df77ddd19dc35a11b6fa2c7a82bb8fd8874cf4e67cca12bd8cc81024d1a031f29c0e99dae32c275ae44b01567245aae46da33be4f4b4d9cc4f939a0a84ec458afa821471462", 0x75}, {&(0x7f0000000c80)="902eae21dd51d7f8ad36f6726b2b12e3f8499051e4f3b24f315e12f29da01ccb852258ef28eeaaef6b04e3048fc2dd0fe7f3ac4f905b6c5700b136a12a9df13039a1225caaf3b73757c6dfe797bc9e5c319035f0375473f386f33e25236d321a22ce8919bf7ba84d881d918a32220a46b2b0b897cc255c82a681d6492c57381a23fa0886aac8bf7b5b0d6150b3a77f83f6004cdb4d912de426f2ca9025a56bdabd8ee5e8ea7a41dcd57b3efbfb0169fdf23c54485752a8c3c8e43be0255b3c5ab2932253ecaae59cbcbbc5fadd85e45350152e755e9b8e9741f7a078927a26d607a41b49575be507b6ab6ba19177d0ad4c18b0ab813ae4c51ba3efae2a461af7dd238da9f0c690a7df79fad7d08d1f70d1621754f55cdb55706e752817533c33006735485e0701c0811ab960152e1f9c1300ee9523c02bc54460f7872f880cf66b8a063f6c8eed85e3f4ef3d5cdbe8f32c003c4aad033376704740a6374fdf35ae7cf470785b44f1aba252fc57ecce6387e4df0b52bb7c31c90873218dbd244fdf710178ddf07c38ff8d97b43e2e2798c3b595ffdf8fb1636caaa2e5aceda7fa620d8f0dbc058ef0d35fd4a7850066ead9d8602a31f3bf5e60f327e6a4c1857ff9fae7065a4dcfff09a37cabe01c671ab815c6ff72cae1f1840f2c4c65e48f0244c55e66673710b4d20b5299e538e500c75ae6519123de03dd193744b514076d6c4073c133ff1f7b0e5ad5a8189799e6b684b3715ef1d38724bc93d60d71a88e13990a430cf3e54f25bed541c9432c09b403b54f4b7e31c1a91fc9eb228bdd644d286813f0d20706f903b043d4cb4c05300b335503c43e96a62a0952f4313d7821db211a9b85fbe1ad67baabd24a33d87e3fcdd8632bab7550bd94f09c73b75486dfd307f9fcabe736ac0c03e46acd0b438bc192d449487dea352ec251305e6139e6113ff397c609294c913aa14b4ad98a97fec6612ff815e41285f715b71a88b862f120a5da40487cf27d5a09ae083830b291b32cb6cf7680dfeca80318378b15c09b70c831453cffe560e0f3e468860390a0acf7941c36a79d9b773f5112a38fad42d1ccd300b47f1b1433451e12f9a9c188cb13dcc2e75f493bfa0354f14c7ad8d8a01c438e9043eab7705cf1c4f8a4410f68de9b8a2647c63667bbf01933add04d0cab3186e76c14c05b63f338297dfdd4e94dd49722a9e8b1da8aefc32929bdb4231b946b1d0fa002dadf13a20fda3930177777da6b4f238fd1ff0e7e3440b3872ce064eb2d90091daa1ebb10ca547475f6c824c2ef482e333c8bf161399549ca2e20c1ce2b71da738b9d3a238b627630bf43260e365069f2c9898180f8557f077722a621a3b7370edce4e31ba16d986d43dc220c0a50ef140b172dfee7aa322a6ea4a9efcf0317932ad72bb0fb40abc07b007a94b2e7a2cb0dce9bdfca93929d5cb18685f0957c442177a53bec7befd774c48b3261a7a702b8f4cb9e0cf490c7e219e3dbcc8adbf51b176b6fa96140d84a6bfd3513a070361c54ebf409be03a876a0ef505d3199601c9fa1f1e08e9422de3089356301a459766f6a60a46af0be07e96c50a67d7e91ca7223d579aedd2f1315ee1b90daa277104b88a2b5a8e57c3c0a5cc60029246559142c183237f503d3ab1226954c5af54035fc205df3bc8765c8d02abbf3f9710708d7f79144c89ecef25e5774567b2c68bcdab245668391cb443e08bb9e0b15c413bd5aff3723586ba2cd1c71614c27ab4f9b37a180409f6740870943b65df2f976e53841736bc4ffb8ed26da0531dae55b358ceae152eab312c783befe79dc6d58187569629259ff8ca99b6a021a745ad8912ef44f6d107c4e05d3af5324010b66fd03cfbe8644f499e85a5bac7784f8334ef6846afdb1a17cb13a35f900502a01bd72f7995eafa00bbc26f7facd109f6eb245808dd065eeb2303eb57f15d79f9582640966f2bcd2e4ac54aff0b878941e63704f51877e4b57a47f5f7b9112d301108146f7b84d5bd795830dc6608b20492e60c6038402ae0531fa93aa0db558336d259d5bc7a6d53a5ff2d4a4a5d4fbf6cb01214ff9ecba625e7c671559550c7c5eea8d7e969a08431faa57de2ddd15d391f19ab3bf5038d08efbac7b7ff646675f668c16f637688c03775271e99a7dead71ece8b3d9ae4c1861998b479bc771f7ec0ee6011112eda20fed428f14266eed910cae96a097ca5ad4d52a111f7583df4339b8cbdb0ec9e5b0f249e6830193965e5ad01e9f5e99d88b85d7340a25b23e349362f2b79b11c116421d7c40d1fc6e087058a37bb602691acbc743fef8844a99ec17065452a7ae491e55c81cdcc6b338f589a2dd5d5b5bf78de8be5d490ff8e0dd1902ad1ea498cb81fd0b1ae67bff5193f4a9f2fee4a28f2b5a7277c2bc23b0eee5a256332383a95fb37038325c39312908e19cf8f428a067052356f461fcc45affe7f0c01a97eef56098c69a1951e149272fbd3a565091fd47c4386f241ebc4298fb792fc4bf623470670bf2c4287bd59489e5cff38b6be6a4be3f1a255e26963962a0c8c4319fb7013e1e17952d2c42672f1dd556ce2dc9cdf3db5562449d848ee41d5ac4ac11fae9ec8bc46f47595b4dc2c24f174a89ec6829161a6fe71a65819c5e8add6c363bd8f4d25fd90afcd2a891ade8b799fcf629ab43266373b4ae997e336470ac1fbafd6e899c71a739eed2e80e1942f4e93e50a5d8d34c96f024ddede226ebe0f1b24560fdd07dff51278cf42cb4e9b83c2b12021dcaf2431edb39ef9403aab7020ed82b7c6eadd08bb9cbfc013156276ef14100ea318a7279d78824aecb33c963af628cbc98daa8f1c97367dca64a628de6ae81c606bb117650b4ac056ab3ae817e6340764d020a1b2c7ad9165982e4589cd55bbc9f39968241821ef74965f2b8b620f1fdfe86e5603b85c83e46eebc08010c969ee5ed83c5f43bd0dfa2075173abbc9bc5389e815e38c073f7aa63a456e9a2d950e23a65a02acaa1394b0f4ebfa0fb01c0f4c7d1d3f3296b3aaa933f05c17374cc5457c519e2e3c9b48b8ac7774f854dd1a213f48063353a160dbf458149cc1ce41d7bc4d0f2aaadf6d80ef3f72324d3a76c699ae1c0437d3c8bff7776d8e64f86b01eb282c42a348f4e75fffa599762e40a290ac3777ea595a66cc582c942c713f0b947bc92c0104ea8dfaf45b4b96deda0f4c368037a65720a273b475c5dbfd5cc91cb761adc1086714f15e48ae1c97842061ca56afab79afa1d32c9dbe0db132270b2f8f0ced10c39ed3c340c1d1d9e08d86acf8b332f07fb621669bdd987e66ffb4b306013869848decda178a9d330a837decced23e90b25f2a95ebb6ff4faf9474ac3e72439a3bc59c5e8d740aedc151ab63b34a4a0613cd67b35646f3a1be642ee780d65ca240eec32f606ff919c617174077102019f1b59b8913543509333e6a1791f474294daa9d1406b3657d14354d5201eb56cfd1e2288d05f4c4afe07537400736ca20809e835b35fddc8af5fcb1b953b55c81d36d872f62404da89478ddda96cf5b20a06427c807037cc6395a7e3269f8ade3981adb8dd966a92313a47e4f845e16c8c6dfb28ed9cbd4b9043bbf2e2f30ef8d560398b30f68cff946a9514e7df4a9ecb45a12f3192076d49c102fc7cb4ecd00262614c2d851cf75f288b523257bfd1ea4bb4c5b5cc4a9620c108fd14a3c7f03ce2ab6cb45ffa7fe9ebb9ae2f81992953bec47427b20bd6420cf352774ec04a9326a0a262be230d4e05bbad07bd43abf9d73f9f2156566d28a2cbb31a0dd5940112baf433f29d8e7779e537684351d1a3966ccd544dc1189921b544da49934eecf87f00bae344874a1ba8f4ffeacffeb7fc5ce239db511d3fc5e9277729dea75cab48fdf726c49a1cf724d4fe78f50a53a80e4fc27b61d68c9d3c1e30de970bbfc95bc3c65c8d1be9ef5a78e5c14d71b63875a4ec027a020e9ac529b54bc32de88be56201d3ec33fbbf063eb71d278e374b6023e4c8696109bd75589c6684e035281b23f874692b6e0308cf9f4cd53b88e201a700e6e2faa843fbf355bccd21ec11870c22038c1052b28c7f17e0c45e617bf88fe7962962b1eff86f192a49342370e19e50189d1f08b2bfec53361fdc747052d4ae7fdbb11616707b283aec5b975bed995d0aee4ccd23fe0c133d847decefe06c6cddd5de26bf48b2248c2c5cf7964fbb88b442cc01d07c892bfe7336fb36ce67d80b92109c54d1e429a49b212b8e67924699057cf382b46124ece402a648de3ef4f6c850fb9e7b3c46007a9425bd509f7505dc050a633eb52d88213be6599aac3efcb46e6f3eb47a979b3e3a9fd8c15604384d6819521ed59d11edcb37d0b198b1df9c9b93c6ca9b7a1cd544c51fce5657e9a2e2a8879b2eb592188ef677a4aba43040dcc105f63f5f1a1b1ebd26aaef3d6b892424e028e4394719599fd73a6498df4f2c640ea57f7216e999ce9af729867495bddd4704e04e63b90489c49013206775e6d01bbf3ca14016223ed5bc8069bb773ae9a178b2d2d81cd6a74c219365a7910f1dd61102afeb3db150985c94bc574dbfb9e05d7833cdb5801bcc1a677d849a84c8f532f3c7fc39166d9bd921260b18e0265801d9a17d4084f86b2d98e8ad063e1fcf35de6f0a70f515613d023192853fcad0c5d37fa7e21e3a828ab4ed461e6536cfb808feb0c70e24656a558f7373fe8a1823b4655789e636ecbb0b2155458d3e0279960f7bc94a7670ceb8cf8669b992b89bc9047f2738ecd35f80c1b9b02f8fe4a5dbfd5c9dc858524b6b08215c2abc2b8edc00ac9bc15732cb96e1a77d87cefa19de3ffc74f1d575493c3885134adb6a4d6c8ca9a510e52ecedbf1efd59f6b429fa146c343fe3ca4f888979982e3e9e8db4e79868b9f14308ccd775cb61f7ed594de6f9009f8e82e584396e1b7f3b19a4528f374499f2d4928442ad5ca0fafb24f76928cf1d8f0fd5a6a700aa3a34788e19629e7c8bd86c07087a0f1cc3f0696d32a048dd8e7d0e6047a93c6f9c3521dcb591be3785de4f5dd99e00760bbef1382fa6fabf4d9b47a3e036920022035b348e40771f7c244f2cd3251219410535c0c5d68f088b564ae8f01a426d2490fe263ae72f37e7f8344bfb3bf87d765480de4e1c98f034ce64d72d496adceca92be99c3542e988421e2fe7a57bc9fbb59709616673ee72baa1888cfdf3f1f86d9eddfa6f01dc7acc2971e0b0bd510a701a5f5c77961ee7a30a38516c594d28e27066155335f424a75d1409cc8d86643e9d0283a68949548c5cf2fba28f070daffa7c9ce1578f9a9d02292f122e61e2c026719c74fdd0e083a2472aeb8b0939746a4928dda5b918bad81107ad1f5f183bef6c592d64019f7934350da43182ca5d07f59a6021154703402796a1234d6079973107b4449a4c8f6318a89f13dc72a9c4c8bc6b8252c0095ced1ab97f3a4db2578a710d04088656e1e13e33d7a01ca685525adcab9858120923767aeaa54f20845b0c2a8f3e883d0b056e15634c7a2461de16489abad3dcf60f2501aa502f58a4ac798842b2cbce98c488dfdcbab19d37d350b7df1152e185523aa2514bc4d995373df22c9583e2d815fed81758ea36fad6f0a36a09acb4d803456d085b45262ccd26eb1d127aa9cb13c48ce1503226f78bc38d6f455ec7b8156016196883fd50985f9ca9a7acf2f295ecb763620e9864fc39660f4fdf3370900649e9e5ffee9e645e9512e49ce209619a81454d9db6c8a453f1951df2e381000c836f927ab7b654db9461c1", 0x1000}, {&(0x7f0000000540)="c46005bda3887a1ee9c03ef8de8d2121e85b56fbb4d66dcebc31e53ba0e1d0de03951b63ba6fc64070ed10898fe1f25eea5b4e4f9a908613b8f3a3b93916667251cdb3e987db70fd3aeccb61141dd79ae4a46f8c6e0b6b5d90851007e8551b80d745b702cd548b8d32edf0a8bfd71bfa6cea9af91ec0e75dfda9e0bf6b689cc9766c7d1075dbc2ffcf1f6c29138eb82dd450f7568ead6b1548f389939fd8118c064caf4af4047110c90369d4a55498d9b3b83f55dd05c93058f1367ce20000504512530812d522da4b0861782373d663d246aa096ed329f8c074cf84f6f2ea6cc1fc5f9711c77055", 0xe8}], 0x7, 0x8001) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4$unix(r2, &(0x7f00000006c0), &(0x7f0000000740)=0x6e, 0x80000) sendto$inet6(r2, &(0x7f0000000040)="5fad703ca7f94f0f2279c2cfd145da17110cfd753030e11540be378aa6585a08c9001cf73783e11997196f7ba509cc459e8656e02fc46faf987e53842015223d1b39612a1196d48638a7981d6c9ae47f0ecfc82cbe6d9b272ca48780a324ea4c7a34c4423b99127ebbd1d39a06b983be8cbdf47a3c60f7d953c77321f7ab5df0983a7806a354e207a87af24c539c954556dc5206", 0x94, 0x2000c085, 0x0, 0x0) [ 850.175693] device nr0 entered promiscuous mode 07:09:58 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x10}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:58 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x20202, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 850.251565] device nr0 entered promiscuous mode 07:09:59 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700000000000000000000e1c0", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="740000002400070500"/20, @ANYRES32=r5, @ANYBLOB="00000000ffffffff000000000800010073667100480002000000000000000000000000000000000000000000000000000000000000471a00000000000000000000000000000000000000000000f3aff151ed1e4a08c07fa96752c88f8ca2454f9c9ed6974ba345296ca6ffafecb3ab42207c5c129c70d7ffb1202624af00"], 0x74}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="7c0000002c00010700"/20, @ANYRES32=r5, @ANYBLOB="00000002000000000300c4c1080001006270660050000200080006000000000004000500400002003c00010000000000eeff0075da891600000011000000000000000010000000000000000000000000000000000000e4ff00ddffffff00"/116], 0x7c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@bridge_getlink={0x44, 0x12, 0x100, 0x70bd25, 0x25dfdbfe, {0x7, 0x0, 0x0, r5, 0x1b400, 0x10004}, [@IFLA_MAP={0x24, 0xe, {0x9, 0x1f, 0x0, 0xa1f, 0x7, 0xff}}]}, 0x44}, 0x1, 0x0, 0x0, 0x30044821}, 0xc03401620b14ce28) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pwritev(r6, &(0x7f00000004c0)=[{&(0x7f0000000380)="81260f0f2ae7ef8188378d76206242be2221e6fe9b94d66f8c8680053122b284c6ca6f4d86ce338f3502", 0x2a}, {&(0x7f00000003c0)="5dca89c6864a14d8aa0af89fed049eb7162b00eabd473cd3ac87e47c7c2a8415f25904628cab1b747173af57c0af0853d05e7437e888177e46a60f2781034a9d64c0e0e9d1f15c65de52212b1d875e866e76b7bb68d7f225de7a", 0x5a}, {&(0x7f0000000440)="6fb364c9dbc56f077c374b2f888fb9a6c2f830cde8f1625cdcede49d47213626cdee0a61bb", 0x25}, {&(0x7f0000000480)="8893", 0x2}], 0x4, 0x1000) [ 850.791846] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:09:59 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x4000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 850.911632] device nr0 entered promiscuous mode 07:09:59 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x48}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:09:59 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040)='/dev/n\a\x00am\x00', 0x200, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 851.356897] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:00 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4c}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 851.520266] device nr0 entered promiscuous mode 07:10:00 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f0000000040)='L', 0x1}], 0x0, 0x8001) lseek(r0, 0xffffffff, 0x3) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r1, 0xc02c5625, &(0x7f0000000000)={0x4, 0x1, @value=0x20}) 07:10:00 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x5000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:00 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = socket$tipc(0x1e, 0x5, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r6, 0x8982, &(0x7f00000000c0)) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 851.662164] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x60}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 851.831366] device nr0 entered promiscuous mode [ 851.842721] net_ratelimit: 6 callbacks suppressed [ 851.842748] protocol 88fb is buggy, dev hsr_slave_0 [ 851.853347] protocol 88fb is buggy, dev hsr_slave_1 07:10:00 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x6000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 851.931208] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x68}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 852.242112] protocol 88fb is buggy, dev hsr_slave_0 [ 852.247230] protocol 88fb is buggy, dev hsr_slave_1 [ 852.530720] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:01 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x7000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:01 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(0x0, 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:01 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6c}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 852.642114] protocol 88fb is buggy, dev hsr_slave_0 [ 852.647243] protocol 88fb is buggy, dev hsr_slave_1 [ 852.687799] device nr0 entered promiscuous mode 07:10:01 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x74}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 853.225930] device nr0 entered promiscuous mode 07:10:01 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x8000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:01 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x7a}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:02 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(0x0, 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:02 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) r6 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x80000, 0x0) ioctl$PPPIOCATTACH(r6, 0x4004743d, &(0x7f0000000100)=0x3) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) r8 = semget(0x3, 0x4, 0xa2f4bd2e4354fb44) semctl$IPC_INFO(r8, 0x4, 0x3, &(0x7f0000000200)=""/190) socket$nl_netfilter(0x10, 0x3, 0xc) [ 853.434452] validate_nla: 2 callbacks suppressed [ 853.434462] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 853.501410] device nr0 entered promiscuous mode 07:10:02 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xf0}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 853.524715] device nr0 entered promiscuous mode 07:10:02 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x9000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:02 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(0x0, 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 853.702229] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 853.780747] device nr0 entered promiscuous mode 07:10:02 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x141}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:02 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xa000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:02 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 853.922084] protocol 88fb is buggy, dev hsr_slave_0 [ 853.927224] protocol 88fb is buggy, dev hsr_slave_1 [ 853.951041] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 854.094030] device nr0 entered promiscuous mode 07:10:02 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x300}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:02 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xc000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 854.322102] protocol 88fb is buggy, dev hsr_slave_0 [ 854.327243] protocol 88fb is buggy, dev hsr_slave_1 [ 854.508186] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:03 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x500}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 854.621219] device nr0 entered promiscuous mode [ 854.689858] device nr0 entered promiscuous mode 07:10:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xe000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 854.720825] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:03 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r7, 0x84, 0x15, &(0x7f00000000c0)={0xf7}, 0x1) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) ioctl$VT_RELDISP(r5, 0x5605) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x10000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x600}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:03 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 855.284123] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 855.376310] device nr0 entered promiscuous mode [ 855.388494] device nr0 entered promiscuous mode 07:10:04 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x700}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:04 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x40000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 855.505716] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:04 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:04 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xa00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 855.705551] device nr0 entered promiscuous mode [ 855.797620] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:04 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x60000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:04 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xc00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:04 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x65580000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 856.660486] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:05 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:05 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xe00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:05 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(0xffffffffffffffff, 0x40a85321, &(0x7f00000000c0)={{0x7, 0x4}, 'port0\x00', 0xdc485064dc16b7a6, 0x20030, 0x1, 0xfffffbff, 0x8, 0x10000, 0x87a, 0x0, 0x2, 0xb3}) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 856.909514] device nr0 entered promiscuous mode 07:10:05 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x81000000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 856.942182] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 857.095306] device nr0 entered promiscuous mode 07:10:05 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x2000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:06 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x3f00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:06 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x88a8ffff, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:06 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:06 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:06 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4bf3496c, 0x7ffd}, 0x0, 0xffffffffffffffff, r6, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:06 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x9effffff, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 858.082116] net_ratelimit: 6 callbacks suppressed [ 858.082124] protocol 88fb is buggy, dev hsr_slave_0 [ 858.092101] protocol 88fb is buggy, dev hsr_slave_1 [ 858.130554] device nr0 entered promiscuous mode [ 858.157634] device nr0 entered promiscuous mode 07:10:06 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4101}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:06 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(0xffffffffffffffff, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:06 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xbf020000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 858.384257] device nr0 entered promiscuous mode 07:10:07 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4800}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 858.492136] protocol 88fb is buggy, dev hsr_slave_0 [ 858.497278] protocol 88fb is buggy, dev hsr_slave_1 [ 858.796060] validate_nla: 4 callbacks suppressed [ 858.796069] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:07 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4c00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 858.887372] device nr0 entered promiscuous mode 07:10:07 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(0xffffffffffffffff, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:07 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xc3ffffff, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 859.434984] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 859.514436] device nr0 entered promiscuous mode 07:10:08 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5865}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:08 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:08 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xf0ffffff, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 859.606915] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 859.686967] device nr0 entered promiscuous mode 07:10:08 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(0xffffffffffffffff, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:08 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 859.841377] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 859.927675] device nr0 entered promiscuous mode 07:10:08 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6558}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:08 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xfeffffff, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:08 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 860.056554] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 860.162112] protocol 88fb is buggy, dev hsr_slave_0 [ 860.167315] protocol 88fb is buggy, dev hsr_slave_1 07:10:08 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6800}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 860.293159] device nr0 entered promiscuous mode 07:10:08 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xffffa888, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 860.331524] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:09 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6c00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 860.562126] protocol 88fb is buggy, dev hsr_slave_0 [ 860.567246] protocol 88fb is buggy, dev hsr_slave_1 07:10:09 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 860.920031] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:09 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xfffff000, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:09 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x5106, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0xd, @perf_bp={0x0}}, 0x0, 0x7, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 861.010382] device nr0 entered promiscuous mode 07:10:09 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x7400}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 861.151242] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 861.198947] device nr0 entered promiscuous mode 07:10:09 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xffffff7f, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:09 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:09 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x7a00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 861.353754] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 861.441235] device nr0 entered promiscuous mode 07:10:10 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8100}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 861.842094] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:10 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xffffff9e, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 861.907661] device nr0 entered promiscuous mode 07:10:10 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:10 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xf000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 862.252090] protocol 88fb is buggy, dev hsr_slave_0 [ 862.257248] protocol 88fb is buggy, dev hsr_slave_1 [ 862.451308] device nr0 entered promiscuous mode 07:10:11 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xffffffc3, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:11 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:11 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:11 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000498000)={0x0, 0x0, &(0x7f000024dff0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000000000000000000000014001200ff01000000000000000000014ea0d3476f3777de0d9df599a107656d7643e07564521936d5bc681be6beea81e9a3bc0c8389b9d7d49b881b70b1e75f64f281f4f7912644ab7a5bf3e08604edbf4075afa771c3e8decfe9bf3f618efb2bbe180c14ef183f15fba1483e18fa78"], 0x28}}, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r7, 0x84, 0x21, &(0x7f0000000140)=0x4, 0x4) [ 862.727097] device nr0 entered promiscuous mode 07:10:11 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 862.748940] device nr0 entered promiscuous mode 07:10:11 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xfffffff0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:11 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:11 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:12 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xfffffffe, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 863.619645] device nr0 entered promiscuous mode 07:10:12 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x40024c080, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f00000000c0)={0x0, 0xfffffffa}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000140)={r4, 0xd1, 0xffff}, 0x8) r5 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r5, 0x0) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r6, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r7, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:12 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0xffffffff, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 863.749968] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 863.776489] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready 07:10:12 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 863.803142] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 863.831259] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 863.857859] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 863.871709] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 863.885648] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 863.900953] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 863.922575] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 863.942982] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 863.957607] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 863.981954] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 864.003777] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 864.026716] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 864.047356] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 864.059509] 8021q: adding VLAN 0 to HW filter on device bond0 [ 864.067193] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 864.073529] 8021q: adding VLAN 0 to HW filter on device team0 [ 864.081021] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 864.093098] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 864.099975] net_ratelimit: 2 callbacks suppressed [ 864.099985] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 864.206859] device nr0 entered promiscuous mode 07:10:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:12 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:12 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 864.309905] audit: type=1800 audit(1577171412.878:1147): pid=22217 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="sda1" ino=17239 res=0 [ 864.343327] validate_nla: 5 callbacks suppressed [ 864.343338] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:12 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) r3 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x7, 0x20000) ioctl$BLKROSET(r3, 0x125d, &(0x7f0000000100)=0x7ff) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 864.550081] device nr0 entered promiscuous mode [ 864.563544] device nr0 entered promiscuous mode 07:10:13 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 864.672363] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 864.700948] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready 07:10:13 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x2}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 864.722607] protocol 88fb is buggy, dev hsr_slave_0 [ 864.727984] protocol 88fb is buggy, dev hsr_slave_1 [ 864.771108] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 864.798071] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 864.820271] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 864.843820] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 864.870340] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 864.895204] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 864.915756] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 864.940199] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 864.978015] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 865.016568] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 865.051023] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 865.088737] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 865.109144] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 865.122099] protocol 88fb is buggy, dev hsr_slave_0 [ 865.127257] protocol 88fb is buggy, dev hsr_slave_1 [ 865.142255] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 865.148695] 8021q: adding VLAN 0 to HW filter on device bond0 [ 865.173587] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 865.182265] 8021q: adding VLAN 0 to HW filter on device team0 [ 865.198344] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 865.220237] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 865.239854] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 07:10:13 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 865.705851] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:14 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:14 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 865.784737] device nr0 entered promiscuous mode 07:10:14 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 865.889630] device nr0 entered promiscuous mode 07:10:14 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x4}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 866.330615] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 866.347120] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 866.367095] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 866.387167] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 866.402117] protocol 88fb is buggy, dev hsr_slave_0 [ 866.407251] protocol 88fb is buggy, dev hsr_slave_1 [ 866.424256] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 866.442976] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 866.450114] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 866.466334] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 866.481454] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 866.497398] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 866.513169] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 866.528285] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 866.547478] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 866.573356] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 866.584461] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 866.594835] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 866.608734] 8021q: adding VLAN 0 to HW filter on device bond0 [ 866.625049] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 866.631169] 8021q: adding VLAN 0 to HW filter on device team0 [ 866.653521] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 866.660653] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 866.682220] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 07:10:15 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:15 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f00000000c0)={0x4, 0x6e176b4e8737b3a7, 0x4, 0x70000, 0x200, {0x0, 0x2710}, {0x1, 0x1, 0xff, 0x1c, 0x7f, 0x8, "c0647a7c"}, 0x9, 0x2, @offset=0x8, 0x8, 0x0, 0xffffffffffffffff}) getsockopt$bt_l2cap_L2CAP_OPTIONS(r3, 0x6, 0x1, &(0x7f0000000140), &(0x7f0000000200)=0xc) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$inet6_opts(r5, 0x29, 0x39, &(0x7f0000000240)=@hopopts={0x3c, 0x1, [], [@jumbo, @jumbo={0xc2, 0x4, 0x2}]}, 0x18) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r6, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x2008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x10408}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) sendfile(r1, r7, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x5}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:15 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 866.917629] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:15 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xc}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 867.106111] device nr0 entered promiscuous mode [ 867.125656] device nr0 entered promiscuous mode 07:10:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x6}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 867.202084] protocol 88fb is buggy, dev hsr_slave_0 [ 867.516795] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:16 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xe}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:16 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:16 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000000)={0x0, 0x80000, r1}) pwritev(r2, &(0x7f0000000c40)=[{&(0x7f0000000040)="32ed2f5d551bb41f79f4e3502319bf8caa21e87979b5b96d783c7826182725e45104354f19fbc0615ea36fce014649fa2a84a65316e342942c87e53f7232df0530678b4121cb7fa101038d9dd9d22c01b2f7772dd4faa12bd5a2acd3a0c2b8988555486882ff67bc8d1075525d3ba17a6759c985519895c10323c64677fd8eebc967b383d986be7229441c5d6925faa92c0b14ffea2e27f9072996697c8ec9c3af5aa3a6a2e149b134f489a8045627849d71d55eeb5e44fc65c603fe", 0xfffffffffffffea8}], 0x1, 0x8001) [ 867.607136] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x7}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:16 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 867.735858] device nr0 entered promiscuous mode 07:10:16 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x20080, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r0, 0xc0106418, &(0x7f0000000040)={0x3ff, 0x5, 0x7ca5, 0x7fff, 0x11, 0x2}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x4000, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000000c0)=0x3) pwritev(r1, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r2, 0x8983, &(0x7f0000000000)={0x8, 'dummy0\x00', {'syz_tun\x00'}, 0x2}) 07:10:16 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000000)={0xfb}, 0x1) pwritev(0xffffffffffffffff, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 868.152221] device nr0 entered promiscuous mode 07:10:16 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x10b14}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) socket$bt_rfcomm(0x1f, 0x1, 0x3) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:16 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000080)={0x3c0000, 0x48, 0x20, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0xa30904, 0x80000001, [], @p_u32}}) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f00000000c0), &(0x7f0000000100)=0x18) [ 868.173179] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:16 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x48}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:16 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:16 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0xf, &(0x7f0000000040)={@loopback, @broadcast, @broadcast}, 0xc) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f0000000000)={0x4, 0x8, 0xe5, 0xffffbf5a}) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:10:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x8}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 868.426879] device nr0 entered promiscuous mode [ 868.443513] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 868.482195] device nr0 entered promiscuous mode 07:10:17 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4c}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:17 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = geteuid() statx(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x1000, 0x20, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r1, r2) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0xa987e5ddcf645d97, 0x0) syz_open_pts(r3, 0x10000) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000040)="ccdf4fa7691afc306f72cd1337c9662a709b9aba0ef7de6e17fd7f3e1a3646779ba9ba749563a926d037d91381ed4acc19", 0x31) arch_prctl$ARCH_GET_CPUID(0x1011) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:10:17 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x9}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 868.663427] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:17 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:17 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:17 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={r3}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f00000000c0)={r3, 0x5}, 0x8) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000000)=ANY=[@ANYRES32=r3, @ANYBLOB="00000400030072000100"], &(0x7f0000000040)=0x14) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) [ 869.144972] device nr0 entered promiscuous mode [ 869.282103] net_ratelimit: 5 callbacks suppressed [ 869.282111] protocol 88fb is buggy, dev hsr_slave_0 [ 869.292117] protocol 88fb is buggy, dev hsr_slave_1 [ 869.644208] device nr0 entered promiscuous mode 07:10:18 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendmsg$tipc(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000100)="c087e2c0afc22e24c89f684ca52f2bfd3ab28c47db927dfbf35b5cb8e6a88a5cc75fb7100433e7dd786c1534f738b0b6710388657c7e560495c622a443b849cf8a41e1dcc7", 0x45}, {&(0x7f0000000200)="208e3ddc999cd6d06eacf0c410a9090b1e2694d61ce393f0cc2d52b10c268bda9c950c26ea36874232820c5b3c2c1e8fc118b5016a1af9935e3981ca8937352d8c45de005668f1d4b662587f6a687ec40f8ec31a6045818a77ef70b6de3d6612367e572902e05acdd6e1dbce23582119957f4f4cb8c6c56d77cdce3d4a4ff0beff0f7abe96d4b49e3b32c91c37a7ec55414b100d846625032d41538dd10b9a45c8846f2b5c6175b33a13a52d929487572be8844a2dc449eeba4132", 0xbb}, {&(0x7f00000002c0)="0598b7ef287aaa6a170e827f1e4964f6f8dc1021b5aa213877de44dd9e4812ab3ea87cff8880de26f888e3098c43dc9b3863e2", 0x33}, {&(0x7f0000000980)="37a31ddc5dc15ac3a6aa3b5fd944cc181055d6e7d0e4305bc7d3383ea7a74894e487ec7df770392b1b4db591e7120d5659eb3d336fc86c5405a2334abb0ada30d6d403f9a491be40ffdaa7e1cc8cd68c7291b80e176275484fcc33e2ca91cda14751f3b1758307e57f18ee187080ea3c786170c9e189065736b841f917efe4fc6635105f72503db473b74524680aa556168a823be7627c619136db82a83f41384c51ee6d7d4230d46ffb260331f1f6dcd264153e6f689ade443ac103da1e5a7313f622ec544d15a9193cad744de22e3d0e2aa65db021bcc377c3d693dd2cbb871794359cd274aa1d28ee5abbb9cc7682b4e42efe42be2297fe2472c9099b415e4a836bc992d288c59fa583399c644d28be27450b6174c42b7ac53d8a2717bfe99a379a966fb2a5df1df5f701dd10f4edc40f84273084b714bd9949a8ed43caf4ffe448059226d87188ec7facb6d13ed269878a74fc2cf63abe56de3ca8ef311945bc604250f93e3c6aea875371086e663d1e22625e6548178e88240c3f045707200c513cf7343b137dc292de8e2315ce33ed7842e27fab7ae19247073d1d0c0f70101de074692c0699c76467c8873f98a13e26a4d0d6c29a3cedc03691f40b572254ee8c2edf1f781cab4df88231475d546dc3f9ce2f1b39023a5543f39d2ee703d4981d2a7f5e06126782d5a258ea515bcb3270ce9c91e2c515449c07cad9fbe9d9e75b3f954cf3a3986a3a4d78c69dc0bf37a5dc37ff1a5a27fcaf2121af7aec0716004c9493965f805df5794f916a54b1451d158dfc0ad615d2082392ba15263beec804cfccc9c0fb41c5a875c3a81bf76c2c0e1f6ab50cc050620632a575758763e83656ef9de5fab5b8807507426f1ba431278054050fa3282ffbb99d52ed299b1ad297906465441a0b1f4c5bb1f35e3fc004648840b6b10c4ee86954eba236e71dd3a1bfab548873149414aa7fa1291e3443e9b27bd2cca92ef9952887ea94ef9b28d7bc41b22a0530b67b3183b8921dd016353756315ea464e7662ead9264cd36490ce48ef0475fbe4e99f34571860f8080a7e1f03deeea2b15e49036a24939b0b3fe7001ddec18758efda6ac5ffe1857c4da73902e649c4458a8ecd993e3ac8bf3f2e11856089b4a92505fbda59365c72108570a5a36143b2134d6a8fe894d1792c0ab25f830d18bd499146ef9543930872666cbee32c54b60e9d40e2c86c0fefe97e50a5a90f9ecc6535a639dba92c55cfa826a632384dccf405fa1790ab113e4cd6071fb07a4053fefa761627251cb9e89ab4efdaeec074fea415b953b63d2e7dcd5112d365dc320263bbd732dabe34acadc7e0133c51c03c52eef3b026c6f2d82261c665a201a3768fc66a50cf64d0171ef4acad73745350e82518f0ace15045249b518c43c3387fc35619b0ba6afb5f586c520384e9ddb5ba963558e6783e9acad7ab7a155b3b2557d3175c9ee0a867599adef9d22aa6a9954c8004e8b4636e353903b7b5d1e75a005404757dc7bbb0e2be353ac4b8fe7c03763913db18f46800f6a72dc0cb6930c85317431fa1cb423a2703a3ccdd855ae94fe48e1b079c5d41a0963586d12c3278695cd632b9d36fdb13f31563f1b0e76cd476bb3bade59f091e2eac019fd2c61aab353be27c7a1e0d73687ce0fc898fa04cd9d503b559a6b536c4a3f74957d13925c52026772f15291e1d17d9863f6c59cb044d716e13a3a68c278b7eb46920a079e0ae03393f0828836bf8e891cd4d4baea904027c9e592d5558fe5e3579290bf76b0cfcbd2798d93ff662412259cdce8d89883287a5175a0da4e944ce3b185da4a8c74c3ab6d9b287f4760d04f48dadc67c6646516e242b74cd7f5ced9259b1d0d5b1e1ea27c6e3984eee0e04484a34e98a4148d2687a09d1c2bb26b9a28da06a8eaa1be313628704d585d07219b2443287baee1ad1b2525805d53b25bd6fc5af4fc603874533964486eff9dc6bbb0011a797aef1e8f18160847cda1d16b6d3372dbd07adce7b1fbeb18fefc3a31030aa93ca1d6b9874c05d0675859e461ad69fe21d681c37b0136429f0f8ad47e5221bee213016609d65ceb71ca6a5fb75128396bd69c73dcbda4cbe5fd94bb86f1ac81a8bcf3176150f3843d6494c90b7b351d5de10cc55290e0d2047ced3241d3eb55b113a1b3af4f9ec036c4e8324bd8995b05446672452df3a20e13b14fa8df75164df9e3f12d94b78eda687b07b745418274bdb26688d28d82230f3a03e7a8edad17293323f4c52352482a146841ba05eaa34bc4431b0e66be547a4f46f5d13e5b375125a7dee3a327eeae10ba771955b8f16ab86822b4d2141e7ffd1cf52bc45a4288a76f58a6c9a0c4cb1d1366c0f1487156f5ab2dbbfb69b5925c8892a2d1c5b08d5fc15cf71b6ec824b58f46b6357eda37bd8add29bd400d3531af92f6abb1dfd1504697950a999b0c214efc05e8ef220db13864bb168e42b1e679d5849894ed26b5f6636d9f8f8cfefac01d30a4ff3fd08394f839877b524d2c2dc31049d26d9836a630a6fd2a1278116b46d32f3e581986930541316f3ecf28def8e889de331c25a1acadef6c59fa5a4359b07d7ff7818cd373b5cb771d638450dc722fd1c39b8697f85d271c670666cc94a61e9d7ce3fcadb087c58a775b4fb1442a929d6dcbc515b8bbe9b452a05d01ccd01ccbcffafc92430663eb88bffe589453811c1c57819babda00aa09ec5923b713381f79612a23dd922bb780a410a2b7b458965dff7c7c4bcbd7261c202c8562984bbb666ebf96e9cc4474cbcf4651b389dfb02cbce4d8b003a91a94bf9107abeceaa7121846a480fbde789838d2dcfffd1f6169112c41507ac45d5ce38351e709f7746467029da75f59b78d88392cc327dae1a0168a0ae1fe09efd3ab318dda2d0f6aa9ee5bb2a766e89c399c4d90bd679211525980906a622da33aa82edf2f2122f4b5d08f025e5179d569edb6e0340532263bea98ee24673909dbb22d90cc118f8db2cf61d828d9302b995439a79f80fbd0b11e96acfc4f48fc4e5f8d9b89dd8698e1d43e0b42ac5ef7c804f006e142e76ac4b2ec2a27fb953d5303c7b69ed5d6f5d9cfbd096d395c23b943f040cba4c05049ac841ee900e473e2940c515cbd9ffce12243988bb1892ca06c672257a1f3820d8b169d7a8cf33323db89bd6a0942d01be525078d8317c89a91db863370472d2fb9879e4a4a9ca244b64c399df04691b75ebc5afc4ce479efb86c15f4b8cfa801c4295f94c3ce21dc431880e3f9a5b4185ea068349e3e1724055ac48485deef3cf935f247b20083a95beb4996a557b41f0492e44b80f16f5420220464c8b50f1b6bc6f36ffee005d463aed311d90571f7bf7f9127abe28b5607dff0a115e4fd25e876917f260342a3aac07f7bcebf54e937b29bed2dbf86cb763e868412bcb9b40775ebb83218b7f1224749b75fc1deeb51855fdff272b2a1d854a328cea799915f67b6669556c32a201084e7ea413c33465a35a6af8a5bce3246507bef5a0cc8a737fc537466dccdfe6d34f3746cc27d091e59a4de777bf221341e11eb255e289c80d0e18d2d21b4f3b493996b90c08e5add643076021d46545903eef686a49033db0725d472009a1c3dcfad3f733617c15a122bd83899f12294cb0ac2a9d271fc37516bdeb9d2d6b50d06b06e2df107839db6ee262b99bc7c38ea47b606c0c64b45e35f10dd4d53d772090e5c3d19771e086e52c8b66e8e0d8f71faebbaa68781ca618f319bb6378895ba1db0808eec819a1ef867c23cdef13b7de70edf12ae69c71cfe1ad0fa2ffa566da7a60772894309d43c310781a4a7037c4fe985fdc9843faac619fb4d65ce6920b5b85b5968f238908f96c0ef1863c8af05e3baf25bc9f25785efabd9ba5ccecf2e01873ce106b27aa8b26b2ee0bd044e76dade307569344654391ccb7fbad7d2f4e7e1ff2ee6a5ed0a3eb1e765a43480385abbd96d1279c76514e9e4b253a6b5c08df268c6d4cb66b9ae00136c013f9470a1c280c22d5ed59f1e0b5b757adffed54c93c5b79604c4d483a65364b23c4076f89c5daa8e22e8008ac86f5008b5d5da8e47be1f82a5422f438acd06c0ed67c1dd043fdda07d9c3220ea92b1a68e736ba0a0d20428eafeffce48bfbb924c1940fc9fbc872173e2d0f9eb6c98ca3ad1233ec3fe16404e139df08a251b51ffba365cb523dd503679d31d37dbe5527b1455555a7cbc49156655a9a5515444bf0b359ab68141de84b7b693d9649ad8e3437dc537a42a0d65df844476774ff8e252e1ebbb3c4457f26bacc1695d512807bbad38b9c981fbc81338c6ebbea4d35e00a19b80725e959c0c826001db0875291b6a7a97ef1fc7471f76f070b816f8a421a51b9abb10fed01fdb1f8ace12da353208dc643f8ae08602b3179afe7da999f0eafbabbb613867e65202a55b471946d6ab06b92ab888f3525e02a80fc4a90ca4cc6132d8f1fa8acb17a24324ea438f9aa634141b0038b3a8746abadbb446729835147311cf3c7a55ddb9a01f75c898fd886deda64025d86208fc92a7e8d0b481872aff894a5c23ad247b3ddefc8d5a0d1673752c41e5be8942898bc5e975c475000ffbe2fe86aaa598f15fdcdae9feddbbb528a202dcfd7d1f78d0b855d556ca525dd7e50ef22a64fa553fa571a56689f8e95d44804e2b2e9db4420e0554a457a43335824dc0a58f2d3314508c0ef313b8fcf4e86597262ca343501a3fd0252fff246cf2b9121fcc0f22c92b14e5c7d2232d587bc2c27878d1474d6b8b1629ab0de70cdaa8be26db3bcfe219b9557c8ed7cbfadaa10626712403e90aff7b997e3067e0263c3150596748e75a626a5fcd31becaf8acbd61437918b6b0252ad8ff3c68b5d6485e0d52c780c62f56944547e5c8da2ba8d3004ed9840c05d2b2080ff524cb9835620ed8edd16ce2af9ea58f10cfe81e0cf09e53f0ae49439ee9f41ceb1bb253cdbf81f1aa2c1b3d6c78e82f16a0e1000be885aa73e1b11a6f26033eda5b72b0c476becd770ae5688290a77909155cee265c06c854857b5af770609ce6ae0c3a94b7c8fe4cd49027618069f9acffb0f2cb6327fb38d28569954c1928ad6e7e36c7ea4edcbf7ca8eaf32213a2f436c997001ef2a41185991924f737a9bede699dd2b42e25393ba49f9392d2d7e4c6b08ed571d25fa2278d87ed17551e29583e59703e13a9d225dff180299703f8c75700ee8451c749d800fe52078c04e9cb7adaf67cdd3c6204e6c88b5b5ce1dba1a83fb7cf61c169627f44d9ef852f4390843b6310b952507edf541e1888b416af4e832128b56ddb95e0308cbc4271f042a7da1996bbb6f534d234872d849b51ff36b28b8068f65c6407d083de101e4489b2b03c853e6363140026e307238bacc802b2d69cd8c7ca09b2cd3836122fa4099fa64a4a092a43916377e8527e760f5bdb4e2053400a88d79a799d26f66909a8e1af797608bfec97ae5f53942ad4ddd6118013c4686e559034fec04aed6600cc1cd7892a83ecf9502b0bbe8a8130921b23eaecfee3cbd97c49aaf337e9770a1948fe4e7a00ff93b7781a95e02b0e1a1e41a4f0966ab6ec23401ec1a558972865ba10120d5160e9130315e319daaf3142473c9d6ff5af83b06f71dfb50769c9e87b50fedeab9c914c7c3899557e5dfa3d6a25428982dd563a89ded0b797b91cf6d68bb471811cb5c2ef439beb897330bb3b54987ad935ceace5f75e602dc10406d67f1199d2307723945e64c826f6e71eb55a843dd318e77019d3d9ec1719b0786137", 0x1000}, {&(0x7f0000001980)="c59836ec626bdec522fe8c28ab97e99dfad88dd50261dd6e6a91c2afa80da145ea37a31406f285560c09eba8ec97ff207ca09db21e8656d3052f5086d5f6d292df793af8b78e68c4f77b5cba42338ff2d77174ab227c1e2767df9e56b8a1b4fd2f9f6aa4ab2a5c319576bb0c1462767639d118200e67ae09d87d9855098f3f722a32950e3441d5484dcdf1fdba2f05b163e5832c270c1ac2988e9bdf1af0cb942eeb284f0303b18ceb307a7650c2d03d4ec41ed3694fef73a8b53996db6355325403352b090867bb908173f7c50f0638cbf4b6c0414a27f0723faa9632d075b73b39b4747053bb420962ad468d4f725a3c92f6676d4deaf769876b5a186a3d8f2497c6c438eb62a02dc9fffc8260c952505b7967791eae50b664a6664141539f932eaac15d30e679bf6ac8743b287598a14f3f7498e503a39a96bc9be572d6628490a1c49525aae27fcd31025c71ce995de92b0730eda19768001b02058c3dba3669d5ec9375fb9537c3baec760be1be85063ae441d120c53a3e586a858b6b3562d1807873a29183e7af8e1969cdf7adc7ba6793cf7e2f3b4819eac986e5b2f1abb4118eebb28d4a55b4b185cb18d3976eab35d2423aed2897057878c5cbc2cfd0053d39694a7afe8ec7f6dd8771ce0b1f784454edaf61fee4f53b8309d2616622def8cba35b25d721b487e733a1c5253aeba92654255a250bf1defd456bfb0fec880e2e01c3cc47f2a7f2919ca2ec1be65e20a594ef831bbd239f8ab1f4e1e608124bbd0364a8218072a0fafebc1a886e3f14a21fbd5da87dc6404885d4fba50fc4e39dd9600bf98bb94b16202245ef49f4aa749d823dc393f82e691741e7943293d68d730fb3c396f428c69aee2a3792c33fd74e71e36527f97263fa1851ccf6291b40d6c7272dcf25e6450284abe7d600839efec97596b33735640f3b60d62601b21e22374226b7a4d42cfc16d88963205f330b0adaf529f30a69267f150337d84fe0fc9f6b829f52118ddb3b41fca1e9254ba11753537b271c006cc6e3f93eb5867896c2f7aeccd6f3f6b30e84c44ca50b20d8bd1dbd65bd94a1d7ff36f410633aac2905b2455585682ec015a849d30b5c777ef03774fc2b3dcdf4f1d5411e1c892aadfcab139d311a649ab72caddbbed38c072a541b612b08d2cb747356c223b485f5daff660b2a0ccd98f72f3737062b51ebc3587580f61364815db2698610b9e26000226a8c92f4b1c9e19337f0acfb4fac215f6a283c5a6907ed8ebd663c859c0735eaa3cff06dae8c6fb1f21b359db325d96bc2c38bc1cbb7d9e7307878c419c4a8acf564e43a92d6ded5bdc05209e30cc4cfaa26d2a7d9b93ad00ef3390df3a906a011b8e4e08075083e9a0a71bd91b11d65a6c0f7bd96184671a4cd216198ed339a3b020a4186cd6474abb3a64955f7c5fe3fc7b79f7adb650030785d34f6d26608727116425fb9ab97a59f45357de7172e494bcdfe2dfa82e5794f1144c5c1f8efc63bf309c53ec3fdf5b9627076d90efb9009d9b42437fb1d4f8cd48976e82c0176d0e9123c749099ae416c4908ab50ff0b58e928513893071bc046352d14b70a4b1c7287b0066e7998c7a6b54ed2e31be08e2c1ca5a5abc89c4a3b69feb35443e0dcc93759262276fdfc7bdfa55965dd67691038f3828715c0b6ffd2761431d2f67c0fa2e1edfdc8302423ed629b016c3fed934e51d4bd73085196e07cf3c087659f4e9941c8e37163d232105b648c6bc70a2b47db99c6d434c425b19358d94b35cba73dbf1bc42e48a550c0606263ca4d73386e50c12e3a9bac66c46b8c39ebb6e49ce39c90b4ef6451d8913f01ac5b32667c8069dfcfafce7eef26321d5399cd9c5c5bd9683c7e8762745ce6dd154c6aee57f3768b22bc3baa40db0739d1bdc866fccf6833bcc06af497f4623405ea6733648aea3caa85aa117c18730e5d965490c118e867e1dddb261dbdb31e4b2b07765a407ca1dcb097b451d1634b7ef7b911a890b75cd258a45a1dc870290870a50ce49b02cd9a793820b100d47f59cce89276ddd1ebb2bf4dc7e250be3a6da653ec8f73243f9f664e40de054d62be6bf9d1e144173367f463b44ce58d9d522ab0a2fab8a12f56a0d89f58ce18914e303bb878d9d34b4ab8f06a61d9d76cc49b0ec08d73f49802f4a6c0696a84090e582e32adca442e96ebfaedb54ad1305be412898c759dd661c3e29d5ecb3a46a1be141747fdf5711e6ab93f3b80d85082f95ac559f3741fdae14ba9c40d4a1977514e742fddc1da00cd70e1f395d2cc3811857f0676abcd34ec39c7298dc6c83d785c7d76c44496d34f25f047fa008a3ca7e1228fee126b4d5a2cec6be37fac0d1266fa801f7e409fd16afa25c8ab72470e0192c6cdc7b37a22e478e493b09d2a7f408e1f200f936749bba469b9ab257f6525d1bbc81665f2ce8093fc0f657544b8c3c674407993b8382ef5f62cd8317e9ef925ee87eac2fb033f9e1d4b99e2e1330679d953dfc3a5539d537efd287e6eb6994bf06c5c5b600b6fef3dd8ee093fba171d636e61f1603319c9adcc0685764e46c280ff9e01a19e3d91ce313d91b7c1846022ce3d8048c49614adba2fc7b268c8405e2296bb45532edef0ced9b19bb8c50202190e384e22869c692570ade3c5c487e37f9fef149b79d6a65f220cb8eff62163a20760bc983e1158698e73236fdfd8fddfa41346a1cd1416791753240a443d7e68574fead4bda14851c094f87800beeef6aba1fcda7baad62c027c2f0f74fd622e008373e4167b6c46c8b68892b2a4180a5cba18125b37bddcc708bbd4f6e6e9a32ff742cef59d51b02eb1a04b2f1d06f1e1554350ec80c65977562937afa2b6a5e3bd1b9f5e5c668d74a152863feb15db21793dde744e54537d814a57480f29c2570f1aadd25140fb125bb093a7a79088ae0158af74f7cffb2fc4f170202806983206f6055289765bcf90bc68637e19c3fd94212164eee3c64b7ef7ee204119326de07435be8fb8c83b9d4daa795375f7b1112df4e2f007ee2e7e0512f8715228ae36db0f892f21788f7ef1ca788297007869239e359cdc93af2f31378627d5f350c27effe00995eec99a4d7fd09d31f2883130367d82ae926a38e647ed2f9cafd0ab6e6cbc6f40a9f93a8eb48f7a740efb3570acab4009330e052ee40f29695ca1300a3d02a232be6704b09cf785d4fc0f7d526fba6081d05c3bc30746af3d85318026ae4b114871ccbe642aca766f7d585edf001742f0172b9f2092155f0c256e89c3f883dd08ff79fce7702804d840274add9b41cf61a571561473591ce70a1b663987a46a23a72cad63eb950eaff15b2d0a35a370d50f3db1c4c3e23dd2f987a3e8bf74e3eb0b44ba34903a11ad768dceece325fb68a6d17b5865c8dcc2d6e9124446be90bc0d74a5cd4cd47871f12950d518a157605f0a4740752b9b50d581c02db9b3e3570c5a6298fa77e54a6cae9616acded1d86fa065521281d3b6402bd653b6d3e7a71e404efeaaced0af3c9fe547e74363cf63b5b12984d6f21c7b6eb7cdaebd04a998a632750ebd0d080d70e7d1d852191c49118b0ef4da75ee2c4bf951101003b2416555b3c3c634a6e8262e5ba259213e4aeefcced8272ca47001cc42f67b8389b8cdb431d3362d6969df879b1e2f41bad00834d1dd5612a707376918d238927f8f5611a24391600dc9605fb726076ac49bfd55e5128d4cb493af76cd69920afd49b18f3703aef718f372c4815d0ec937688d8f117ca063d40585a87cbe3565f77a02820eff0d586470d842c1b93d8d8becd16515ed74db11a3f7205528a217b230efc6b0a3f3455f4d69a3e192a796a9a38a5250b93c9118b84d23ccd43c969a140ded0fcc65f7ca685158cb36a6dad5d69d4660f61c21f85e727bf5d01664dc5ee2a67ba2066df395e49156024b9a9859c8d86afc35920059cfeee6b2e1e808e5e45e0ade920b67765d7b2fcf93bf961d7a4b9ca0f362e37694949a18129aca37857db15d539b3b9fa57178ee3785b798bdfc9841fc9f8a0a99e9c49dc061ff21d4b9d1c9622b0eb7858ad9d333b962dccb1919e8f3cee53e4a870d02374fdc915a617fb089fdc90df18f76e4ab822129e9d2214d63ba1d877c35bd043a16c8b06574ff3a8078a3fb506343bd8e970b68d016f5681bf46380d711c965236134b89a3450abfc23cc6cd10256f9987727efe1b38992e0c63ee7f05263567592a1ee5dbee38acbe908a5863907f1cfa43d6b8f6553d7a827ceb47a969e89c763e7497c6b92346e8d1222ae4793962877c3e6a6221ca73d56427556124a09e6a2a6f3bb61d3e2e180ffafefe69bc483b957a84b37718cb2494c924db13203b63aded66b78f56b71a29e835cdc7cde7ce1fd80e8af0187507017a957732036f2e01e5eca320a554f05adfbf16bc217b7dcab10ade2adac3e50575ab1d69bead6e5fbc7317edddf1c9ab70c6ca6296724769acb8d283aa7dd2d6ecbd93386f268353aeedd1aa6587acc23fc0e1854ec46f5e6d1e53651554c2880db6568357c4f0d26617a735a86c829bec3df8e37d0d0e8fd320e7f47def7b0b67ce29e6be80496c1d87f19b7378af9b9b1ab72af711facfb2e7d6e3b83ee9fef8e4e02f83c57c61e3fed9e6560300d98a6f63b50dc16534fb9af9158060f7f300a43047036addba8b3ac57c510ec9ca4ac1937a4f29f904530450c1b0f74f9384cd3bbbad75a1ece64965a03d7837cb19eeb18e7d9dd8c117c1ccb6e118c690011fe51ad93435840df27645108f54306fc3bae756bd08b3ae636342e40e8505e7de9d71da3ffbfc2906fb8c13fb8a6c7b5d6e0a62eaa6c027513cd1fd04200114ca107bf3b01efad20483e858e4318cd133c5221bd781fcdf7ea765ca2f805d6bde6d3b6144e4517bb8ab6ffb3815be005663e3c6836b1e9f17b935b4e55ae67094aed916f20ad7957948e30d0dbc1bea70b5983176b25c0aaaba1661af2a78036e66977ea88e85d60a37da9bcfc929b3ff192bf86d3622eef55e3068155938e6fb8bfa1733e4b0be9ee003c5429dcec020c99fd08aed5cb8a6736e9a6d62a8395ff7c8e1a84417ea3ef2896e6f97c9fbe85daac897c98895dc9e931acfe52312c348aa2af3cc5d58ee8ae00dd9e9e8caf5992e8d50b063fe701430b8f5f37b95c0e85b75c0e777ef6470a1710c0e8004d63849ca15d56670dc8e04473890439146608e45d6989436dee09389072e0836d281de63b1dfe6f96cf4ac5d6ff5bc225875c88149d967d982af5ccaba8a500c828a8ea6df1fa55c49d37633e04d8b691dc0128124d31791a70587378e80cbad4af7454b5e5bb78067fcf360dfe4a8c97db914cec4da5149dc551f9e1e716a48f4e3b55bde06fb94297f4d3f6e57d6d00a8260e0f94fac3a862b06aceaa13576dfeef90715c3b7e1a6936de3405e058cfa17882019e70ad4aa41f6e749f8fdb2f07afedaec78070fc112bac8486e80aeec17d1704509ad777fb2f4961ba97f927678467b8028c7e841f40b5105dcfa9cfb3c9c896b0b4baec3ec753f72c04e4d293b37857ec53a8c30262198b0af834d3091d5cf7bf2bbafe67cbb7c8f03aa2242d4ee2c1e97b0660395c1ac5fa73f282bfd5b129945dde97fa2153ba190557fdd3fdc8599fd87cb4cd5935b5fb0622eaa0454ce92cb48bc47c5f771be4cb8e8c728330d37f50a78ce88f28b578f9585bdc6eb055a593dbc144055e7925cb5dc9eafd4ec40c1a9dff1421f4f2e7bdd38a62054fa402f72a43f996a85451c583d43fe48f44c0", 0x1000}], 0x5, &(0x7f0000000380)="befebf7c121ca15b8f5fb11ed59212a89907baf5c38864282490ed275e1a58eb0b3a601c20c6c2987e9a769624e0137abbe7a9162127fb808104eb66", 0x3c, 0x4000000}, 0x2000040) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) bind$inet6(r8, &(0x7f00000000c0)={0xa, 0x4e24, 0x4, @mcast2, 0xffffffff}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0xa}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x68}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:18 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) get_thread_area(&(0x7f0000000180)={0x9, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1}) getsockopt$inet6_dccp_buf(r0, 0x21, 0xc, &(0x7f0000000000)=""/238, &(0x7f0000000100)=0xee) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r1, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r2, 0xc0406618, &(0x7f0000000140)={{0x0, 0x0, @descriptor="1b41b04442a7dd0e"}}) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_GETFMTS(r4, 0x8004500b, &(0x7f00000001c0)=0xa) 07:10:18 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 870.263411] validate_nla: 1 callbacks suppressed [ 870.263425] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6c}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 870.344818] device nr0 entered promiscuous mode 07:10:18 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x2080, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080), 0x10) [ 870.408667] device nr0 entered promiscuous mode 07:10:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0xc}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 870.437111] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 870.572085] protocol 88fb is buggy, dev hsr_slave_0 [ 870.577277] protocol 88fb is buggy, dev hsr_slave_1 07:10:19 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x74}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:19 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) setfsuid(r1) [ 870.747471] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0xe}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:19 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7a}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 870.936614] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 870.962329] protocol 88fb is buggy, dev hsr_slave_0 [ 870.967798] protocol 88fb is buggy, dev hsr_slave_1 [ 871.126545] audit: type=1804 audit(1577171419.698:1148): pid=22385 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir154753035/syzkaller.NzicsO/437/bus" dev="sda1" ino=17243 res=1 [ 871.228856] audit: type=1804 audit(1577171419.698:1149): pid=22385 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir154753035/syzkaller.NzicsO/437/bus" dev="sda1" ino=17243 res=1 07:10:20 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r4, 0x10f, 0x80, &(0x7f0000000380), &(0x7f0000000400)=0x4) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r6, 0x0, 0x83, &(0x7f0000000240)={'broute\x00', 0x0, 0x3, 0x13, [], 0x2, &(0x7f0000000140)=[{}, {}], &(0x7f0000000200)=""/19}, &(0x7f00000002c0)=0x78) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r7, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:20 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f0000000000)='L', 0xca}], 0x1, 0x8001) 07:10:20 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x10}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:20 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 871.645129] device nr0 entered promiscuous mode 07:10:20 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'IDLETIMER\x00'}, &(0x7f0000000040)=0x1e) [ 871.666678] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:20 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x141}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:20 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='\x00[\xf5\xdf\n\x80R\xf5\xb9\x00', 0x4000, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) msgsnd(0x0, &(0x7f0000000000)={0x3, "c5028eac94022bf9ee4de8a291a53c7897ccae380e765b0012fae9e069495c9db351480624a51f4b814245f9b449eeeeef9c18e07a716ec3f84b896c7b0142084c0a2c3a38f7fb63a6b30cd8fc54ad8730a5d39bb0c56c11d3dd246521745362aef60b69eaf596e67f90c0f70192afe3181e82ae5c3d6ba6de6dc72ba577c401d29d8171f95bbab228246278518bb027d76f5aa75e53c511ccf9b017ff554a59b257bda7966aee"}, 0xaf, 0x800) [ 871.879658] device nr0 entered promiscuous mode [ 871.895789] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x60}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:20 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 871.919801] device lo entered promiscuous mode [ 871.934340] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 871.967247] device tunl0 entered promiscuous mode [ 872.002802] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 872.035632] device gre0 entered promiscuous mode [ 872.041298] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready 07:10:20 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x802, 0x0) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x42ef) ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000080)={0xffffffffffffffff, 0x4}) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f00000000c0)={0x7, 0x3, 0x6, 0x54f}) [ 872.050431] device gretap0 entered promiscuous mode [ 872.067050] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 872.081439] device erspan0 entered promiscuous mode [ 872.109053] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 872.116634] device ip_vti0 entered promiscuous mode [ 872.131105] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 872.147719] device ip6_vti0 entered promiscuous mode 07:10:20 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x294, 0x8001) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x200045, 0x0) [ 872.154676] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 872.192626] device sit0 entered promiscuous mode [ 872.202700] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 872.223040] device ip6tnl0 entered promiscuous mode [ 872.238364] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 872.254576] device ip6gre0 entered promiscuous mode [ 872.265203] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 872.273603] device syz_tun entered promiscuous mode [ 872.281327] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 872.299249] device ip6gretap0 entered promiscuous mode [ 872.310011] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 872.323561] device bridge0 entered promiscuous mode [ 872.329328] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 872.341293] device vcan0 entered promiscuous mode [ 872.347192] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 872.359150] device bond0 entered promiscuous mode [ 872.364463] device bond_slave_0 entered promiscuous mode [ 872.370176] device bond_slave_1 entered promiscuous mode [ 872.381343] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 872.387888] 8021q: adding VLAN 0 to HW filter on device bond0 [ 872.399643] device team0 entered promiscuous mode [ 872.405894] device team_slave_0 entered promiscuous mode [ 872.411656] device team_slave_1 entered promiscuous mode [ 872.422984] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 872.429216] 8021q: adding VLAN 0 to HW filter on device team0 [ 872.441043] device dummy0 entered promiscuous mode [ 872.447084] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 872.458631] device nlmon0 entered promiscuous mode [ 872.466618] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 872.486098] device caif0 entered promiscuous mode [ 872.501134] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 872.642140] protocol 88fb is buggy, dev hsr_slave_0 [ 872.647276] protocol 88fb is buggy, dev hsr_slave_1 [ 872.904213] device nr0 entered promiscuous mode [ 872.952206] device nr0 entered promiscuous mode [ 873.042098] protocol 88fb is buggy, dev hsr_slave_0 07:10:22 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000000)=0x85, 0x4) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x2, 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000180)={0x9, 0x7, 0x6, 0x7f, 0x4, [{0xffffffffffffffe0, 0xff, 0xfff, [], 0x2008}, {0xe90a, 0x5, 0xfffffffffffffff4, [], 0xd0f}, {0x3, 0xfffffffffffffffe, 0x8, [], 0x80}, {0x1, 0xc79b, 0x5, [], 0x100}]}) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) write$snddsp(r1, &(0x7f0000000040)="b4f41c11f57e924f4a45a8c2f0d1cc4fe94124ad3460e261bbf7e1703ece6feb8d6fadcf2965fcf8fd551491a47b7b29d389f7ceec0fe3e0145214092fa50f5bd0689ced64b03522c29fa4e7025f4721c98c6afe51549ce3a05d8d141b896eaad25ac601e21195c0e877ad89be949a4ccddf931c6057904938b04cfbbb0d5fb0f796b90177086fa7381de7af204fe06c8d18c5ba4e708a51088ce2dc7efabbd9abb7b973efcdc41c197612645d2e394a252a96ba3c2e8f2036211601b86fc7775bb9d81f0354f63db533ec39c9dd20b8920c3a77c8b146e329f7d71ae5da4096c5b34b465bb6167cb0a19c9d3b6ccc1095ba1814", 0xf4) 07:10:22 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x101000, 0x90) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:22 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:22 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 873.573654] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 873.625649] device batadv0 entered promiscuous mode [ 873.632295] device vxcan0 entered promiscuous mode [ 873.643091] device vxcan1 entered promiscuous mode [ 873.672204] device netdevsim5 entered promiscuous mode [ 873.692943] device veth0 entered promiscuous mode [ 873.698136] device veth1 entered promiscuous mode [ 873.731743] device veth0_to_bridge entered promiscuous mode [ 873.752451] device veth1_to_bridge entered promiscuous mode [ 873.770834] device veth0_to_bond entered promiscuous mode [ 873.790237] device veth1_to_bond entered promiscuous mode [ 873.804422] device veth0_to_team entered promiscuous mode [ 873.814895] device veth1_to_team entered promiscuous mode [ 873.830748] device veth0_to_hsr entered promiscuous mode [ 873.836869] device veth1_to_hsr entered promiscuous mode [ 873.843084] device hsr0 entered promiscuous mode [ 873.848098] device wlan0 entered promiscuous mode [ 873.853491] device wlan1 entered promiscuous mode [ 873.858588] device veth2 entered promiscuous mode [ 873.864032] device veth3 entered promiscuous mode [ 873.869079] device veth4 entered promiscuous mode [ 873.874454] device veth5 entered promiscuous mode [ 873.879577] device veth6 entered promiscuous mode [ 873.884988] device veth7 entered promiscuous mode [ 873.890082] device veth8 entered promiscuous mode [ 873.895620] device veth9 entered promiscuous mode [ 873.900701] device veth10 entered promiscuous mode [ 873.906205] device veth11 entered promiscuous mode [ 873.911343] device veth12 entered promiscuous mode [ 873.916864] device veth13 entered promiscuous mode [ 873.922477] device veth14 entered promiscuous mode [ 873.927674] device veth15 entered promiscuous mode [ 873.933132] device bridge1 entered promiscuous mode [ 873.962245] device nr0 entered promiscuous mode [ 873.974671] device nr0 entered promiscuous mode 07:10:22 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x2}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:23 executing program 2: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x200a04, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x20) r2 = getgid() r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x8001) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r6 = socket$bt_bnep(0x1f, 0x3, 0x4) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r8 = syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r10 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) r11 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r11, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r12 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xa4, 0xa4, 0x6, [@int={0x1, 0x0, 0x0, 0x1, 0x0, 0x48, 0x0, 0x41, 0xa1dc10c9da9732f4}, @func={0x3, 0x0, 0x0, 0xc, 0x5}, @int={0xf, 0x0, 0x0, 0x1, 0x0, 0x36, 0x0, 0x78, 0x1}, @union={0xd, 0x5, 0x0, 0x5, 0x1, 0x2, [{0x2, 0x4, 0x8b97}, {0xf, 0x2, 0x1ff}, {0xb, 0x4, 0xffffffff}, {0xb, 0x1}, {0xe, 0x1, 0x3}]}, @volatile={0x6, 0x0, 0x0, 0x9, 0x3}, @restrict={0x6, 0x0, 0x0, 0xb, 0x3}, @struct={0xa, 0x1, 0x0, 0x4, 0x1, 0x100, [{0x10, 0x1, 0x3b4f4e62}]}]}, {0x0, [0xa88ef94775f70858, 0x0, 0x2557352c3da22bab, 0x61]}}, &(0x7f0000000480)=""/1, 0xc2, 0x1, 0x1}, 0x20) r13 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r13, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r14 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r14, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r15 = syz_open_dev$vcsu(&(0x7f0000000500)='/dev/vcsu#\x00', 0x0, 0x101040) r16 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r16, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r17 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000540)='/dev/dlm_plock\x00', 0x400801, 0x0) pipe2$9p(&(0x7f0000000580), 0x4000) r18 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000005c0)='/proc/self\x00', 0x404000, 0x0) getpid() r19 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r19, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r19, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f0000000700)=0xe8) r21 = msgget$private(0x0, 0x0) msgsnd(r21, &(0x7f0000000000)={0x2}, 0x2000, 0x0) lstat(0x0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r21, 0x1, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, r22}, 0x88f, 0x0, 0x0, 0x0, 0x0, 0x4800000}) r23 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r23, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r24 = accept$netrom(r23, &(0x7f0000000740)={{0x3, @rose}, [@bcast, @remote, @rose, @remote, @netrom, @bcast, @bcast, @bcast]}, &(0x7f00000007c0)=0x48) r25 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r25, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r26 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r26, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r27 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r27, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r28 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r28, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r29 = socket$caif_stream(0x25, 0x1, 0x3) r30 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r30, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r31 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r31, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r32 = syz_open_dev$amidi(&(0x7f0000000ac0)='/dev/amidi#\x00', 0x7, 0x424000) r33 = socket$nl_crypto(0x10, 0x3, 0x15) r34 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r34, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r35 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r35, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r36 = accept4(r35, &(0x7f0000000b00)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000b80)=0x80, 0x400) r37 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r37, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r38 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r38, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r39 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r39, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r40 = fcntl$getown(0xffffffffffffffff, 0x9) r41 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r41, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) statx(r41, &(0x7f0000000bc0)='./file0\x00', 0x800, 0x0, &(0x7f0000001c80)={0x0, 0x0, 0x0, 0x0, 0x0}) r43 = getgid() r44 = gettid() ptrace$setopts(0x4206, r44, 0x0, 0x0) tkill(r44, 0x20) stat(&(0x7f0000000c00)='./file0\x00', &(0x7f0000001d80)={0x0, 0x0, 0x0, 0x0, 0x0}) r46 = getgid() r47 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001e00)='sessionid\x00') r48 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r48, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r49 = syz_open_dev$mouse(&(0x7f0000001e40)='/dev/input/mouse#\x00', 0x100000001, 0x200080) r50 = socket$inet(0x2, 0x80004, 0x7f) r51 = syz_open_dev$sndpcmp(&(0x7f0000001e80)='/dev/snd/pcmC#D#p\x00', 0xfffffffffffffff7, 0x8000) r52 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r52, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r53 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r53, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r54 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r54, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r55 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000001ec0)={0x28, 0x0, 0x2710, @local}, 0x10, 0x80800) r56 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r56, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r57 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r58 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r58, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) fcntl$getownex(r58, 0x10, &(0x7f0000001f00)={0x0, 0x0}) stat(&(0x7f0000001f40)='./file0\x00', &(0x7f0000001f80)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000002000)='./file0\x00', &(0x7f0000002040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r62 = gettid() ptrace$setopts(0x4206, r62, 0x0, 0x0) tkill(r62, 0x20) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000022c0)={{{@in=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f00000023c0)=0xe8) r64 = getegid() r65 = gettid() ptrace$setopts(0x4206, r65, 0x0, 0x0) tkill(r65, 0x20) getresuid(&(0x7f0000002400), &(0x7f0000002440)=0x0, &(0x7f0000002480)) r67 = msgget$private(0x0, 0x0) msgsnd(r67, &(0x7f0000000000)={0x2}, 0x2000, 0x0) lstat(0x0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r67, 0x1, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, r68}, 0x88f, 0x0, 0x0, 0x0, 0x0, 0x4800000}) r69 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r69, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r70 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000024c0)='/dev/ashmem\x00', 0x400200, 0x0) r71 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r71, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r72 = fcntl$getown(r71, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000b34ff8)={0x0, 0x0}, &(0x7f0000b34ffc)=0xc) setuid(r73) r74 = msgget$private(0x0, 0x0) msgsnd(r74, &(0x7f0000000000)={0x2}, 0x2000, 0x0) lstat(0x0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r74, 0x1, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, r75}, 0x88f, 0x0, 0x0, 0x0, 0x0, 0x4800000}) r76 = gettid() ptrace$setopts(0x4206, r76, 0x0, 0x0) tkill(r76, 0x20) r77 = getuid() r78 = msgget$private(0x0, 0x0) msgsnd(r78, &(0x7f0000000000)={0x2}, 0x2000, 0x0) lstat(0x0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r78, 0x1, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, r79}, 0x88f, 0x0, 0x0, 0x0, 0x0, 0x4800000}) r80 = getpgid(0x0) r81 = msgget$private(0x0, 0x0) msgsnd(r81, &(0x7f0000000000)={0x2}, 0x2000, 0x0) lstat(0x0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r81, 0x1, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, r82}, 0x88f, 0x0, 0x0, 0x0, 0x0, 0x4800000}) r83 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r83, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r84 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r84, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r85 = accept$inet6(0xffffffffffffffff, &(0x7f0000002500)={0xa, 0x0, 0x0, @local}, &(0x7f0000002540)=0x1c) r86 = openat$cuse(0xffffffffffffff9c, &(0x7f0000002580)='/dev/cuse\x00', 0x2, 0x0) r87 = socket$isdn(0x22, 0x3, 0x21) r88 = gettid() ptrace$setopts(0x4206, r88, 0x0, 0x0) tkill(r88, 0x20) r89 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r89, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendmmsg$unix(r0, &(0x7f00000029c0)=[{&(0x7f0000000040)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000000c0)}, {&(0x7f0000000100)="4fb08ee49d709e52034e582c359fe7ae84d28a7dc2b1110dbc112612abbf496e10ebab5aed846af68edc607966b6f437f78daebf2d6b273dd387ed3cf7a9462417f8d08a2ef6abc86fe5a82844889ad67f7974dc47b868bff7a60d971a7074bcea3e749ad35e1bf3f50985b190b81081fe745047976925dad24678c823883a309b5c97520a2ce53173ad83019ba73fc33582515a5c00885cb710b6f5b264888a1cd9d44b965872a6ba77fe247c8d44732ea5c970141859e15e210f80", 0xbc}, {&(0x7f0000002cc0)="22cc22dc0b11cc5d9379b3be2c8ffe04fcbdd7d5c76486797cfad4b50f5f4cc8d74ff9c2d058a3d84a4a2b1eec1cde56fd54a13b261d0ee4fa2a0e4c74e3d4210a64a33f343afb047b45114cdb3d90e28c0c2f1d1cfc632bedc28d9f60b9177b66a83fab36347c2401da812e3f89bd24a79c4a35d185843ea6251dfd979a7cb8ada6be050978058b2a91cac4a26fe4e30f0238b06396696e737ab5c9d1201ba37fb1c0103a8f92fec3750d22be39b70db028b74e0955eb726cbd9a159b8b7d327d3c762b87f0e36297acf74883969497ff17af5d1d30576c44fd35a0af0379abf9c91c51e89de7143f7b2999a2c26c9d07a4289b86a0a48cb618974ea8c4ab61f84cd6921dcb264fe34da7102f9c2201acc56a39ebdf4dc077c73009bca86363bbfe2ef2b1a28bdea7d1348e3827ac9b32c00d206d72d5f953507153979eec90819ef12b5cb1115d2228969c9b63d5fb338a9f4b6fa469c48216af01a7f837ed71410a073997270863bf31905e1474de077fa63d890d9cb5bb5fde265f0cc77d2b96f588b0991f57bda9615085bde8d3fc3be462460d7c432dcf34ea6ed4dca032c0911c4ed434bb71c1d2e2fe7007c927523c3dd3eba19fbad59c20cd7e82261e9bd4113b8dbfe201491e147b5180b42a0beb3659f31820351e99333f2dddb8aef7e8398b14db1fdb29a55de4389e502b733ef898a005a70be689c0b4123728884619c36ee5bc9781c09d49de61d52c5f6c9d1e2987f0002229c57033b8d6539c085dbc4418c57f34254b32a464e826993e4f884eb12ae895b78729419caf36b80c9559b7c6e57bb3ca4e95d025e35fbe26686240750af3bb4338167cff5cf7c85566ab5c3b01fc3d35d4dc91a6fd33ab4816d16bbf11a403377540f0abdd4b2d004276952de6e700e77dcb433d63c5d1ccd21ba5bf7d1982ccf6d6335adef3379f7b199c4112f7893e1c1028feb769ac62ddad18b1ff217eff60339c16ec6e7266fd72724f10a27a3b03dca98ba329c268d0a597bfcc66071e46b5aef80a2d5be810f5af5f7f43b200e33ba32410ecbbe6a74bd0f5834e9a91f2777d00db1e01eb8479882b9fc91d190947f96c1fe7513f942319595829551cd538d45c945269d698240e0dea88ac1a714907c84fd56b4c657bed9b84097d69c5fb361d0fe2f0b58f372635c66a64bf5129ebad39b7dbe0a71cf95b529c944b18f75a7b86dbac95b8862e66c5ee40625368b29f0008bd328f528aaafc78c46e3f9185f409b832d93ac874f79eb87537c6ad689c460f0c3b21b0e96a263937713a156a2fcee464c3f72fccb71c9f42186992390856127dd7eaeabd0505940e3840c4085fec28aab669174540ba62e1b08fbe4810f4f3ed19a386800f05cc01596262e87108cec0b7f0813eb6178910686ecc7297cc06693f4a56022ba2ac13e7ea521080c442ad4c03f51f05b1f4106c74f0e785c902703d29586429cb599eb939d7c67c923e832551d0b0d83c59727330518a5510be5d540cf118272e20a6464eb176e480fecd5386f18fc8bb603222c6aa33f46d3b552fae28d82cddd250ed7f053c23d5c1fdf4a41601b6f2d45c3194f7582fa8e54849b3e20e1f67e71706d3872089f39d111aefd36b4f2a309e10a0e3f56d1ba2f7816288799edf3470fc61074917d2fe1ca294d876cfe6da0485070a3a4d8f8c0bcc2638a5d7aad8e37b2ee69296001e67e4824726be0243cae214d16a05939871c188d5d756e5bd9957f07f69255c21f4308f38b366f605b37f24a5a04c36d99a93d39541bcd09955073ea226518a04a5e459e69814232bea30f71251c8ea71a58afa1ca61e272ff470a01006d4f33c696eb09ca775cb4695a295e26269a554a654cbe8907d3f4378b829df4994826ca66d4abb50976ae1208a82f1d587d13ce4749e56e7121755f1259a44aa0ff36f26daa8365477f5faeb5a3579715b0a27019217bd705adf47f1326a6953ed8211bce16ec2f0f8a714028950da4f705f5ee97796dc6ef059a799630bd601054f0c5887b988be400944f3c2264db483cfaedfc4be8e33c96b7a251d7d6185c0293b22c453549e6ac6eb3b37e3e185929ebe50f7370df22337c6b2097499c573bec571ab89fdcd750f5af56004581bb035695d16e079a3da9f2d77ed948fd46e319b9d92c3a04c5d5c13b2bf8a78ab7d6308db90cf16ec9ea931642bf4ff723df094280ea23f5c608108df832fe921fbc8e1550df530acac41cd9ff7057e536a37660c97d60a9ea70750abe6859c77159bebabf1c44ce7f3437dc80adc93729aca7e88e76abe5b980727c2651682c9741263ac50320d5f20d194b42531fbf504998e4d5262c896acb352bb2283f5be64abe066c8d286e91e184d5a503bc6bed06e2cb16f6925a529508bca600d3eab6f40a53b06b091b59b12593172c762708a44cca283dac044269dc8acb914d6912ea67284d5a661740552def20ebf036a7830b0d93fcaa25d1c54d5d652ec6907e016b547d334039bada9805756674e70eeae510bf2ee564889b4a4b37ef8cedc63fb3c67c3ca6877f7353f8ee1a52c0eab9bcbed5ed8f6d4eee1731379fc5e0505d66256b0e47996411e1b5fd002980e7e1dbc11e546a996a2b2f54cc49ca5cb8a44d2f9df2d17c76f415d57ea89aced011940d004d85c610a1f2eadbf1d2d5b5c0b6f09830311dc83c8fb9863751d56bdb07bd15cedda832b666636490893659b5840e2183af246d6f02b0be401cc8a40d0514db084231e53ff38d8dc42114d8f0c53a150c65038bd7f41b165a4b74d9ede677fe43c0409aa96feb367ec39be7bb1465fba414a1a246d8ffa172268c3133f6253f29796591b19546742e80f74cad71a276f1c3892b6c4ed39e129ee6f56ec6e3d005cf244a5f19c427ea41cd13f9c8d15c9802220b404d9c131e07e8f069e1d00bb1868d33ee2717771c22bbfad6aecc2246bca190cb5937c8813c1d2c4cb470edfadb1eea69c137b64291e4943e77ad3f15fe98336d029e3e1537114fc26e164bc7f7a752382f31cf2623429500af5d19f1bc4fa0b3b8359a1bf8f6b4cf1337eabc360725e8ba77ec74c96181e9f0688c78c9987c5f8065e3bc85cfd9d0165d7b823d99a4d269b12908078e2252c7c4312fd6c1761d0c843b46fb4ab180d953b0c0e22e840e441a7c7e76e2c5f028ab8b2f29c24da3e4a23e562e23d5809fe98c183d7f7ce7728b17d0ce0cc6ef3a62b267981b55d6974a4a308a7dfe2f6888a9095c162e3428f4e4620d55daffb2874ed92118e56fe220f0ae015a6160c3e11f08ac548be7cb193d50772ac357823f3a71c8c6e251cd47f36752da4f05e432c8cc7c8e76de28be669f11aa2e97a121b42e3495f9826f46ae3b29a0cf795f26dc248a77337da84a8dbb030d40f398ea52f25f771ab6210d5c11e71e0c41cf853a995f0b2dc7e4ffc5600c59441ae47e462245aa29179eb7881605b1435dbb1ebce70233c39ba45cafbe194e6426ffb4405d0ea48dbaa7e869b3c6e7afc66fc811b6f5f7636907d8860e1ca11b68717183f1deba5b03b7ca51de43d2cdcdbd4e7a58c75c78b4175942b78c87e9699ec17d3b4c9aee7fa820db34a97219dc04157b04997d4b4ab4150e7b45636ec3598d850e0ce7ee125f3f4f2fe6e743c167b0db1f29cbc2454b289fc449f90585c6bf9523aa5eab64d76c8b53dcb85ec98cb168b3e76a8887983176845e9f87b0a85b248c55a7fac5b1b6d105860708f57b713783527ee503469720fff83daa885aabcede4695c77119bb589593f37732d3a49be97f835541cd98298ecde1f4ab0de1dbe73affc6770fbd70f18d2896088bc27921413003ea4f550a29fa99efcafaea34ab8f35a0c639d261e6cf5900d24d4b8c47f450dcbcfc670e9d065bf85f1379c9cdf6a6ab2b9ea1f48ef4c1602ea05c2db9f90493158ba43f1b4fc5ccbe3649b733e133ac0919fb15c8776657ffb71a53aac4e17d4830d128d2b2dbc4d190354541c61f9a47deef5c09b5f6f448271a4e673c90e6323ccbbdc612bce77c6ce2dff4d1676fb6e7798ecde81f79a56f52d7d2a327361defef4d5960a397992c4f18f0cf3e811fc1e271f0f25ccef049516480a273dc23ca9628de6b6106cb8cca4a689c47eed7344735324a69ae7e7979a47b32d27d828a471bdfb0675af9721e1654b061d51299b10f8c590ce7d8ddc6ae4875b1cdef35665c92ababb0373a4fe0bdc73ac27330fd8023caba134ef1c70ebf22c2b35900b79d64f4105ca9bc903ddbbf0f070dca5888f5bb02adb7d44e0328c9246e901b6401f0d848ec449ce68e7354121c21dd13ca44cc931387cce330c977b4df5055c9a92f06eb8d57b40767524f52ac15309a94efca629224a9a1fc3b492978a22054fd78bac16f65b9bb0c2d119794ae0c8e99f198e07a94bae74ba7415a2b87002a310b45c1891866ec8e146d8196ee4ebb13f6cb8a7fabaea743b27e1a894524d05db7645120287dce5f716890962b6309c61fc5af227e8c57e964346e8d2a0fd40b7f2b5fef652e1ead5ec9ee3744ff15aaf8881f20e7aadac20dcf38e97d5400355e1bd0cd90340252f3f070778fa6167bd2a9a4a13bb861c3432cac4e190a51fd786175427deac0a55554fa33dd14595d21686b53204e4889bd6f1450c4a5e3d756d7afadbb99a0254e189fab7e5d9c659f197e5168171617dfb3680c6b86d73dc4debc5e194af11f942f1bee678d03ee71f19ebfff287b0922c7a0688817bdca93304f5ba32c0fa88c3f379b4bb2b1a59e637ff2d1e455174414d3f23a2af00fc1d7750531b4ad20524ba9d9b7659eb0de721b3ceafd53357215f2b861adc14022ca874305ead9d7bf679dd6c2906c0fe0f3e909c20862582480da13be68a95732cc359c024ec2d2f710cfe8ccad1b9f516c4ccadb941574a38ea1e39ea4f55eb805e15086000c27343c6f1b9c2fa85d26c3db913c4058ab6fc60137baeac106e19882f577dc943215cee4d743a0702e0602da6f8b1b8372504f9437e20fe3bbe79f3be837c27cce2420290d88b354c53e649d3a1f3426ea85a5602063cf887b7247f8aaffd68ee0d4ba2f013ad9f58bb807c3df1a75eb3d6906fb088ee1fb4fe580b0c172b2717bc0b02ca478d4b16a6ad11c0e6aba29c9f11534e29de97a95e3a18c49174084608b5605ac4b167f8cf6405ad9275de68a341c80666cdafd6b940f3b92e1ba4db8ff1b450993fef575478a1cd6a5a1f00a724457684954b505b1dd2f32334aaa82ad21f984e51dce53023ef95723a6eccf51910268c93731d676ad039e15071b25aee499e7b527cd6c3b362a5ed22cee4ae258233a960bcb56f46a8649abc5858d7bbd8d7588db034ed54119eb860e07f74bebdeba76661efc75ff670ede184593565bbecf87c17511ca84fdf5c66f176be3df28a11cb99b0fa000625c7308b18afacb038c01215fbc8dd53be91b675624f7509cd8b5ec156ded7b4af07b588ee59f568f6c7dc16fe6008ae605bbb68f95d51de1850fdc04ffa2e48e7b12bb8edfbdc86c1c923b95043618efa4d8c2bed20ce0e52f2a9c8e86930e200e4123b96d5171d16f22cae96f6d32cf3abb5cc37070af83cd2151c998b596e5cff2a54a8c49a9df931afb0a537921c001168861fea7812433afd52d803a77342b1bd0c73f1b0b7ac9de67e8104891d9fe8b783c9d3ba19d0b958667e026c2892039bbf49da2703ef5caf21bbc4aed7448420e1dba0e55d13bde2222361b0add1c3a58e0ff081bc49b5791f57068b2ba42a2e38ce921f84f5d748d203d17a", 0x100b}, {&(0x7f00000001c0)="5d2965ba852eab4d0c506b1d37b919eacdbb42150fbf2be66d228315500cab3c5af997be3ec27d089360a2b60c7ead60c0edadf35238e616c618d47854c731", 0x3f}, {&(0x7f0000000200)="4b3b60e2b7a4864913354402eadbf49a604752df8cfdc1ab7174c3ec3df8b57a3939c3be22008d018468e66ed3a742c6112645c8a50411e1acef02df441ed3cd884309d540ca1d2cc2469d1a5407a2c7f4b917e8c7d8c8590fdf5056ae751aaf8ed44bd2d6f4a1f5223d085505b78f25b0b5b9b61d7a4cbd38c1f7424bbb8c9213bb870ab30fa8af", 0x88}], 0x5, &(0x7f0000000900)=[@cred={{0x1c, 0x1, 0x2, {r1, 0x0, r2}}}, @rights={{0x14, 0x1, 0x1, [r3]}}, @rights={{0x30, 0x1, 0x1, [r4, r5, r6, r7, r8, r9, r10, r11]}}, @rights={{0x34, 0x1, 0x1, [r12, r13, r89, r15, 0xffffffffffffffff, r16, r17, r47, r18]}}, @cred={{0x1c, 0x1, 0x2, {r88, r20, r22}}}, @rights={{0x2c, 0x1, 0x1, [r24, r25, r26, 0xffffffffffffffff, r27, r28, r29]}}], 0xf0, 0xf7123e3e8d981763}, {&(0x7f0000000800)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000000a80)=[{&(0x7f0000000a00)="074b23766aff3987bd6edf93f4e7ff74add3d679d3f6d6c7767925af0a0ee3c3205665a9760da97b26a7cc7f1f22d93bdc575b8641450b2b3d2434ef856bfe308caaa79aa5a728c5a6dc", 0x4a}], 0x1, &(0x7f00000020c0)=[@rights={{0x38, 0x1, 0x1, [r30, r31, r32, r33, r34, r36, r37, 0xffffffffffffffff, r38, r39]}}, @cred={{0x1c, 0x1, 0x2, {r40, r42, r43}}}, @cred={{0x1c, 0x1, 0x2, {r44, r45, r46}}}, @rights={{0x38, 0x1, 0x1, [r47, r48, r49, r50, r51, r52, r53, r54, r55, r56]}}, @rights={{0x14, 0x1, 0x1, [r57]}}, @cred={{0x1c, 0x1, 0x2, {r59, r60, r61}}}], 0xe8, 0x15}, {&(0x7f00000021c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000002280)=[{&(0x7f0000002240)="c381254f15df1f4ec047f157", 0xc}], 0x1, &(0x7f0000002b00)=ANY=[@ANYBLOB="1c000000ed7f0000010021d43dd990001c71e0c108974826768e1a2c7157fea974d29145f6215babc791cea2eecf3c6899c4a0277d53c78cdf4d3d878c64259e9773d3304b379ae73f0888e84fc8e625c1d172331ee1dc7b4cd0300b8d4944a4aa0c47d809156baa48e391db0db99b79ef97745d936950fabafcbca3c1f2828c316e9ce78f6fc7dcbd0471aaeb55dc62a96112e0167f0fdb79cace5403", @ANYRES32=0x0, @ANYRES32=r63, @ANYRES32=r64, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r65, @ANYRES32=r66, @ANYRES32=r68, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r69, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r70, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r72, @ANYRES32=r73, @ANYRES32=r75, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r76, @ANYRES32=r77, @ANYRES32=r79, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r80, @ANYRES32, @ANYRES32=r82, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32=r83, @ANYRES32=r84, @ANYRES32=r85, @ANYRES32=r86, @ANYRES32=r87, @ANYBLOB='\x00\x00\x00\x00'], 0x185}, {&(0x7f00000026c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f00000027c0)=[{&(0x7f0000002740)="dd0ba19c0f4cbf0cb34ac36b8fa2514aa61c0f2ca50d8b87546291086edc09665665880e7e8e68932834561b17fbb9377a89f362425db0107b61987959f823e442127e69cf709629cd167f", 0x4b}], 0x1, 0x0, 0x0, 0x10}, {&(0x7f0000002800)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000002980)=[{&(0x7f0000002880)="b770ffa241a09d39962085f7067bd5cdbd7b5fb04ffb4fb2b8d6704c5b08fb1f973a49fc062a2c80a9518cb77af55408139353cc39840631c05380b4ecc9c0cafc7c02720fbe3177f33c4e56279f182c9bb00b7503fc3b666bce7456576de6e14ab1c22ce895a8d3a31bcc28dd1d8075f0bf5b2543f230a749736bd843f5b43f4e1ad2c60c610ea37f3a0f803e34ad120f589bbfadd4908f77991e249d8c7dd4c6986cba5bc2ca2273f9d3387168599d6ec6b32c17f2deea292d92b237c18386f5db91494220e57abd94dba3dc7a6c57de8cdec3f4113d0103", 0xd9}], 0x1, 0x0, 0x0, 0x20040810}], 0x5, 0x40) r90 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r90, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 874.437481] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 874.509651] device nr0 entered promiscuous mode 07:10:23 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x600}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 874.584064] audit: type=1400 audit(1577171423.158:1150): avc: denied { create } for pid=22498 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 [ 874.606934] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:23 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:23 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 874.646270] device lo left promiscuous mode [ 874.707601] device tunl0 left promiscuous mode [ 874.716015] device gre0 left promiscuous mode [ 874.722129] net_ratelimit: 3 callbacks suppressed [ 874.722137] protocol 88fb is buggy, dev hsr_slave_0 [ 874.732094] protocol 88fb is buggy, dev hsr_slave_1 [ 874.736508] device gretap0 left promiscuous mode [ 874.749615] device erspan0 left promiscuous mode [ 874.755051] device ip_vti0 left promiscuous mode [ 874.760064] device ip6_vti0 left promiscuous mode [ 874.765730] device sit0 left promiscuous mode [ 874.770479] device ip6tnl0 left promiscuous mode [ 874.775888] device ip6gre0 left promiscuous mode [ 874.780919] device syz_tun left promiscuous mode [ 874.787155] device ip6gretap0 left promiscuous mode [ 874.793255] device bridge0 left promiscuous mode [ 874.800296] device vcan0 left promiscuous mode [ 874.807362] device bond0 left promiscuous mode [ 874.818025] device team0 left promiscuous mode [ 874.823877] device dummy0 left promiscuous mode [ 874.828802] device nlmon0 left promiscuous mode [ 874.846190] device caif0 left promiscuous mode [ 874.855611] device batadv0 left promiscuous mode [ 874.864811] device vxcan0 left promiscuous mode [ 874.873133] device vxcan1 left promiscuous mode [ 874.885988] device netdevsim5 left promiscuous mode [ 874.898334] device veth0 left promiscuous mode [ 874.903378] device veth1 left promiscuous mode 07:10:23 executing program 2: ioctl$sock_bt_cmtp_CMTPGETCONNLIST(0xffffffffffffffff, 0x800443d2, &(0x7f0000000140)={0x4, &(0x7f00000000c0)=[{}, {}, {}, {}]}) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) ioctl$PPPIOCATTACH(r0, 0x4004743d, &(0x7f0000000180)) r1 = socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$VIDIOC_TRY_EXT_CTRLS(r0, 0xc0205649, &(0x7f0000000080)={0xa30000, 0x8, 0xffffffff, r1, 0x0, &(0x7f0000000040)={0x9b0901, 0x400, [], @p_u16=&(0x7f0000000000)=0xe}}) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 874.908266] device veth0_to_bridge left promiscuous mode [ 874.918849] device veth1_to_bridge left promiscuous mode [ 874.930730] device veth0_to_bond left promiscuous mode [ 874.949107] device bond_slave_0 left promiscuous mode [ 874.971909] device veth1_to_bond left promiscuous mode 07:10:23 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x200, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 874.997216] device bond_slave_1 left promiscuous mode [ 875.007049] device veth0_to_team left promiscuous mode [ 875.024568] device team_slave_0 left promiscuous mode [ 875.048055] device veth1_to_team left promiscuous mode [ 875.068102] device team_slave_1 left promiscuous mode [ 875.074122] device veth0_to_hsr left promiscuous mode [ 875.079716] device veth1_to_hsr left promiscuous mode [ 875.087013] device hsr0 left promiscuous mode [ 875.097511] device wlan0 left promiscuous mode [ 875.104505] device wlan1 left promiscuous mode [ 875.109317] device veth2 left promiscuous mode [ 875.116441] device veth3 left promiscuous mode [ 875.121135] device veth4 left promiscuous mode [ 875.125841] protocol 88fb is buggy, dev hsr_slave_0 [ 875.125912] protocol 88fb is buggy, dev hsr_slave_1 [ 875.136305] device veth5 left promiscuous mode [ 875.141008] device veth6 left promiscuous mode [ 875.145853] device veth7 left promiscuous mode [ 875.150550] device veth8 left promiscuous mode [ 875.155308] device veth9 left promiscuous mode [ 875.160013] device veth10 left promiscuous mode [ 875.164838] device veth11 left promiscuous mode [ 875.169620] device veth12 left promiscuous mode [ 875.174474] device veth13 left promiscuous mode [ 875.179218] device veth14 left promiscuous mode [ 875.184058] device veth15 left promiscuous mode [ 875.188823] device bridge1 left promiscuous mode [ 875.389188] device nr0 entered promiscuous mode 07:10:24 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) ioctl$SNDCTL_DSP_NONBLOCK(r0, 0x500e, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000000)={'filter\x00'}, &(0x7f0000000080)=0x54) 07:10:24 executing program 1: ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000080)={0x4, 0xe29, 0xfffffffd, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x1441266, 0x3, [], @p_u8=&(0x7f0000000000)=0xf9}}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f00000000c0)={0x0, 0x0, 0xd7}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000100)={0x0, 0x0, 0xfffffffffffff503}) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000140)={r1, r2}) syz_mount_image$ntfs(&(0x7f00000001c0)='ntfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001b00)={[{@show_sys_files_yes='show_sys_files=yes'}, {@case_sensitive_no='case_sensitive=no'}, {@disable_sparse_no='disable_sparse=no'}, {@umask={'umask'}}, {@case_sensitive_no='case_sensitive=no'}, {@uid={'uid'}}, {@mft_zone_multiplier={'mft_zone_multiplier'}}, {@dmask={'dmask'}}, {@errors_recover='errors=recover'}, {@nls={'nls', 0x3d, 'maccroatian'}}]}) 07:10:24 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x700}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:24 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_DELAY(r3, 0x80084121, &(0x7f00000000c0)) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:24 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x4}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:24 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:24 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L'}], 0x14f, 0x8001) splice(0xffffffffffffffff, &(0x7f0000000040)=0x8, 0xffffffffffffffff, &(0x7f0000000080)=0x298d, 0x2, 0x8) syz_open_dev$tty20(0xc, 0x4, 0x0) [ 875.475717] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 875.501885] device lo entered promiscuous mode [ 875.520344] device tunl0 entered promiscuous mode [ 875.542381] device gre0 entered promiscuous mode [ 875.572279] ntfs: (device loop1): parse_options(): NLS character set maccroatia not found. [ 875.597731] device gretap0 entered promiscuous mode [ 875.611839] device erspan0 entered promiscuous mode [ 875.619698] device ip_vti0 entered promiscuous mode [ 875.678004] device ip6_vti0 entered promiscuous mode 07:10:24 executing program 2: openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r0 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) pwritev(r0, &(0x7f0000000c40), 0x1, 0x8001) [ 875.724197] ntfs: (device loop1): parse_options(): NLS character set maccroatia not found. [ 875.731727] device sit0 entered promiscuous mode [ 875.759700] device ip6tnl0 entered promiscuous mode 07:10:24 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) unshare(0x28000400) clone(0x1a1041f36dc2d062, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f0000000040)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00\xf5\xf5\xdc\xbe\xd1v7\xc5\xc0\xde\xe3\xb2+\xbe\xe3\xf1]\xecA\aU\xe4:\'\xfd\xbf-\\\xb6FVe@\xd17\xc55\x16\ny1\xd3\x18\x1d\x864\x988\xc7\xa4\x969\xed\x17\xd3\"SG\xccc\'\xa82\xb43\x81\x82`\x9f\x9c\x10*\xde\xd5(\x1a\x9a\xd0\f\x15g\xfd[U`:\x94\x86\x15g\xa4\xcd/v\x0e\xae\xb0\xb8xmQ\xee\xda1\xc6\x06\xed\xa8\xc6\xb9\x13\xe1\x03\x8e\x0f.', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r0, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0xfffffffffffffffd, {0x4000001}, 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000000)) socket(0xa, 0x0, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x15000000000000, 0x485, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00*\x0e\xc3=.\x13\xcbx\x95*\xeeX\x9fcy\xa49\xf6\x8f\x82^\x19\xa9\xcd+\b\x9f\xc6,\xa0\xf0\xff\x9dO\x06\xc9\x15\xda\xa4\x7fh\xd4\xe8C\xdeKUrR\xf4\x9c\x87\xee\xd2\xfb\xdfs\xd0G\x91\x02\x15Z\xa8\x1ad\xadY\x13\x14mg\xc9\x00\x16\xa4\xc48\x06u\x1e:\xd4Y?\xd8P\xe8reP\xffv\xd6\x12\x85N1\n\f\xb0\x1e\xe7\xffD\x1aS\xbf0\x80\xff\xff7V\xcc5\x96W\x14J\xe2\x93\xe3\xc6A7\xd8\xec\xb2m\xf5\x16-\x1b\xbd\x11\x1aYg\xe0\xa7\xd19\a') prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)) [ 875.775413] device ip6gre0 entered promiscuous mode [ 875.780767] device syz_tun entered promiscuous mode [ 875.786514] device ip6gretap0 entered promiscuous mode [ 875.799647] device bridge0 entered promiscuous mode [ 875.813268] device vcan0 entered promiscuous mode [ 875.818576] device bond0 entered promiscuous mode 07:10:24 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @empty}, {0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xa}}, r3}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000040)={0x4, 0x8, 0xfa00, {r3, 0x401}}, 0x10) [ 875.824991] device bond_slave_0 entered promiscuous mode [ 875.833647] device bond_slave_1 entered promiscuous mode [ 875.839855] device team0 entered promiscuous mode [ 875.856589] device team_slave_0 entered promiscuous mode [ 875.870696] device team_slave_1 entered promiscuous mode [ 875.876934] device dummy0 entered promiscuous mode [ 875.883233] device nlmon0 entered promiscuous mode [ 875.888462] device caif0 entered promiscuous mode [ 875.894425] device batadv0 entered promiscuous mode [ 875.899850] device vxcan0 entered promiscuous mode [ 875.915546] device vxcan1 entered promiscuous mode [ 875.922371] device netdevsim5 entered promiscuous mode [ 875.928086] device veth0 entered promiscuous mode [ 875.933673] device veth1 entered promiscuous mode [ 875.940832] device veth0_to_bridge entered promiscuous mode [ 875.947563] device veth1_to_bridge entered promiscuous mode [ 875.954002] device veth0_to_bond entered promiscuous mode [ 875.960112] device veth1_to_bond entered promiscuous mode [ 875.966433] device veth0_to_team entered promiscuous mode [ 875.972771] device veth1_to_team entered promiscuous mode 07:10:24 executing program 2: pwritev(0xffffffffffffffff, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000040)={0x5, 0x4, 0x4, 0x400, 0x1, {r2, r3/1000+10000}, {0x2, 0xb72985b92771e4b6, 0x1, 0x8, 0x1, 0x9, "0cc04a26"}, 0x7, 0x3, @fd, 0x203a, 0x0, 0xffffffffffffffff}) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000180), 0x4) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r4, 0xc0205649, &(0x7f0000000140)={0xa00000, 0xff, 0x0, r5, 0x0, &(0x7f0000000100)={0x990a73, 0x6, [], @p_u16=&(0x7f00000000c0)=0x4}}) [ 875.978846] device veth0_to_hsr entered promiscuous mode [ 875.988408] device veth1_to_hsr entered promiscuous mode [ 875.997927] device hsr0 entered promiscuous mode [ 876.005575] device wlan0 entered promiscuous mode [ 876.014311] device wlan1 entered promiscuous mode [ 876.024109] device veth2 entered promiscuous mode [ 876.031941] IPVS: ftp: loaded support on port[0] = 21 [ 876.037661] device veth3 entered promiscuous mode [ 876.048769] device veth4 entered promiscuous mode [ 876.064213] device veth5 entered promiscuous mode [ 876.068635] audit: type=1400 audit(1577171424.638:1151): avc: denied { map } for pid=22585 comm="syz-executor.1" path=2F6D656D66643A2F70726F632F7379732F6E65742F697076342F76732F69676E6F72655F74756E6E656C6564202864656C6574656429 dev="tmpfs" ino=87492 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 [ 876.071612] device veth6 entered promiscuous mode [ 876.107626] device veth7 entered promiscuous mode [ 876.119459] device veth8 entered promiscuous mode 07:10:24 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$PPPIOCATTACH(r0, 0x4004743d, &(0x7f0000000000)=0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x0, 0x0) r2 = socket(0x3, 0x800, 0x8) fcntl$setsig(r2, 0xa, 0x3e) pwritev(r1, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 876.129430] device veth9 entered promiscuous mode [ 876.141100] device veth10 entered promiscuous mode [ 876.156407] device veth11 entered promiscuous mode [ 876.182338] device veth12 entered promiscuous mode [ 876.197369] device veth13 entered promiscuous mode [ 876.202656] device veth14 entered promiscuous mode [ 876.207991] device veth15 entered promiscuous mode [ 876.217837] device bridge1 entered promiscuous mode [ 876.257734] device nr0 entered promiscuous mode 07:10:24 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:24 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$NS_GET_OWNER_UID(r2, 0xb704, &(0x7f0000000040)=0x0) r4 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000b34ff8)={0x0, 0x0}, &(0x7f0000b34ffc)=0xc) setuid(r5) r6 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000b34ff8)={0x0, 0x0}, &(0x7f0000b34ffc)=0xc) setuid(r7) r8 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000b34ff8)={0x0, 0x0}, &(0x7f0000b34ffc)=0xc) setuid(r9) r10 = msgget$private(0x0, 0x0) msgsnd(r10, &(0x7f0000000000)={0x2}, 0x2000, 0x0) lstat(0x0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r10, 0x1, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, r11}, 0x88f, 0x0, 0x0, 0x0, 0x0, 0x4800000}) statx(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x6000, 0x8, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r13 = msgget$private(0x0, 0x0) msgsnd(r13, &(0x7f0000000000)={0x2}, 0x2000, 0x0) lstat(0x0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r13, 0x1, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, r14}, 0x88f, 0x0, 0x0, 0x0, 0x0, 0x4800000}) fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000001c0)={{}, {0x1, 0x2032b47e5b6db1a1}, [{0x2, 0x0, r3}, {0x2, 0x1, r5}, {0x2, 0x5, r7}, {0x2, 0x1, r9}], {0x4, 0x1}, [{0x8, 0x0, r11}, {0x8, 0x6, r12}, {0x8, 0x2eced317fc74d157, r14}], {0x10, 0x1}, {0x20, 0x4}}, 0x5c, 0x1) 07:10:25 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x1, 0x2) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nvram\x00', 0x7e5862e4e1844ea4, 0x0) fstat(r2, &(0x7f0000000080)) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) [ 876.559561] device nr0 entered promiscuous mode [ 876.591066] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 876.601134] device lo left promiscuous mode [ 876.616269] device tunl0 left promiscuous mode [ 876.621093] device gre0 left promiscuous mode [ 876.626756] device gretap0 left promiscuous mode [ 876.637188] device erspan0 left promiscuous mode [ 876.645896] device ip_vti0 left promiscuous mode [ 876.650891] device ip6_vti0 left promiscuous mode [ 876.659689] device sit0 left promiscuous mode [ 876.665524] device ip6tnl0 left promiscuous mode [ 876.670515] device ip6gre0 left promiscuous mode [ 876.679553] device syz_tun left promiscuous mode [ 876.685770] device ip6gretap0 left promiscuous mode [ 876.691025] device bridge0 left promiscuous mode [ 876.700209] device vcan0 left promiscuous mode [ 876.706144] device bond0 left promiscuous mode [ 876.711200] device team0 left promiscuous mode [ 876.720292] device dummy0 left promiscuous mode [ 876.726302] device nlmon0 left promiscuous mode [ 876.731186] device caif0 left promiscuous mode [ 876.739932] device batadv0 left promiscuous mode [ 876.745994] device vxcan0 left promiscuous mode [ 876.750836] device vxcan1 left promiscuous mode [ 876.759649] device netdevsim5 left promiscuous mode [ 876.765853] device veth0 left promiscuous mode [ 876.770709] device veth1 left promiscuous mode [ 876.779319] device veth0_to_bridge left promiscuous mode [ 876.786155] device veth1_to_bridge left promiscuous mode [ 876.791907] device veth0_to_bond left promiscuous mode [ 876.801292] device bond_slave_0 left promiscuous mode [ 876.806636] protocol 88fb is buggy, dev hsr_slave_0 [ 876.806715] protocol 88fb is buggy, dev hsr_slave_1 [ 876.822225] device veth1_to_bond left promiscuous mode [ 876.827759] device bond_slave_1 left promiscuous mode [ 876.833528] device veth0_to_team left promiscuous mode [ 876.839052] device team_slave_0 left promiscuous mode [ 876.844806] device veth1_to_team left promiscuous mode [ 876.850334] device team_slave_1 left promiscuous mode [ 876.856082] device veth0_to_hsr left promiscuous mode [ 876.861618] device veth1_to_hsr left promiscuous mode [ 876.867479] device hsr0 left promiscuous mode [ 876.872590] device wlan0 left promiscuous mode [ 876.877421] device wlan1 left promiscuous mode [ 876.882537] device veth2 left promiscuous mode [ 876.887373] device veth3 left promiscuous mode [ 876.892515] device veth4 left promiscuous mode [ 876.897353] device veth5 left promiscuous mode [ 876.903388] device veth6 left promiscuous mode [ 876.908214] device veth7 left promiscuous mode [ 876.913329] device veth8 left promiscuous mode [ 876.918149] device veth9 left promiscuous mode [ 876.924370] device veth10 left promiscuous mode [ 876.929275] device veth11 left promiscuous mode [ 876.934498] device veth12 left promiscuous mode [ 876.939415] device veth13 left promiscuous mode [ 876.944629] device veth14 left promiscuous mode [ 876.949539] device veth15 left promiscuous mode [ 876.954774] device bridge1 left promiscuous mode [ 876.991011] device nr0 entered promiscuous mode [ 877.202112] protocol 88fb is buggy, dev hsr_slave_0 [ 877.207244] protocol 88fb is buggy, dev hsr_slave_1 07:10:26 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f0000000100)='./file0\x00', 0xccf82b8c3d0385a3, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:26 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:26 executing program 2: r0 = syz_open_dev$vcsu(&(0x7f0000000000)='/dev/vcsu#\x00', 0xa4e, 0x80) setsockopt$CAN_RAW_LOOPBACK(r0, 0x65, 0x3, &(0x7f0000000040), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r1, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:10:26 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x5}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:26 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xc00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 877.524465] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 877.628207] device nr0 entered promiscuous mode [ 877.651896] device nr0 entered promiscuous mode [ 877.897255] device nr0 entered promiscuous mode 07:10:26 executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @remote}]}, &(0x7f0000000180)=0x3ad) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000200)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}}}, &(0x7f0000000040)=0xb0) 07:10:26 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xe00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:26 executing program 2: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x1, 0xd52041) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000100)={'veth0_to_bridge\x00', 0xf1}) fstatfs(r0, &(0x7f0000000240)=""/189) ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000440)=ANY=[@ANYBLOB="6d616e676c650000000097131ddf0000000000000000000000000000000000000400d9183cc3fbff7d980000000000000000000000000000000000000000138be872f05cb770ca86480c84b740000081000000000000ef39a7847ab2f7e2874efa0000000000c283554835eef6a2f4ba77fc12000000000000000000e2af2eec71cc05d000"/142], 0x68) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000040)="3ef22fb6f8069c2675aa7c31f710312ea7fb4f822aae22be3d6b5d436d0841a34877b13acc9573", 0x27}, {&(0x7f0000000080)="bd2d62b9c2c598243012b731a21ce45c97415bc56c92f0220baae5d5d2959867df085d9fdac272e1270fe842baa55dd3ef83b5c702918710f743af5d482723f024ee3f86753aa32c85d7acead80432139910ecad428239db", 0x58}, {&(0x7f00000001c0)="bce84c575369a096e0544e1fa927329edb510393b964e80d1955dd0aeaafe98b4d09e921e01fec1c78309b001ec9c80ccdc7f5466d1315150f408876a1bc03cd9a1c39bc36e5fe84837b097e9322cc78b8e1f6511b8c1ec1116cce4f3694414b373de0f55ef0ad70d55c8e9a5668527947d35f9560a0d668e07837d046", 0x7d}], 0x3, 0x8001) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x40442, 0x0) connect$pptp(r3, &(0x7f0000000300)={0x18, 0x2, {0x2, @empty}}, 0x1e) 07:10:26 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x6}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:26 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:26 executing program 3: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000200)={0x0, 0x4, 0x4, 0x400, 0x8, {0x77359400}, {0x2, 0x8, 0x0, 0x4, 0x7, 0x1f, "89c68d3e"}, 0x3, 0x4, @fd, 0x7fff}) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_OVERLAY(r2, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f00000000c0)=@generic={0x2, 0x7fff, 0x100}) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r5) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r7 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r7, 0x0) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r8, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r9 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r9, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r5, r9, 0x0, 0x80001d00c0d0) r10 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r10, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) write$FUSE_LSEEK(r10, &(0x7f0000000100)={0x18, 0x0, 0x6, {0x21}}, 0x18) r11 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r11, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 878.266796] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:26 executing program 2: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x5, 0x400003) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000180), &(0x7f00000001c0)=0x4) write$midi(r0, &(0x7f0000000040)="e96e26f74a01091db3932a0e8039b3e50b272bc05a4e091583c84be94380a9f532349a0c094dc959bfb95c13aabb83697a46674bf36b36c7aa15c5f7619ccabf94c2f62f87aa7d5898b80be5a027dbe685bfa08203bf0005759fef37bc4b93f420bf5cb457397a8ee4ae1888efe73958f9a088c98c0c95", 0x77) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getpeername$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) syz_open_dev$swradio(&(0x7f0000000200)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000140)={@mcast2, r4}, 0xffffff5d) pwritev(r2, &(0x7f0000000c40), 0x0, 0x8001) 07:10:26 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='batadv0\x00', 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) 07:10:26 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 878.439560] device nr0 entered promiscuous mode 07:10:27 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x69c62c18f68af9e3) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x42c0, 0x0) ioctl$FS_IOC_GETFSLABEL(r2, 0x81009431, &(0x7f0000000080)) ioctl$sock_bt_bnep_BNEPCONNDEL(r1, 0x400442c9, &(0x7f0000000000)={0x9, @local}) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:10:27 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x7}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:27 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000140), 0x0, 0x8001) 07:10:27 executing program 2: openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x2, 0x400000) pwritev(r0, &(0x7f0000000000)=[{&(0x7f00000008c0)='L', 0x1}], 0x0, 0x5) 07:10:27 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:10:27 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) unshare(0x10000) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:10:27 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)=' \x00\x00\x00\x00\x00\x00\x00am\x00', 0x303000, 0x0) fcntl$setsig(r0, 0xa, 0x20) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) inotify_init() [ 878.819856] device nr0 entered promiscuous mode [ 878.837254] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 878.882100] protocol 88fb is buggy, dev hsr_slave_0 [ 878.887279] protocol 88fb is buggy, dev hsr_slave_1 [ 878.916088] device nr0 entered promiscuous mode 07:10:27 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 879.228078] device nr0 entered promiscuous mode 07:10:27 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x40, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvme-fabrics\x00', 0x402000, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r3, 0x4010ae74, &(0x7f0000000100)={0x0, 0x81, 0xfffb}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x10, 0x0) ioctl$sock_SIOCGSKNS(r4, 0x894c, &(0x7f0000000200)=0x8) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:27 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x2000000000008001) 07:10:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x4000071, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000080)) 07:10:27 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:27 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x8}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:27 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 879.347816] device nr0 entered promiscuous mode 07:10:27 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/Bev/\x04vr!m\x00', 0x10601, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pwritev(r1, &(0x7f0000000280)=[{&(0x7f0000000000)="dafb5b29f46a623b3da8b8f64cc1a46b6b75a8a0a3f3ab0749b19e808fe5a7412676187b2520a1871dd30194f1ec7ff3baeaa7e123a3211d7ec3e8cec31b4f3c31b7b9e292fb03fcbec9495459391dcba01a4aa478542e2c0b8195f1859f946303e9bff1d19d38ae497db22b045a096f73a07aa9ebf84b476c792668eb7d7bb31a930ed2aaa8bec7e7d48665933eea1100a532680b1bdfaddfcc31cf511376b2d1276494aeb1fd511ca2d4d645706eea0d297bcdb071b62f39fcef121daf7e06574aeb39b86cde866fa4119de852332b10f74b9f95bd17f012ba12cdfcb9f44beb3b26a7ea0763cc33b865c8590d51577feb434b28"}, {&(0x7f0000000100)="b9ec1752076e49ba71fb067aacb6abf919eac398a430f0979de4cef01631666a114180d659d28134baa36d8e561dabbd44380276471d739e1f23471dc545227c8b929d6f287da95b72698e7db972d2c9b4dfbe9aaac5b02a3010a4936c9032a276d692d6976304912f27e72a34ae0b024f57b49603"}, {&(0x7f0000000180)="172135f45728d67ede143b7e8c5260c5fea3f31d9f3a771b5f2b85fde0bb1703685007177e597df7f50a293456ade9ed2698fcf23d3c4d69bd91602fafb7314483d9ba4cb1b0c68f8ddf6dbc6d189cd281f9a7dc9d5c6f0da3c8dce34f"}, {&(0x7f0000000200)="874e223991d898fd65c1eee7882e6ad094063470309a92cf4bdd3c815c7887244460aa9c0dda2182a369bfeb99dba55a11b841407956224f35d517fc2225de918f49b8b46e441ccea0e6e879d09be7e9276f431db569e0bc0d6eec0eec54a86882b64fc81713fabe55cb4389cbde98fb7d219b88", 0x224}], 0x1000000000000145, 0x8001) fallocate(r0, 0x44, 0x3, 0x3) 07:10:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, r0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, 0x0, 0x0) keyctl$setperm(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140), 0x0, 0x0, 0x0) [ 879.437526] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 879.453814] device lo entered promiscuous mode [ 879.459049] device tunl0 entered promiscuous mode [ 879.469717] device gre0 entered promiscuous mode [ 879.475659] device gretap0 entered promiscuous mode 07:10:28 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000000)={[0xa9a5, 0x8db, 0x4, 0x0, 0x4, 0x9, 0x3, 0x7, 0x2, 0x1, 0x9, 0x40, 0x8, 0x5, 0x5, 0x1], 0xd000, 0x2010}) [ 879.494940] device erspan0 entered promiscuous mode 07:10:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = inotify_init() r2 = dup2(r0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@broadcast, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr, @broadcast}, @udp={0x0, 0x0, 0x8}}}}}, 0x0) [ 879.523088] device ip_vti0 entered promiscuous mode [ 879.539584] device ip6_vti0 entered promiscuous mode [ 879.557169] device sit0 entered promiscuous mode [ 879.562840] device ip6tnl0 entered promiscuous mode [ 879.592657] device ip6gre0 entered promiscuous mode [ 879.598024] device syz_tun entered promiscuous mode [ 879.616082] device ip6gretap0 entered promiscuous mode [ 879.627667] device bridge0 entered promiscuous mode [ 879.635150] device vcan0 entered promiscuous mode [ 879.640240] device bond0 entered promiscuous mode [ 879.648405] device bond_slave_0 entered promiscuous mode [ 879.659288] device bond_slave_1 entered promiscuous mode [ 879.668674] device team0 entered promiscuous mode [ 879.675747] device team_slave_0 entered promiscuous mode [ 879.681584] device team_slave_1 entered promiscuous mode [ 879.690361] device dummy0 entered promiscuous mode [ 879.697660] device nlmon0 entered promiscuous mode [ 879.705839] device caif0 entered promiscuous mode [ 879.711005] device batadv0 entered promiscuous mode [ 879.719500] device vxcan0 entered promiscuous mode [ 879.727670] device vxcan1 entered promiscuous mode [ 879.734937] device netdevsim5 entered promiscuous mode [ 879.740609] device veth0 entered promiscuous mode [ 879.748680] device veth1 entered promiscuous mode [ 879.755997] device veth0_to_bridge entered promiscuous mode [ 879.767061] device veth1_to_bridge entered promiscuous mode [ 879.775245] device veth0_to_bond entered promiscuous mode [ 879.781243] device veth1_to_bond entered promiscuous mode [ 879.790409] device veth0_to_team entered promiscuous mode [ 879.798311] device veth1_to_team entered promiscuous mode [ 879.807213] device veth0_to_hsr entered promiscuous mode [ 879.815066] device veth1_to_hsr entered promiscuous mode [ 879.820977] device hsr0 entered promiscuous mode [ 879.828953] device wlan0 entered promiscuous mode [ 879.836151] device wlan1 entered promiscuous mode [ 879.841321] device veth2 entered promiscuous mode [ 879.849402] device veth3 entered promiscuous mode [ 879.856718] device veth4 entered promiscuous mode [ 879.861895] device veth5 entered promiscuous mode [ 879.870127] device veth6 entered promiscuous mode [ 879.877185] device veth7 entered promiscuous mode [ 879.884921] device veth8 entered promiscuous mode [ 879.890121] device veth9 entered promiscuous mode [ 879.897209] device veth10 entered promiscuous mode [ 879.905189] device veth11 entered promiscuous mode [ 879.910447] device veth12 entered promiscuous mode [ 879.917686] device veth13 entered promiscuous mode [ 879.925664] device veth14 entered promiscuous mode [ 879.930957] device veth15 entered promiscuous mode [ 879.938116] device bridge1 entered promiscuous mode 07:10:28 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 880.380941] device nr0 entered promiscuous mode [ 880.388831] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 880.408060] device lo left promiscuous mode [ 880.421254] device tunl0 left promiscuous mode 07:10:29 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x9}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 880.436733] device gre0 left promiscuous mode [ 880.444461] device gretap0 left promiscuous mode [ 880.467332] device erspan0 left promiscuous mode [ 880.486434] device ip_vti0 left promiscuous mode [ 880.496911] device ip6_vti0 left promiscuous mode [ 880.504134] device sit0 left promiscuous mode [ 880.508943] device ip6tnl0 left promiscuous mode [ 880.517584] device ip6gre0 left promiscuous mode [ 880.524674] device syz_tun left promiscuous mode [ 880.529717] device ip6gretap0 left promiscuous mode [ 880.537778] device bridge0 left promiscuous mode [ 880.545938] device vcan0 left promiscuous mode [ 880.550735] device bond0 left promiscuous mode [ 880.558454] device team0 left promiscuous mode [ 880.565604] device dummy0 left promiscuous mode [ 880.570556] device nlmon0 left promiscuous mode [ 880.578262] device caif0 left promiscuous mode [ 880.585066] device batadv0 left promiscuous mode [ 880.590113] device vxcan0 left promiscuous mode [ 880.599028] device vxcan1 left promiscuous mode [ 880.610773] device netdevsim5 left promiscuous mode [ 880.626382] device veth0 left promiscuous mode [ 880.639366] device veth1 left promiscuous mode [ 880.657169] device veth0_to_bridge left promiscuous mode [ 880.675037] device veth1_to_bridge left promiscuous mode [ 880.689949] device veth0_to_bond left promiscuous mode [ 880.702258] device bond_slave_0 left promiscuous mode [ 880.707599] device veth1_to_bond left promiscuous mode [ 880.723093] device bond_slave_1 left promiscuous mode [ 880.737500] device veth0_to_team left promiscuous mode [ 880.752763] device team_slave_0 left promiscuous mode [ 880.766085] device veth1_to_team left promiscuous mode [ 880.778335] device team_slave_1 left promiscuous mode [ 880.791655] device veth0_to_hsr left promiscuous mode [ 880.797495] device veth1_to_hsr left promiscuous mode [ 880.803382] device hsr0 left promiscuous mode [ 880.808146] device wlan0 left promiscuous mode [ 880.813300] device wlan1 left promiscuous mode [ 880.818137] device veth2 left promiscuous mode [ 880.823305] device veth3 left promiscuous mode [ 880.828145] device veth4 left promiscuous mode [ 880.833312] device veth5 left promiscuous mode [ 880.838156] device veth6 left promiscuous mode [ 880.843322] device veth7 left promiscuous mode [ 880.848140] device veth8 left promiscuous mode [ 880.854187] device veth9 left promiscuous mode [ 880.861313] device veth10 left promiscuous mode [ 880.867384] device veth11 left promiscuous mode [ 880.872626] device veth12 left promiscuous mode [ 880.877511] device veth13 left promiscuous mode [ 880.882812] device veth14 left promiscuous mode [ 880.887706] device veth15 left promiscuous mode [ 880.892962] device bridge1 left promiscuous mode [ 880.962116] net_ratelimit: 4 callbacks suppressed [ 880.962123] protocol 88fb is buggy, dev hsr_slave_0 [ 880.972106] protocol 88fb is buggy, dev hsr_slave_1 [ 881.059339] device nr0 entered promiscuous mode [ 881.362130] protocol 88fb is buggy, dev hsr_slave_0 [ 881.367274] protocol 88fb is buggy, dev hsr_slave_1 07:10:30 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0xa}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:30 executing program 1: r0 = epoll_create1(0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x36, 0x8000000, r1, 0x0) 07:10:30 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4101}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:30 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:30 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r3, 0x80045300, &(0x7f00000000c0)) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendmmsg$unix(r4, &(0x7f00000000c0), 0x0, 0x8000) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r5 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r5, 0x0) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x1aa, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r6, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x0, 0x8e8a177507e78fb7) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r9 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r9, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10010, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}}, 0x0, 0xa, 0xffffffffffffffff, 0x0) sendfile(r1, r9, 0x0, 0x80001d00c0d0) r10 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x101000, 0x0) ioctl$VIDIOC_OVERLAY(r10, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 881.615275] device nr0 entered promiscuous mode 07:10:30 executing program 1: [ 881.665400] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 881.709059] device lo entered promiscuous mode 07:10:30 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0xc}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 881.744168] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 881.762093] protocol 88fb is buggy, dev hsr_slave_0 [ 881.767240] protocol 88fb is buggy, dev hsr_slave_1 [ 881.769370] device tunl0 entered promiscuous mode 07:10:30 executing program 1: [ 881.791248] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 881.814089] device gre0 entered promiscuous mode [ 881.833186] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 881.863267] device gretap0 entered promiscuous mode [ 881.887256] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 881.911498] device erspan0 entered promiscuous mode [ 881.930383] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready 07:10:30 executing program 1: [ 881.942521] device ip_vti0 entered promiscuous mode [ 881.948066] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 881.968436] device ip6_vti0 entered promiscuous mode [ 881.983968] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 882.000920] device sit0 entered promiscuous mode 07:10:30 executing program 1: [ 882.024033] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 882.039486] device ip6tnl0 entered promiscuous mode [ 882.054743] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 882.061545] device ip6gre0 entered promiscuous mode [ 882.074035] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 882.088887] device syz_tun entered promiscuous mode [ 882.106357] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 882.115228] device ip6gretap0 entered promiscuous mode 07:10:30 executing program 1: [ 882.126162] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 882.140014] device bridge0 entered promiscuous mode 07:10:30 executing program 1: [ 882.188691] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 882.203589] device vcan0 entered promiscuous mode [ 882.209154] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 882.216037] device bond0 entered promiscuous mode [ 882.221115] device bond_slave_0 entered promiscuous mode [ 882.227237] device bond_slave_1 entered promiscuous mode [ 882.246733] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 882.258606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 882.268770] device team0 entered promiscuous mode [ 882.285833] device team_slave_0 entered promiscuous mode 07:10:30 executing program 1: [ 882.298984] device team_slave_1 entered promiscuous mode [ 882.318807] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 882.339887] 8021q: adding VLAN 0 to HW filter on device team0 07:10:30 executing program 1: [ 882.352840] device dummy0 entered promiscuous mode [ 882.358535] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 882.365604] device nlmon0 entered promiscuous mode [ 882.371374] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 882.378442] device caif0 entered promiscuous mode [ 882.392986] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 07:10:31 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4800}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 882.445726] device nr0 entered promiscuous mode 07:10:31 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 882.888961] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 882.920188] device lo left promiscuous mode [ 882.962320] device tunl0 left promiscuous mode [ 882.977159] device gre0 left promiscuous mode [ 882.987630] device gretap0 left promiscuous mode [ 882.998382] device erspan0 left promiscuous mode [ 883.014022] device ip_vti0 left promiscuous mode [ 883.026373] device ip6_vti0 left promiscuous mode [ 883.042092] protocol 88fb is buggy, dev hsr_slave_0 [ 883.047225] protocol 88fb is buggy, dev hsr_slave_1 [ 883.052697] device sit0 left promiscuous mode [ 883.061846] device ip6tnl0 left promiscuous mode [ 883.086893] device ip6gre0 left promiscuous mode [ 883.100850] device syz_tun left promiscuous mode [ 883.119185] device ip6gretap0 left promiscuous mode [ 883.138277] device bridge0 left promiscuous mode [ 883.155718] device vcan0 left promiscuous mode [ 883.177885] device bond0 left promiscuous mode [ 883.192856] device bond_slave_0 left promiscuous mode [ 883.210225] device bond_slave_1 left promiscuous mode [ 883.217308] device team0 left promiscuous mode [ 883.226926] device team_slave_0 left promiscuous mode [ 883.233539] device team_slave_1 left promiscuous mode [ 883.240136] device dummy0 left promiscuous mode [ 883.250653] device nlmon0 left promiscuous mode [ 883.256929] device caif0 left promiscuous mode [ 883.270485] device nr0 entered promiscuous mode 07:10:31 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0xe}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:31 executing program 1: 07:10:31 executing program 3: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) mmap$binder(&(0x7f0000063000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0x0) r5 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r5, 0x0) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r6, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x1, 0x80000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.capability\x00', &(0x7f0000000140)=@v2={0x2000000, [{0x80000001, 0x3}, {0x0, 0x6}]}, 0x14, 0x1) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r7, 0x0, 0x80001d00c0d0) ioctl$PERF_EVENT_IOC_PERIOD(r6, 0x40082404, &(0x7f0000000200)=0x7) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:31 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4c00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:31 executing program 1: 07:10:31 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 883.513425] device nr0 entered promiscuous mode [ 883.523012] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 883.534511] audit: type=1400 audit(1577171432.108:1152): avc: denied { map } for pid=22823 comm="syz-executor.3" path="socket:[87871]" dev="sockfs" ino=87871 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=packet_socket permissive=1 07:10:32 executing program 1: 07:10:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x10}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 883.653866] device nr0 entered promiscuous mode 07:10:32 executing program 1: 07:10:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5865}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:32 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 883.842093] protocol 88fb is buggy, dev hsr_slave_0 07:10:32 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x70}, @dev}, @icmp=@parameter_prob={0xb, 0x4, 0x0, 0x0, 0x0, 0x6, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @dev}}}}}}, 0x0) [ 883.889110] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 883.919667] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready 07:10:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x60}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 883.955693] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 883.993408] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 884.023831] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 884.067344] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 884.092359] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready 07:10:32 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, r0, 0x0) [ 884.122638] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 884.153037] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 884.173009] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 884.203146] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 884.217155] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 884.243402] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 884.264971] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 884.291659] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 884.333557] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 884.342157] 8021q: adding VLAN 0 to HW filter on device bond0 [ 884.368309] audit: type=1800 audit(1577171432.938:1153): pid=22869 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="sda1" ino=17233 res=0 [ 884.376245] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 884.464155] 8021q: adding VLAN 0 to HW filter on device team0 [ 884.491875] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 884.520164] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 884.577882] device nr0 entered promiscuous mode 07:10:33 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x800000, 0x0) ioctl$VHOST_GET_VRING_ENDIAN(r5, 0x4008af14, &(0x7f0000000140)={0x3, 0x2d0}) r6 = open(&(0x7f00000000c0)='./bus\x00', 0xccf82b8c3d0ba886, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:33 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000000)={@random="a9248e6e42e2", @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev}, @icmp=@timestamp}}}}, 0x0) 07:10:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:33 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:33 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 885.028059] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:33 executing program 1: perf_event_open(&(0x7f00000003c0)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000340)={0x1, 0x70, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, @perf_config_ext, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10d, 0xb, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x660c, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x4030582a, &(0x7f0000000040)) 07:10:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6558}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:33 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/168, 0xa8}, 0x7}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = dup2(r4, r4) ioctl$DRM_IOCTL_GET_CAP(r5, 0xc010640c, &(0x7f0000000200)={0x6}) write$tun(r5, &(0x7f00000003c0)={@void, @val={0x1, 0x0, 0x7, 0x3, 0x7fff, 0x400}, @ipv6={0x5, 0x6, "151d69", 0x62, 0x0, 0x2, @loopback, @local, {[@dstopts={0x4, 0x6}], @tipc=@payload_named={{{{{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x1, 0x6, 0x0, 0x2, 0x100, 0x81, 0x2, 0x4e23, 0x4e23}, 0x0, 0x2}, 0x2, 0x1}}, [0x0]}}}}, 0x94) pipe(&(0x7f0000000100)={0xffffffffffffffff}) ioctl$VIDIOC_ENUMAUDIO(r6, 0xc0345641, &(0x7f0000000180)={0x8, "91609518a1d91f2ff62800359b99d5200598ffef658b89361ee720707af7b079"}) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) creat(&(0x7f00000001c0)='./bus\x00', 0x0) setsockopt$RXRPC_SECURITY_KEY(r5, 0x110, 0x1, &(0x7f0000000100)='em1user\x00', 0x8) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) r7 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r7, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xd9, 0x0, 0x0, 0x0, 0x0, 0x2000000000003, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x0, 0x0, 0x400, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(r8, &(0x7f0000000000), 0x10000000d) [ 885.271857] device nr0 entered promiscuous mode [ 885.285794] device nr0 entered promiscuous mode 07:10:33 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 885.531661] audit: type=1804 audit(1577171434.098:1154): pid=22909 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir429526756/syzkaller.kxVamC/363/bus" dev="sda1" ino=17270 res=1 07:10:34 executing program 1: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 885.649803] audit: type=1804 audit(1577171434.128:1155): pid=22909 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429526756/syzkaller.kxVamC/363/bus" dev="sda1" ino=17270 res=1 [ 885.789333] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 885.799828] device lo entered promiscuous mode [ 885.805553] device tunl0 entered promiscuous mode [ 885.819207] device gre0 entered promiscuous mode [ 885.831080] device gretap0 entered promiscuous mode [ 885.842374] device erspan0 entered promiscuous mode [ 885.847723] device ip_vti0 entered promiscuous mode [ 885.855856] device ip6_vti0 entered promiscuous mode [ 885.861251] device sit0 entered promiscuous mode [ 885.867260] device ip6tnl0 entered promiscuous mode [ 885.876340] device ip6gre0 entered promiscuous mode [ 885.881610] device syz_tun entered promiscuous mode [ 885.888005] device ip6gretap0 entered promiscuous mode [ 885.897414] device bridge0 entered promiscuous mode [ 885.903601] device vcan0 entered promiscuous mode [ 885.908692] device bond0 entered promiscuous mode [ 885.917454] device bond_slave_0 entered promiscuous mode [ 885.924309] device bond_slave_1 entered promiscuous mode [ 885.930117] device team0 entered promiscuous mode [ 885.938886] device team_slave_0 entered promiscuous mode [ 885.945704] device team_slave_1 entered promiscuous mode [ 885.951527] device dummy0 entered promiscuous mode [ 885.960552] device nlmon0 entered promiscuous mode [ 885.966618] device caif0 entered promiscuous mode [ 885.971695] device batadv0 entered promiscuous mode [ 885.980595] device vxcan0 entered promiscuous mode [ 885.986687] device vxcan1 entered promiscuous mode [ 885.991831] device netdevsim5 entered promiscuous mode [ 886.001206] device veth0 entered promiscuous mode [ 886.007489] device veth1 entered promiscuous mode [ 886.016460] device veth0_to_bridge entered promiscuous mode [ 886.023616] device veth1_to_bridge entered promiscuous mode [ 886.029663] device veth0_to_bond entered promiscuous mode [ 886.039387] device veth1_to_bond entered promiscuous mode [ 886.046396] device veth0_to_team entered promiscuous mode [ 886.056103] device veth1_to_team entered promiscuous mode [ 886.063126] device veth0_to_hsr entered promiscuous mode [ 886.068964] device veth1_to_hsr entered promiscuous mode [ 886.078622] device hsr0 entered promiscuous mode [ 886.084754] device wlan0 entered promiscuous mode [ 886.089921] device wlan1 entered promiscuous mode [ 886.098752] device veth2 entered promiscuous mode [ 886.104897] device veth3 entered promiscuous mode [ 886.110155] device veth4 entered promiscuous mode [ 886.119048] device veth5 entered promiscuous mode [ 886.125089] device veth6 entered promiscuous mode [ 886.130194] device veth7 entered promiscuous mode [ 886.139157] device veth8 entered promiscuous mode [ 886.145457] device veth9 entered promiscuous mode [ 886.150545] device veth10 entered promiscuous mode [ 886.159500] device veth11 entered promiscuous mode [ 886.167703] device veth12 entered promiscuous mode [ 886.176878] device veth13 entered promiscuous mode [ 886.183279] device veth14 entered promiscuous mode [ 886.188465] device veth15 entered promiscuous mode [ 886.197534] device bridge1 entered promiscuous mode 07:10:34 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6800}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 886.243970] device nr0 entered promiscuous mode 07:10:34 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 886.691547] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 886.709845] device lo left promiscuous mode [ 886.720066] device tunl0 left promiscuous mode [ 886.735765] device gre0 left promiscuous mode [ 886.750641] device gretap0 left promiscuous mode [ 886.760732] device erspan0 left promiscuous mode [ 886.772207] device ip_vti0 left promiscuous mode [ 886.783044] device ip6_vti0 left promiscuous mode [ 886.799653] device sit0 left promiscuous mode [ 886.816888] device ip6tnl0 left promiscuous mode [ 886.832074] device ip6gre0 left promiscuous mode [ 886.847278] device syz_tun left promiscuous mode [ 886.861356] device ip6gretap0 left promiscuous mode [ 886.875801] device bridge0 left promiscuous mode [ 886.889885] device vcan0 left promiscuous mode [ 886.894759] device bond0 left promiscuous mode [ 886.899819] device team0 left promiscuous mode [ 886.904900] device dummy0 left promiscuous mode [ 886.909817] device nlmon0 left promiscuous mode [ 886.914790] device caif0 left promiscuous mode [ 886.919639] device batadv0 left promiscuous mode [ 886.924707] device vxcan0 left promiscuous mode [ 886.929628] device vxcan1 left promiscuous mode [ 886.935252] device netdevsim5 left promiscuous mode [ 886.940535] device veth0 left promiscuous mode [ 886.945420] device veth1 left promiscuous mode [ 886.950270] device veth0_to_bridge left promiscuous mode [ 886.956132] device veth1_to_bridge left promiscuous mode [ 886.961989] device veth0_to_bond left promiscuous mode [ 886.967669] device bond_slave_0 left promiscuous mode [ 886.973216] device veth1_to_bond left promiscuous mode [ 886.987723] device bond_slave_1 left promiscuous mode [ 887.002253] device veth0_to_team left promiscuous mode [ 887.015740] device team_slave_0 left promiscuous mode [ 887.030122] device veth1_to_team left promiscuous mode [ 887.044711] device team_slave_1 left promiscuous mode [ 887.058065] device veth0_to_hsr left promiscuous mode [ 887.073782] device veth1_to_hsr left promiscuous mode [ 887.087273] device hsr0 left promiscuous mode [ 887.099955] device wlan0 left promiscuous mode [ 887.111529] device wlan1 left promiscuous mode [ 887.124273] device veth2 left promiscuous mode [ 887.135996] device veth3 left promiscuous mode [ 887.147668] device veth4 left promiscuous mode [ 887.159327] device veth5 left promiscuous mode [ 887.164252] device veth6 left promiscuous mode [ 887.169145] device veth7 left promiscuous mode [ 887.174075] device veth8 left promiscuous mode [ 887.193112] device veth9 left promiscuous mode [ 887.202088] net_ratelimit: 6 callbacks suppressed [ 887.202095] protocol 88fb is buggy, dev hsr_slave_0 [ 887.204743] device veth10 left promiscuous mode [ 887.207039] protocol 88fb is buggy, dev hsr_slave_1 [ 887.222892] device veth11 left promiscuous mode [ 887.234538] device veth12 left promiscuous mode [ 887.250159] device veth13 left promiscuous mode [ 887.261869] device veth14 left promiscuous mode [ 887.276857] device veth15 left promiscuous mode [ 887.292356] device bridge1 left promiscuous mode 07:10:35 executing program 1: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:35 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6c00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:35 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FBIOGET_FSCREENINFO(r3, 0x4602, &(0x7f00000000c0)) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:36 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 887.524866] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 887.548583] device nr0 entered promiscuous mode 07:10:36 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7400}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 887.600113] device nr0 entered promiscuous mode [ 887.602358] protocol 88fb is buggy, dev hsr_slave_0 [ 887.610577] protocol 88fb is buggy, dev hsr_slave_1 07:10:36 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 888.002918] protocol 88fb is buggy, dev hsr_slave_0 [ 888.008526] protocol 88fb is buggy, dev hsr_slave_1 [ 888.207603] device nr0 entered promiscuous mode [ 888.218208] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:36 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7a00}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 888.386018] audit: type=1800 audit(1577171436.958:1156): pid=22968 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="sda1" ino=17286 res=0 07:10:37 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:37 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 888.463128] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:37 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8100}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:37 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000080)=0x2000001, 0x326) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(0xffffffffffffffff, 0xc080661a, &(0x7f00000000c0)={{0x1, 0x0, @reserved="4b59bec201bac698044d8a5616c9ce450d32884f1a7825850585f215cdfdfee2"}}) socket$nl_netfilter(0x10, 0x3, 0xc) [ 888.944946] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 888.957591] device lo entered promiscuous mode [ 888.979357] device tunl0 entered promiscuous mode [ 888.996243] device gre0 entered promiscuous mode [ 889.001385] device gretap0 entered promiscuous mode [ 889.008275] device erspan0 entered promiscuous mode [ 889.017990] device ip_vti0 entered promiscuous mode [ 889.024746] device ip6_vti0 entered promiscuous mode [ 889.030242] device sit0 entered promiscuous mode [ 889.040020] device ip6tnl0 entered promiscuous mode [ 889.047153] device ip6gre0 entered promiscuous mode [ 889.059104] device syz_tun entered promiscuous mode [ 889.071330] device ip6gretap0 entered promiscuous mode [ 889.081682] device bridge0 entered promiscuous mode [ 889.088628] device vcan0 entered promiscuous mode [ 889.097749] device bond0 entered promiscuous mode [ 889.104248] device bond_slave_0 entered promiscuous mode [ 889.110057] device bond_slave_1 entered promiscuous mode [ 889.120447] device team0 entered promiscuous mode [ 889.127050] device team_slave_0 entered promiscuous mode [ 889.136894] device team_slave_1 entered promiscuous mode [ 889.144224] device dummy0 entered promiscuous mode [ 889.149509] device nlmon0 entered promiscuous mode [ 889.158873] device caif0 entered promiscuous mode [ 889.165410] device batadv0 entered promiscuous mode [ 889.170778] device vxcan0 entered promiscuous mode [ 889.180322] device vxcan1 entered promiscuous mode [ 889.186977] device netdevsim5 entered promiscuous mode [ 889.196626] device veth0 entered promiscuous mode [ 889.201853] device veth1 entered promiscuous mode [ 889.208296] device veth0_to_bridge entered promiscuous mode [ 889.218553] device veth1_to_bridge entered promiscuous mode [ 889.226110] device veth0_to_bond entered promiscuous mode [ 889.236341] device veth1_to_bond entered promiscuous mode [ 889.243542] device veth0_to_team entered promiscuous mode [ 889.249565] device veth1_to_team entered promiscuous mode [ 889.259771] device veth0_to_hsr entered promiscuous mode [ 889.267067] device veth1_to_hsr entered promiscuous mode [ 889.277082] device hsr0 entered promiscuous mode [ 889.282093] protocol 88fb is buggy, dev hsr_slave_0 [ 889.287230] protocol 88fb is buggy, dev hsr_slave_1 [ 889.297862] device wlan0 entered promiscuous mode [ 889.303382] device wlan1 entered promiscuous mode [ 889.308520] device veth2 entered promiscuous mode [ 889.318540] device veth3 entered promiscuous mode [ 889.324220] device veth4 entered promiscuous mode [ 889.329368] device veth5 entered promiscuous mode [ 889.339570] device veth6 entered promiscuous mode [ 889.345058] device veth7 entered promiscuous mode [ 889.350213] device veth8 entered promiscuous mode [ 889.360358] device veth9 entered promiscuous mode [ 889.365814] device veth10 entered promiscuous mode [ 889.371018] device veth11 entered promiscuous mode [ 889.380912] device veth12 entered promiscuous mode [ 889.386566] device veth13 entered promiscuous mode [ 889.391828] device veth14 entered promiscuous mode [ 889.402087] device veth15 entered promiscuous mode [ 889.407355] device bridge1 entered promiscuous mode [ 889.417780] device nr0 entered promiscuous mode 07:10:38 executing program 1: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:38 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 889.447315] device nr0 entered promiscuous mode 07:10:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 889.682130] protocol 88fb is buggy, dev hsr_slave_0 [ 889.687287] protocol 88fb is buggy, dev hsr_slave_1 07:10:38 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 889.923186] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 889.944527] device lo left promiscuous mode [ 889.970562] device tunl0 left promiscuous mode [ 890.000539] device gre0 left promiscuous mode [ 890.006541] device gretap0 left promiscuous mode [ 890.028255] device erspan0 left promiscuous mode [ 890.046871] device ip_vti0 left promiscuous mode [ 890.051892] device ip6_vti0 left promiscuous mode [ 890.084778] device sit0 left promiscuous mode [ 890.092586] device ip6tnl0 left promiscuous mode [ 890.116568] device ip6gre0 left promiscuous mode [ 890.122867] device syz_tun left promiscuous mode [ 890.141381] device ip6gretap0 left promiscuous mode [ 890.160271] device bridge0 left promiscuous mode [ 890.165479] device vcan0 left promiscuous mode [ 890.185416] device bond0 left promiscuous mode [ 890.193526] device team0 left promiscuous mode [ 890.209676] device dummy0 left promiscuous mode [ 890.227425] device nlmon0 left promiscuous mode [ 890.233675] device caif0 left promiscuous mode [ 890.238684] device batadv0 left promiscuous mode [ 890.247577] device vxcan0 left promiscuous mode [ 890.253751] device vxcan1 left promiscuous mode [ 890.258736] device netdevsim5 left promiscuous mode [ 890.267788] device veth0 left promiscuous mode [ 890.273913] device veth1 left promiscuous mode [ 890.278894] device veth0_to_bridge left promiscuous mode [ 890.288636] device veth1_to_bridge left promiscuous mode [ 890.295724] device veth0_to_bond left promiscuous mode [ 890.301364] device bond_slave_0 left promiscuous mode [ 890.310735] device veth1_to_bond left promiscuous mode [ 890.317517] device bond_slave_1 left promiscuous mode [ 890.326811] device veth0_to_team left promiscuous mode [ 890.333642] device team_slave_0 left promiscuous mode [ 890.339192] device veth1_to_team left promiscuous mode [ 890.349115] device team_slave_1 left promiscuous mode [ 890.355822] device veth0_to_hsr left promiscuous mode [ 890.361488] device veth1_to_hsr left promiscuous mode [ 890.370627] device hsr0 left promiscuous mode [ 890.377566] device wlan0 left promiscuous mode [ 890.386211] device wlan1 left promiscuous mode [ 890.391897] device veth2 left promiscuous mode [ 890.397996] device veth3 left promiscuous mode [ 890.406648] device veth4 left promiscuous mode [ 890.411618] device veth5 left promiscuous mode [ 890.417896] device veth6 left promiscuous mode [ 890.426783] device veth7 left promiscuous mode [ 890.431712] device veth8 left promiscuous mode [ 890.437766] device veth9 left promiscuous mode [ 890.446869] device veth10 left promiscuous mode [ 890.456962] device veth11 left promiscuous mode [ 890.474301] device veth12 left promiscuous mode [ 890.485910] device veth13 left promiscuous mode [ 890.497901] device veth14 left promiscuous mode [ 890.508689] device veth15 left promiscuous mode [ 890.519612] device bridge1 left promiscuous mode 07:10:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffff}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 890.535401] device nr0 entered promiscuous mode [ 890.599738] device nr0 entered promiscuous mode 07:10:39 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 891.058440] device nr0 entered promiscuous mode [ 891.071857] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 891.090214] device lo entered promiscuous mode [ 891.104232] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 891.117420] device tunl0 entered promiscuous mode [ 891.130909] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 891.147835] device gre0 entered promiscuous mode [ 891.162512] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 891.172548] device gretap0 entered promiscuous mode [ 891.178339] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 891.189644] device erspan0 entered promiscuous mode [ 891.195625] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 891.209510] device ip_vti0 entered promiscuous mode [ 891.215328] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 891.226891] device ip6_vti0 entered promiscuous mode [ 891.232717] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 891.239704] device sit0 entered promiscuous mode [ 891.249852] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 891.256595] device ip6tnl0 entered promiscuous mode [ 891.266696] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 891.273662] device ip6gre0 entered promiscuous mode [ 891.279359] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 891.290777] device syz_tun entered promiscuous mode [ 891.296699] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 891.308263] device ip6gretap0 entered promiscuous mode [ 891.315279] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 891.327192] device bridge0 entered promiscuous mode [ 891.333133] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 891.340003] device vcan0 entered promiscuous mode [ 891.350195] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 891.356993] device bond0 entered promiscuous mode [ 891.366856] device bond_slave_0 entered promiscuous mode [ 891.372740] device bond_slave_1 entered promiscuous mode [ 891.379215] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 891.390119] 8021q: adding VLAN 0 to HW filter on device bond0 [ 891.397440] device team0 entered promiscuous mode [ 891.406929] device team_slave_0 entered promiscuous mode 07:10:40 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x5a1200, 0x0) write$vhci(r1, &(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, "02632cf2214ff149676799c9ae6acded6e6616976ff44cfdc44a7e614b973e6713a85dff1c55b3cedcf134e407ed97366a3b75236f793fba43311a519576df1190d1c30cb3cf4252be961d09386aecac970c748e84917ec7f51b690c2c6c7239ea220fe540d420f20c0122b60fa3cdbddbbdf42f"}, 0x75) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0xc33b, 0x0, 0x10001, 0x7}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000100)={0x96f, r2}) [ 891.412824] device team_slave_1 entered promiscuous mode [ 891.419264] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 891.430133] 8021q: adding VLAN 0 to HW filter on device team0 [ 891.438296] device dummy0 entered promiscuous mode [ 891.446805] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 891.453985] device nlmon0 entered promiscuous mode [ 891.459631] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready 07:10:40 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 891.466574] device caif0 entered promiscuous mode 07:10:40 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r2, 0x800443d2, &(0x7f0000000180)={0x8, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}]}) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700000000000000000000e1c0", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="740000002400070500"/20, @ANYRES32=r6, @ANYBLOB="00000000ffffffff000000000800010073667100480002000000000000000000000000000000000000000000000000000000000000471a00000000000000000000000000000000000000000000f3aff151ed1e4a08c07fa96752c88f8ca2454f9c9ed6974ba345296ca6ffafecb3ab42207c5c129c70d7ffb1202624af00"], 0x74}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="7c0000002c00010700"/20, @ANYRES32=r6, @ANYBLOB="00000002000000000300c4c1080001006270660050000200080006000000000004000500400002003c00010000000000eeff0075da891600000011000000000000000010000000000000000000000000000000000000e4ff00ddffffff00"/116], 0x7c}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x3d, 0x1, &(0x7f00000001c0)=@raw=[@exit], &(0x7f0000000200)='GPL\x00', 0x6, 0x54, &(0x7f0000000240)=""/84, 0xa1880, 0x3557e068594699ae, [], r6, 0x1, 0xffffffffffffffff, 0x8, &(0x7f00000002c0)={0x3, 0x3}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x5, 0x6a, 0x4}, 0x10}, 0x78) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000480)={0x9, &(0x7f0000000400)=[{0x7fff, 0x1f, 0x8, 0x4}, {0x8, 0x1, 0x81, 0x3f}, {0x6, 0xff, 0x9e, 0x7}, {0x1, 0x1, 0x9, 0x5}, {0x1, 0x3, 0x1}, {0x9, 0x1f, 0x9}, {0x1f, 0x40, 0x9, 0x9}, {0xf, 0x91, 0x8, 0x8}, {0x4, 0x6, 0x8, 0x8}]}) ppoll(&(0x7f00000004c0)=[{r7, 0x28}, {r8, 0x1012}, {r9, 0x10}], 0x3, &(0x7f0000000500), &(0x7f0000000540)={0x4}, 0x8) setsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, &(0x7f0000000000)=0x1, 0x4) r10 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r10, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r11 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r11, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet6_mreq(r10, 0x29, 0x14, &(0x7f0000000100)={@empty}, &(0x7f0000000140)=0xd3) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) 07:10:40 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f00000004c0)=ANY=[@ANYBLOB="000000002a25000025090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001080000000007000100008000"/192]) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r2, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) lsetxattr$smack_xattr_label(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='security.SMACK64IPOUT\x00', 0x0, 0x0, 0x1) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r2, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r2, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) getsockopt$inet_mreqsrc(r1, 0x0, 0x0, &(0x7f0000000080)={@loopback, @broadcast, @empty}, &(0x7f00000006c0)=0xc) r3 = openat$cgroup_ro(r0, &(0x7f0000000680)='memory.current\x00', 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000005b80)=0x211ce5c2) read$FUSE(r2, &(0x7f0000001780), 0x1000) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f00000003c0)={0x0, 0x100000000}) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000580)) write$FUSE_ENTRY(r2, &(0x7f00000005c0)={0x90, 0x0, 0x2}, 0x90) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FBIOGET_CON2FBMAP(r4, 0x460f, &(0x7f0000000700)={0x38}) accept4$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x0, 0x0) write$FUSE_ENTRY(r2, &(0x7f0000000380)={0x90, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}}, 0x90) umount2(&(0x7f0000000540)='./file0\x00', 0x0) 07:10:40 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 891.782273] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 891.821483] device lo left promiscuous mode [ 891.838101] device tunl0 left promiscuous mode [ 891.845137] device gre0 left promiscuous mode [ 891.857088] device gretap0 left promiscuous mode [ 891.863305] device erspan0 left promiscuous mode [ 891.883424] device ip_vti0 left promiscuous mode [ 891.898640] device ip6_vti0 left promiscuous mode [ 891.905037] device sit0 left promiscuous mode [ 891.910895] device ip6tnl0 left promiscuous mode [ 891.925923] device ip6gre0 left promiscuous mode [ 891.931821] device syz_tun left promiscuous mode [ 891.938225] device ip6gretap0 left promiscuous mode [ 891.944493] device bridge0 left promiscuous mode [ 891.950640] device vcan0 left promiscuous mode [ 891.956413] device bond0 left promiscuous mode [ 891.961261] device bond_slave_0 left promiscuous mode [ 891.967003] device bond_slave_1 left promiscuous mode [ 891.974188] device team0 left promiscuous mode [ 891.985613] device team_slave_0 left promiscuous mode [ 891.991169] device team_slave_1 left promiscuous mode [ 891.998245] device dummy0 left promiscuous mode [ 892.004464] device nlmon0 left promiscuous mode [ 892.013251] device caif0 left promiscuous mode 07:10:40 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:40 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, 0x0, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r0, 0x0, 0x4000) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x803, 0x0) socket(0x1, 0x803, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0xa0002, 0x0) write$sndseq(r2, &(0x7f0000000080)=[{0x0, 0x5}], 0x30) write$sndseq(r2, 0x0, 0x0) getsockname$packet(r0, 0x0, &(0x7f0000000200)=0xfd4e) getpriority(0x1, 0x0) r3 = gettid() getpriority(0x1, r3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)}, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$sndseq(r4, &(0x7f0000000080)=[{0x10081, 0x6, 0x0, 0x0, @tick, {}, {}, @raw8={"26fca6df95f88cd60bc421c2"}}], 0x30) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000380)='devlink\x00') sendmsg$DEVLINK_CMD_PORT_GET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400", @ANYRES16=r6, @ANYBLOB="7ddf0000eae6c0c652db17000046a0e8460f3d7bbd130f2647255c565156da77171cc0861deaf09bb88cb03ed0142cec5809e4a2d9f5bd178172081e255fe423281d01db01dc01d2a28af3bd75c080ed4db892b364df7819fb9525b1ce4c4409d755c0729ffbf705008d9fcd7be58006ae0faa124423dd5ab40c8fdca27f8746b46d9154ff5610a3ae9e47f001b2f024a75b3b6217952c0049f4fdd4fb6447f95b4b1a36b625d4f0dda801ca75cce97ad21ebbc6ea5c6d1104dc003e757e265e6ee917939145ff5af4b04a29fca2"], 0x3}}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000380)={0x0, 0x0}) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0xa0002, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000080)=[{0x10081, 0x5}], 0x30) r9 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0xa0002, 0x0) write$sndseq(r9, &(0x7f0000000080)=[{0x10081, 0x5}], 0x30) write$sndseq(r9, &(0x7f0000000240)=[{0x3, 0x97, 0x0, 0x9b, @time={0x0, 0x9}, {0x2e, 0x7f}, {0xa1, 0x8}, @raw8={"7e6a263060b1b3993d013eef"}}, {0x0, 0x9, 0xce, 0x9, @time={0x2, 0x6}, {0x5, 0x5c}, {0x1, 0xd6}, @raw8={"3d2206d6ae2256179f2e4268"}}, {0x80, 0x9, 0x4, 0x8, @tick=0x2, {0x40, 0xfa}, {0x4, 0x8}, @queue={0x3, {0x400, 0xa18a}}}, {0x0, 0x3f, 0x7b, 0xff, @time={0x6, 0x7fff}, {0x1f, 0xfc}, {0x9, 0x8}, @time=@tick=0x8}], 0x70) sendmsg$DEVLINK_CMD_RELOAD(r4, &(0x7f00000002c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000400)={0x88, r6, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r7}}, {@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r8}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_FD={0x8}}]}, 0x88}, 0x1, 0x0, 0x0, 0x4080}, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0xa0002, 0x0) 07:10:40 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r4, 0x5456, &(0x7f00000000c0)={0x79, 0x7f, 0x9, 0x7f, 0x6, "a76e16138431dba9481bc192cbca386249b7b7"}) r5 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r5, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000100)={'gre0\x00', 0x81}) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r6, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r7, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 892.039463] device nr0 entered promiscuous mode 07:10:40 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_USER_PVERSION(r1, 0x40044104, &(0x7f0000000000)=0x1) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) 07:10:40 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 892.209814] device nr0 entered promiscuous mode [ 892.220871] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:40 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:40 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:40 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 892.348051] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23069 comm=syz-executor.1 07:10:41 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$MON_IOCX_GETX(r3, 0x4018920a, &(0x7f0000000280)={&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000340)=""/255, 0x21}) ioctl$TIOCSRS485(r1, 0x542f, &(0x7f00000005c0)={0x1f, 0x1, 0x7ff}) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000540)='/dev/vcsa\x00', 0x100, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r5, 0xc0245720, &(0x7f0000000580)={0x2}) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r4, 0xc0845658, &(0x7f0000000180)={0x0, @reserved}) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000100)) r6 = open(&(0x7f0000000040)='./file0\x00', 0x88000, 0x0) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r8 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000600)='/dev/dlm-monitor\x00', 0x203, 0x0) write$selinux_create(r8, &(0x7f0000000640)=@access={'system_u:object_r:logrotate_var_lib_t:s0', 0x20, '/usr/sbin/cupsd', 0x20, 0x5}, 0x4e) ioctl$PPPIOCGFLAGS1(r7, 0x8004745a, &(0x7f00000000c0)) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000000000)=0x1000, 0x4) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0x1}], 0x1, 0x8001) lgetxattr(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)=@known='trusted.overlay.redirect\x00', &(0x7f0000000440)=""/234, 0xea) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000080)=0x3fe0, 0x4) r9 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r9, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r9, 0xc008551c, &(0x7f00000006c0)={0x8, 0x8, [0x1, 0x7]}) [ 892.409830] device nr0 entered promiscuous mode 07:10:41 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000300), 0x100000000000025f, 0x8007) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xffffffffffff7fff, 0x8000) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') r3 = socket$caif_stream(0x25, 0x1, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r3, 0xc0046686, &(0x7f00000001c0)={0x1, 0xf9, "5201ce2d2055777bfefcf1931778518024c7c2d32308cf94d7694041d0a3648b2023a5b09afecb722aa085484c26b1226391c0610dc125795bdc1440e6d0be6d21721c9f2b197eec7611749631cb18fb43794614d804de5a3d2d8b01a4c67daebaaf29a92e82f2dcf3b5b82b7b22c2992c74f49e7962d411387903fe48fc31e92dc4456f3869c9d97252ea8f6921d55cb3f8ed1468af7884e97a410a58bb7af8f5486b2b96593d0f34da2b6efa6323841e97663dc2d4a3bbb8d487abe5ddcccb0d677491d4674e2170045624daa439bc74093fed64f568d18bed087a15c383739992cbf1e577757b5d4cb75d525b6476007091591fcf89d510"}) sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x48088104}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="e701fefbd2dc2d90a9a3c9a572e383000000", @ANYRES16=r2, @ANYBLOB="10002bbd7000fbdbdf251500000014000900080002000200000008000100ffff0000"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x10) 07:10:41 executing program 1: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lseek(r0, 0x800002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpu.stat\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000080)="e3341232f022a360a6c886da08391df5", 0x10) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="f8"], 0x1) fallocate(0xffffffffffffffff, 0x3, 0x0, 0x0) writev(r0, &(0x7f0000000380), 0x0) lseek(r0, 0x0, 0x3) [ 892.519414] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:41 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/\x00', 0x401, 0x0) pwritev(r0, &(0x7f0000000c40)=[{&(0x7f00000008c0)='L', 0xfffffff5}], 0x1, 0x8001) 07:10:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:41 executing program 1: r0 = perf_event_open(&(0x7f0000000100)={0x4, 0x70, 0x8, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0xfd727a5aa08d3c4e, 0xae74c897c480b113, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x3}, 0x0, 0xa, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x1ff) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='rdma.current\x00', 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000640)={r1, 0x28, &(0x7f0000000040)={0x0, 0x0}}, 0xffffffffffffffdf) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r2}, 0xc) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0x203}, 0x0, 0x0, 0x7, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000a00)='./cgroup.net/syz1\xff', 0x1ff) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x2000, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000840)={&(0x7f0000000800)='cpuacct.usage_sys\x00'}, 0x10) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='pids.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0xc0189436, &(0x7f0000000040)) r5 = getpid() r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='pids.current\x00', 0x0, 0x0) ioctl$TUNGETVNETHDRSZ(r6, 0x800454d7, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000880)={0xffffffffffffffff, 0xb0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=0x6, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x0, 0x5}, 0x0, 0x0, &(0x7f0000000540)={0x5, 0x4, 0x8, 0x67}, &(0x7f0000000580)=0xc39, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=0x1}}, 0x2da) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={r5, r6, 0x0, 0x7, &(0x7f0000000280)='nodev:\x00', r7}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000008c0)={r5, r4, 0x0, 0xffffffffffffffc1, &(0x7f0000000a40)='\x00'}, 0xfffffffffffffc26) ioctl$TUNSETPERSIST(r3, 0x400454cb, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x275a, 0x0) syncfs(r9) write$cgroup_int(r9, &(0x7f0000000200), 0x4003da) r10 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r10, &(0x7f0000000200)=0x9, 0x12) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.net/syz0\x00', 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0x400000) r11 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r11, &(0x7f0000000200), 0x400000) mkdirat$cgroup(r3, 0x0, 0x1ff) ioctl$PERF_EVENT_IOC_QUERY_BPF(r8, 0xc008240a, &(0x7f0000000900)=ANY=[@ANYBLOB="080000000000000000000000e5ff00"/40]) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000a80)='./cgroup.cpu/syz1\x00', 0x1ff) gettid() r12 = socket$kcm(0x2, 0x5, 0x0) sendmsg$kcm(r12, &(0x7f0000000680)={&(0x7f0000000740)=@pptp={0x18, 0x2, {0x0, @loopback}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x38c}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, &(0x7f00000009c0)=ANY=[@ANYRES32=r12], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x78) openat$tun(0xffffffffffffff9c, &(0x7f0000000300)='/dev/net/tun\x00', 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000007c0)={0x0, 0xffffffffffffffff, 0x18}, 0x10) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x4c, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487591731cba12c07d57d995b61e89a4530f92304f242b416ae9eeefc0e9c60ebab1c176bf9bb4dde984510c82dc2b9381b72b100d0682fd0a0c4a06b29e220dc28dac72599456d4c4e6f3fe2d1dee18f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084a12f56d1cb398dff1db3df9858837458a4ca03767c69cee1b6be484e4c9507af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208e4557cd4ed88b37ab8d7674c644dca2f1b4d745fd95c41f9d441d42f49db6d4a4762e5cc23dfc1adafd1e5a3e7f2e898961cb43e438c4e41ae43ea118e1407a601dae4b8b99bffffb1ac006c67767b03b95151aeb89e6d4a43c625aa2285b6e4afd8c1cc3eb215ba22f43115dbba9dc7beedb130d9f2be90133a0e3ed34258b8c9370634060105baa664953514605fba3973aa021945b985a8a66e9cfa9d9e57033815717b4fdbe55b37cb8d7f41aacfbd4089ea1bd22440f64909a09b5a759a703e71f358e11ac8e13db15d792e604a4f279b3bd6621bdf2c17bcaabd6948537faf9fff8dc4006200607a9a76e5d9656a7154c75773902a1bdf399df3925130312d095e9c1f973d091c198c1a11a767761fe46169b2b5b8cdedb695cc425fe203d2f2655a76865c2cb4e2470fcfb1248c0add5431a7fbcb0ef4f66a09af93a09fab1daae4b518d7a5d9"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r13, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631477fbac14140ce0", 0x0, 0x9}, 0x28) close(r13) [ 893.141709] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 893.178016] device nr0 entered promiscuous mode 07:10:42 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xa}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:42 executing program 2: openat$nvram(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nvram\x00', 0x401, 0x0) 07:10:42 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:42 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700000000000000000000e1c0", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="740000002400070500"/20, @ANYRES32=r8, @ANYBLOB="00000000ffffffff000000000800010073667100480002000000000000000000000000000000000000000000000000000000000000471a00000000000000000000000000000000000000000000f3aff151ed1e4a08c07fa96752c88f8ca2454f9c9ed6974ba345296ca6ffafecb3ab42207c5c129c70d7ffb1202624af00"], 0x74}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="7c0000002c00010700"/20, @ANYRES32=r8, @ANYBLOB="00000002000000000300c4c1080001006270660050000200080006000000000004000500400002003c00010000000000eeff0075da891600000011000000000000000010000000000000000000000000000000000000e4ff00ddffffff00"/116], 0x7c}}, 0x0) r9 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vcsu\x00', 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x15, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @alu={0x7, 0x1, 0xa, 0xb, 0x6, 0xffffffffffffffc0, 0x965a3ed7bedd6018}]}, &(0x7f0000000200)='GPL\x00', 0xfffffff8, 0x78, &(0x7f0000000240)=""/120, 0x0, 0x2, [], r8, 0x8, r9, 0x8, &(0x7f0000000380)={0x4, 0x1}, 0x8, 0x10, &(0x7f00000003c0)={0x3, 0x8, 0x9, 0x5}, 0x10}, 0x78) r10 = open(&(0x7f0000000140)='./file0\x00', 0xccf82b8c3d03c5e2, 0xa2) ftruncate(r10, 0x200004) r11 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r11, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$BLKSECDISCARD(r11, 0x127d, &(0x7f00000000c0)=0x20) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r10, 0x0, 0x80001d00c0d0) r12 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r12, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:42 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) [ 893.452118] net_ratelimit: 9 callbacks suppressed [ 893.452124] protocol 88fb is buggy, dev hsr_slave_0 [ 893.462200] protocol 88fb is buggy, dev hsr_slave_1 07:10:42 executing program 2: semctl$SETVAL(0x0, 0x0, 0x10, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, &(0x7f0000000040)) r2 = fanotify_init(0x0, 0x0) r3 = epoll_create1(0x0) r4 = fcntl$dupfd(r3, 0x2, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) socketpair$unix(0x1, 0x0, 0x0, 0x0) r7 = dup(0xffffffffffffffff) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r8, 0xc0c0583b, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x0, [], [{0x5, 0x8, 0x101, 0x1ff, 0x3, 0x7f}, {0x8000, 0x80, 0x3, 0x3ff, 0x8, 0x3f}], [[]]}) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000080)={0xffffffffffffffff, 0x7fffffff, 0x20, r7}) fanotify_mark(r2, 0x51, 0x8000038, r4, 0x0) fanotify_mark(r2, 0x36, 0x8000000, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r9) [ 893.572695] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:42 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 893.697057] device nr0 entered promiscuous mode 07:10:42 executing program 1: perf_event_open(&(0x7f0000000100)={0x4, 0xfffffffffffffea7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x2a13c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}, 0xc210, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$P9_RUNLINKAT(r0, &(0x7f0000000080)={0x7, 0x4d, 0x1}, 0x7) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, 0x0) close(0xffffffffffffffff) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x1b, 0xfffffffffffffffd, &(0x7f00000000c0)) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x400000000000002, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000200)={0xa30000, 0x7, 0x7, r1, 0x0, &(0x7f00000001c0)={0x990aff, 0x3, [], @ptr=0x6}}) ioctl$sock_SIOCBRDELBR(r3, 0x89a1, &(0x7f0000000240)='bridge_slave_1\x00') ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x109) r4 = dup(r2) ioctl$KVM_ASSIGN_DEV_IRQ(r4, 0x4040ae70, &(0x7f0000000000)={0xffffffff, 0x1, 0x1, 0x504}) socket$netlink(0x10, 0x3, 0x13) write$uinput_user_dev(r4, &(0x7f0000000980)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x92, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r4, 0x5501) [ 893.752823] device nr0 entered promiscuous mode 07:10:42 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xc}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 893.774613] audit: type=1800 audit(1577171442.348:1157): pid=23124 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=16527 res=0 [ 893.813628] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 893.842709] protocol 88fb is buggy, dev hsr_slave_0 [ 893.848121] protocol 88fb is buggy, dev hsr_slave_1 07:10:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000000c0)=0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x7ff, 0x80) r5 = socket$vsock_dgram(0x28, 0x2, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r3, &(0x7f0000000140)={r4, r5, 0x8}) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x3b9}, 0x100) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xfdbe) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r5, 0x660c) 07:10:42 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 893.906704] input: syz0 as /devices/virtual/input/input15 07:10:42 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) [ 894.053664] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:42 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x13, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="850000000000000000009500"/24], &(0x7f0000281ffc)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x35, 0x10, &(0x7f0000000040), 0xfffffffffffffeb7}, 0x48) 07:10:42 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xe}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:42 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 894.163513] device nr0 entered promiscuous mode [ 894.204225] audit: type=1400 audit(1577171442.778:1158): avc: denied { prog_load } for pid=23165 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 894.242717] protocol 88fb is buggy, dev hsr_slave_0 [ 894.248336] protocol 88fb is buggy, dev hsr_slave_1 [ 894.389024] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 894.455468] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=30255 sclass=netlink_route_socket pig=23131 comm=syz-executor.3 07:10:43 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = fcntl$dupfd(r2, 0x0, r3) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000100)='/d`\x11a\xec*\xb6\xcc') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r5 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4010, r5, 0x0) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r6, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r6, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r7, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:43 executing program 1: openat$autofs(0xffffffffffffff9c, 0x0, 0x145000, 0x0) write(0xffffffffffffffff, &(0x7f0000000180), 0x0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000080)=0x1ff, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open(&(0x7f000001d000)={0x1, 0xffffffffffffff8c, 0x0, 0x0, 0x0, 0x4, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x8, 0x6037}, 0x0, 0x0, 0x4, 0x8, 0x4000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000009000/0x3000)=nil, 0x3000, 0x100000e, 0x400002172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x4000, 0x3, &(0x7f0000ff8000/0x4000)=nil) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000040), 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r1 = memfd_create(&(0x7f0000000100)='#\'%nodev\x00', 0x0) write(r1, &(0x7f0000002000)='/', 0x1) sendfile(r1, r1, 0x0, 0xfec) utimes(0x0, &(0x7f0000000380)) 07:10:43 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xc000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:43 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x10}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 894.997722] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:43 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:43 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xe000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:43 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000000140)='/dev/bsg\x00', 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) fchdir(r0) pipe2(&(0x7f0000000000), 0x4000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_G_EDID(r1, 0xc0285628, &(0x7f0000000180)={0x0, 0x9, 0x2, [], &(0x7f0000000080)=0xd7}) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x7fff) 07:10:43 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x60}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 895.196596] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:43 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 895.401046] device nr0 entered promiscuous mode 07:10:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3000003, 0x5c831, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, 0x0, &(0x7f0000000280)) ioctl$VIDIOC_S_TUNER(0xffffffffffffffff, 0x4054561e, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000600)={'syz\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1b\x00', {}, 0x0, [0x400], [0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8de, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x45c) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000b47000/0x18000)=nil, 0x0, 0xffffff88, 0x0, 0x0, 0x3cf) socket(0x2, 0x0, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000280)) ioctl$TCSETSF(0xffffffffffffffff, 0x5412, &(0x7f0000000240)={0x16, 0x3, 0x0, 0x4, 0xff}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r3, 0xc08c5336, &(0x7f0000000380)={0x9, 0x9, 0x0, 'queue1\x00', 0xffff8001}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffdfffffffff, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$video(&(0x7f0000000180)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f00000000c0)={0x0, @bt={0x320, 0x258, 0x1, 0x1, 0xd59f80, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7fff, 0x0, 0x10000000}}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.stat\x00', 0x2761, 0x0) r6 = perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup2(r8, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) close(r6) fcntl$setpipe(r4, 0x407, 0x200006) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x55aa40be, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000340)={0xfffffffe, 0x0, 0x0, 0x2}) 07:10:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:44 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x40, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) [ 895.522102] protocol 88fb is buggy, dev hsr_slave_0 [ 895.527270] protocol 88fb is buggy, dev hsr_slave_1 07:10:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3f000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:44 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)) socket$nl_netfilter(0x10, 0x3, 0xc) [ 895.606645] audit: type=1400 audit(1577171444.168:1159): avc: denied { map } for pid=23223 comm="syz-executor.1" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=89534 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:hugetlbfs_t:s0 tclass=file permissive=1 07:10:44 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xf0}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 895.746429] device nr0 entered promiscuous mode 07:10:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 895.807806] device nr0 entered promiscuous mode [ 895.922561] protocol 88fb is buggy, dev hsr_slave_0 [ 895.928355] protocol 88fb is buggy, dev hsr_slave_1 07:10:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x41010000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:44 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x2bf}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x48000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:45 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000004c0)) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000580)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6c815", 0x94, 0x9}], 0x0, 0x0) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000000140)={0x0, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) lsetxattr$trusted_overlay_origin(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0)='trusted.overlay.origin\x00', &(0x7f0000000240)='y\x00', 0x2, 0x1) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f0000000040)={{}, 0x57, 0xfffffffe, &(0x7f0000000280)="cf844eb715f614dbafe155390c48f7115fb1874493bd1d71597c53d64809aa7bac6a6ea84ee9270155f19aab48d7a035328d4099d58a7007c3f3a717e3d52aaee6c18c99de56ed7b000a1605b904c6dbfb638ff7fc69b9"}) syncfs(0xffffffffffffffff) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0xcec, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000001c00006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4801, 0x0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) fanotify_init(0x3, 0x80000) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) execveat(r0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000500)=[&(0x7f0000000340)='proc\x00', &(0x7f0000000380)='trusted.overlay.origin\x00', &(0x7f00000003c0)='keyringvmnet0&\x00', &(0x7f0000000400)=')wlan1[\xe4lo(\xd7\x00', &(0x7f0000000440)='trusted.overlay.origin\x00', &(0x7f0000000480)='cpuset/system\n\x00'], &(0x7f0000000640)=[&(0x7f0000000540)=':eth0cgroup\x00'], 0x1000) syz_mount_image$cifs(&(0x7f0000000800)='cifs\x00', &(0x7f0000000840)='./file0\x00', 0x8, 0x0, &(0x7f0000000880), 0x80, &(0x7f00000008c0)='proc\x00') r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f0000000740)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x840}, 0xc, &(0x7f0000000700)={&(0x7f0000000980)=ANY=[@ANYBLOB="00000000d33afd87050c81110bbd77d1c5395e598c6ec65b0af065ea7e083803871c285b455d97", @ANYRES16=0x0, @ANYBLOB="000e26bd7000fbdbdf250a0000007c000100100001006574683a7663616e300000003c0002000800040004000000080001000200000008000100200000000800020008000000080001000d000000080004000000000808000300090000001400010069623a76657468315f746f5f68737200100001007564703a73797a300000000008000300ff010000c4000100380004001400010002004e23ac1414bb0000000000000000200002000a004e2400000a703f3f012520be1785eeea624fc27631c5800000001400010069623a69703665727370616e30000000080003006bf300002c0004001400010002004e20e000000200000000000000001400020002004e21ac1414bb000000000000000008000300018000001800010069623a6272696467655f736c6176655f310000000800030000800000180001006574683a76657468315f746f5f7465616d000000"], 0x154}, 0x1, 0x0, 0x0, 0x10}, 0x10) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000680)) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000000780)) 07:10:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4c000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:45 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x300}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 896.575711] audit: type=1804 audit(1577171445.148:1160): pid=23266 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir154753035/syzkaller.NzicsO/452/bus" dev="sda1" ino=16654 res=1 07:10:45 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)) socket$nl_netfilter(0x10, 0x3, 0xc) [ 896.686233] CIFS VFS: Malformed UNC in devname. [ 896.731586] audit: type=1804 audit(1577171445.178:1161): pid=23245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir154753035/syzkaller.NzicsO/452/bus" dev="sda1" ino=16654 res=1 [ 896.936167] CIFS VFS: Malformed UNC in devname. [ 897.340668] device nr0 entered promiscuous mode 07:10:46 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$PIO_SCRNMAP(r5, 0x4b41, &(0x7f00000000c0)="35470459004c4f1c254a357aaadf91c84096a2fb7e83d3c8f384e430942879d6e4f4ed6fb80ccb6c438fd8caa77b67173462d2e03ec9756be1d31b355d150d51110969631eddedbb5ce9cfacf387eb2e519b0d259062e1c20853e4fb") ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:46 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x2f, 0x0, @local={0xac, 0x13}, @multicast1}, @tipc=@payload_direct={{{{0x20, 0x0, 0x0, 0x0, 0x0, 0x8}}}}}}}}, &(0x7f0000000100)={0x0, 0x2, [0x2, 0x2db]}) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvram\x00', 0x10000, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_ro(r1, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) getsockname$unix(r0, &(0x7f00000001c0), &(0x7f0000000240)=0x6e) 07:10:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x500}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 897.491043] validate_nla: 6 callbacks suppressed [ 897.491054] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:46 executing program 4 (fault-call:22 fault-nth:0): ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:46 executing program 1: mlock(&(0x7f0000ffc000/0x3000)=nil, 0x3000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc2d}}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') preadv(r0, &(0x7f0000000100), 0x29f, 0x2) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x5, 0x0, &(0x7f0000000340)) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000), 0x4) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x2) ioctl$TIOCSETD(r1, 0x5412, 0x0) 07:10:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x65580000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 897.613282] device nr0 entered promiscuous mode [ 897.673197] device nr0 entered promiscuous mode 07:10:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x600}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 897.747388] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 897.769942] FAULT_INJECTION: forcing a failure. [ 897.769942] name failslab, interval 1, probability 0, space 0, times 0 07:10:46 executing program 1: mkdir(&(0x7f0000000040)='./bus\x00', 0x10081be4d37a9e4b) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) socket$caif_stream(0x25, 0x1, 0x1) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r0, 0x80082102, &(0x7f0000000140)) removexattr(&(0x7f0000000380)='./bus\x00', &(0x7f00000003c0)=@known='system.posix_acl_access\x00') [ 897.859929] CPU: 0 PID: 23311 Comm: syz-executor.4 Not tainted 4.19.91-syzkaller #0 [ 897.859942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 897.877142] Call Trace: [ 897.879745] dump_stack+0x197/0x210 [ 897.879767] should_fail.cold+0xa/0x1b [ 897.879785] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 897.892390] ? lock_downgrade+0x880/0x880 [ 897.896570] __should_failslab+0x121/0x190 [ 897.900827] should_failslab+0x9/0x14 [ 897.904649] kmem_cache_alloc_trace+0x2cc/0x760 [ 897.909340] ? find_held_lock+0x35/0x130 [ 897.913428] alloc_pipe_info+0xbc/0x430 [ 897.917429] splice_direct_to_actor+0x76c/0x970 [ 897.922113] ? __inode_security_revalidate+0xda/0x120 [ 897.927321] ? generic_pipe_buf_nosteal+0x10/0x10 [ 897.932183] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 897.937222] ? selinux_file_permission+0x92/0x550 [ 897.942088] ? do_splice_to+0x180/0x180 [ 897.946085] ? security_file_permission+0x89/0x230 [ 897.951036] ? rw_verify_area+0x118/0x360 [ 897.955208] do_splice_direct+0x1da/0x2a0 [ 897.959377] ? splice_direct_to_actor+0x970/0x970 [ 897.964232] ? retint_kernel+0x2d/0x2d [ 897.964569] overlayfs: failed to resolve './file1': -2 [ 897.968143] do_sendfile+0x597/0xce0 [ 897.968171] ? do_compat_pwritev64+0x1c0/0x1c0 [ 897.968190] ? fput+0x128/0x1a0 [ 897.985051] __x64_sys_sendfile64+0x1dd/0x220 [ 897.989560] ? __ia32_sys_sendfile+0x230/0x230 [ 897.994155] ? do_syscall_64+0x26/0x620 [ 897.998153] ? lockdep_hardirqs_on+0x415/0x5d0 [ 898.002750] ? trace_hardirqs_on+0x67/0x220 [ 898.007087] do_syscall_64+0xfd/0x620 [ 898.007111] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 898.007122] RIP: 0033:0x45a919 [ 898.007135] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 898.007146] RSP: 002b:00007fa119a78c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 898.007159] RAX: ffffffffffffffda RBX: 00007fa119a78c90 RCX: 000000000045a919 [ 898.007166] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000005 [ 898.060671] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 898.067956] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007fa119a796d4 [ 898.075239] R13: 00000000004c925e R14: 00000000004e0f88 R15: 000000000000000a [ 898.084961] overlayfs: failed to resolve './file1': -2 07:10:46 executing program 1: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) mmap(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x200000e, 0x1010, r1, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mlock2(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x0) mremap(&(0x7f0000a94000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000a90000/0x4000)=nil) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r2, &(0x7f0000b1d000)=[{0x0}], 0x1, 0x0) 07:10:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x68000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 898.248781] audit: type=1400 audit(1577171446.818:1162): avc: denied { map } for pid=23334 comm="syz-executor.1" path="/selinux/load" dev="selinuxfs" ino=3 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file permissive=1 07:10:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x700}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 898.297004] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 898.789591] device nr0 entered promiscuous mode 07:10:47 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_DBG_S_REGISTER(r0, 0x4038564f, &(0x7f00000000c0)={{0x4}, 0x8, 0x400, 0x6}) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:10:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6c000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:47 executing program 1: r0 = socket(0xa, 0x80001, 0x0) unshare(0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f0000000340)='./file0\x00', 0x0, 0x2001251, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/raw6\x00') perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$TCGETA(r1, 0x5405, &(0x7f0000000240)) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x8}, 0x10}, 0x78) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000200)=0x1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x2}, 0x0, 0xffffffefffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') r2 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000b34ff8)={0x0, 0x0}, &(0x7f0000b34ffc)=0xc) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$TCFLSH(r4, 0x540b, 0x0) setuid(r3) r5 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl(r5, 0x800010000000937a, 0x0) 07:10:47 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x900}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:47 executing program 4 (fault-call:22 fault-nth:1): ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 899.316801] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x74000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 899.386601] FAULT_INJECTION: forcing a failure. [ 899.386601] name failslab, interval 1, probability 0, space 0, times 0 [ 899.417088] CPU: 1 PID: 23353 Comm: syz-executor.4 Not tainted 4.19.91-syzkaller #0 [ 899.424933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 899.434303] Call Trace: [ 899.436914] dump_stack+0x197/0x210 [ 899.440563] should_fail.cold+0xa/0x1b [ 899.444467] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 899.449589] ? lock_downgrade+0x880/0x880 [ 899.453769] __should_failslab+0x121/0x190 [ 899.458033] should_failslab+0x9/0x14 [ 899.461846] __kmalloc+0x2e2/0x750 [ 899.465395] ? kmem_cache_alloc_trace+0x348/0x760 [ 899.470252] ? retint_kernel+0x2d/0x2d [ 899.474164] ? alloc_pipe_info+0x19c/0x430 [ 899.478414] alloc_pipe_info+0x19c/0x430 [ 899.482490] splice_direct_to_actor+0x76c/0x970 [ 899.487176] ? __inode_security_revalidate+0xda/0x120 [ 899.492380] ? generic_pipe_buf_nosteal+0x10/0x10 [ 899.497238] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 899.502281] ? selinux_file_permission+0x92/0x550 [ 899.507147] ? do_splice_to+0x180/0x180 [ 899.511137] ? security_file_permission+0x89/0x230 [ 899.516082] ? rw_verify_area+0x118/0x360 [ 899.520251] do_splice_direct+0x1da/0x2a0 [ 899.524421] ? splice_direct_to_actor+0x970/0x970 [ 899.529298] ? security_file_permission+0x89/0x230 [ 899.534241] ? rw_verify_area+0x118/0x360 [ 899.538406] do_sendfile+0x597/0xce0 [ 899.542149] ? do_compat_pwritev64+0x1c0/0x1c0 [ 899.546750] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 899.551548] __x64_sys_sendfile64+0x1dd/0x220 [ 899.556061] ? __ia32_sys_sendfile+0x230/0x230 [ 899.560663] ? do_syscall_64+0x26/0x620 [ 899.564650] ? lockdep_hardirqs_on+0x415/0x5d0 [ 899.569247] ? trace_hardirqs_on+0x67/0x220 [ 899.573690] do_syscall_64+0xfd/0x620 [ 899.577515] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 899.582722] RIP: 0033:0x45a919 [ 899.585930] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 899.604844] RSP: 002b:00007fa119a78c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 899.612563] RAX: ffffffffffffffda RBX: 00007fa119a78c90 RCX: 000000000045a919 [ 899.619846] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000005 [ 899.627122] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 07:10:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7a000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 899.634406] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007fa119a796d4 [ 899.641724] R13: 00000000004c925e R14: 00000000004e0f88 R15: 000000000000000a [ 899.692103] net_ratelimit: 6 callbacks suppressed [ 899.692112] protocol 88fb is buggy, dev hsr_slave_0 [ 899.702134] protocol 88fb is buggy, dev hsr_slave_1 [ 900.162137] protocol 88fb is buggy, dev hsr_slave_0 [ 900.167320] protocol 88fb is buggy, dev hsr_slave_1 [ 900.192536] audit: type=1800 audit(1577171448.758:1163): pid=23374 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="sda1" ino=16625 res=0 [ 900.469483] device nr0 entered promiscuous mode [ 900.482128] protocol 88fb is buggy, dev hsr_slave_0 [ 900.487239] protocol 88fb is buggy, dev hsr_slave_1 [ 900.520744] device nr0 entered promiscuous mode [ 900.535878] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:49 executing program 1: sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000780)='/dev/net/tun\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x181002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'nr0\x01\x00', 0x1132}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{}, {}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0xb1}, {0x6}]}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000100)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000280)={'veth1_to_team\x00', 0x100}) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x1001004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x22, &(0x7f0000000280)=ANY=[]) 07:10:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xa00}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x81000000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:49 executing program 4 (fault-call:22 fault-nth:2): ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 901.073732] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffff}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 901.269401] FAULT_INJECTION: forcing a failure. [ 901.269401] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 901.292246] CPU: 0 PID: 23396 Comm: syz-executor.4 Not tainted 4.19.91-syzkaller #0 [ 901.300087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 901.309479] Call Trace: [ 901.312092] dump_stack+0x197/0x210 [ 901.315749] should_fail.cold+0xa/0x1b [ 901.319673] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 901.324803] ? __might_sleep+0x95/0x190 [ 901.328913] __alloc_pages_nodemask+0x1ee/0x750 [ 901.333609] ? __alloc_pages_slowpath+0x2870/0x2870 [ 901.338645] ? find_held_lock+0x35/0x130 [ 901.342724] ? __do_page_cache_readahead+0x3f1/0x720 [ 901.347846] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 901.353408] alloc_pages_current+0x107/0x210 [ 901.357845] __page_cache_alloc+0x2bd/0x450 [ 901.362183] ? kasan_check_read+0x11/0x20 [ 901.366451] __do_page_cache_readahead+0x1ce/0x720 [ 901.371413] ? read_pages+0x610/0x610 [ 901.375226] ? page_cache_sync_readahead+0x1d3/0x520 [ 901.380353] ondemand_readahead+0x543/0xcd0 [ 901.384696] page_cache_sync_readahead+0x281/0x520 [ 901.389648] generic_file_read_iter+0x16b6/0x2b90 [ 901.394514] ? save_stack+0xa9/0xd0 [ 901.398160] ? kasan_kmalloc+0xce/0xf0 [ 901.402058] ? __kmalloc+0x15d/0x750 [ 901.405793] ? do_sendfile+0x597/0xce0 [ 901.409712] ? filemap_range_has_page+0x380/0x380 [ 901.414571] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 901.419346] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 901.424120] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 901.428891] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 901.433666] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 901.438438] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 901.443214] ? lockdep_hardirqs_on+0x415/0x5d0 [ 901.447806] ? retint_kernel+0x2d/0x2d [ 901.451703] ? trace_hardirqs_on_caller+0x6a/0x220 [ 901.456653] ext4_file_read_iter+0x180/0x3c0 [ 901.461080] generic_file_splice_read+0x42c/0x750 [ 901.465938] ? add_to_pipe+0x350/0x350 [ 901.469848] ? security_file_permission+0xf9/0x230 [ 901.474910] ? security_file_permission+0x89/0x230 [ 901.479861] ? rw_verify_area+0x118/0x360 [ 901.484019] ? add_to_pipe+0x350/0x350 [ 901.487921] do_splice_to+0x127/0x180 [ 901.491739] splice_direct_to_actor+0x2d3/0x970 [ 901.496420] ? generic_pipe_buf_nosteal+0x10/0x10 [ 901.501281] ? do_splice_to+0x180/0x180 [ 901.505268] ? security_file_permission+0x89/0x230 [ 901.510209] ? rw_verify_area+0x118/0x360 [ 901.514370] do_splice_direct+0x1da/0x2a0 [ 901.518536] ? splice_direct_to_actor+0x970/0x970 [ 901.523403] ? security_file_permission+0x89/0x230 [ 901.528345] ? rw_verify_area+0x118/0x360 [ 901.532528] do_sendfile+0x597/0xce0 [ 901.536266] ? do_compat_pwritev64+0x1c0/0x1c0 [ 901.540864] ? fput+0x128/0x1a0 [ 901.544167] __x64_sys_sendfile64+0x1dd/0x220 [ 901.548687] ? __ia32_sys_sendfile+0x230/0x230 [ 901.553284] ? do_syscall_64+0x26/0x620 [ 901.557282] ? lockdep_hardirqs_on+0x415/0x5d0 [ 901.561915] ? trace_hardirqs_on+0x67/0x220 [ 901.566254] do_syscall_64+0xfd/0x620 [ 901.570072] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 901.575267] RIP: 0033:0x45a919 [ 901.578468] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 901.597385] RSP: 002b:00007fa119a36c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 901.605107] RAX: ffffffffffffffda RBX: 00007fa119a36c90 RCX: 000000000045a919 [ 901.612382] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000005 [ 901.622001] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 901.629284] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007fa119a376d4 [ 901.636567] R13: 00000000004c925e R14: 00000000004e0f88 R15: 000000000000000a [ 901.738230] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 901.757834] device lo entered promiscuous mode [ 901.772087] protocol 88fb is buggy, dev hsr_slave_0 [ 901.777207] protocol 88fb is buggy, dev hsr_slave_1 [ 901.778879] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 901.790885] device tunl0 entered promiscuous mode [ 901.799495] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 901.808402] device gre0 entered promiscuous mode [ 901.818297] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 901.827151] device gretap0 entered promiscuous mode [ 901.836008] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 901.845068] device erspan0 entered promiscuous mode [ 901.850856] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 901.864715] device ip_vti0 entered promiscuous mode [ 901.870473] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 901.880549] device ip6_vti0 entered promiscuous mode [ 901.888763] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 901.898569] device sit0 entered promiscuous mode [ 901.909166] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 901.927243] device ip6tnl0 entered promiscuous mode [ 901.932979] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 901.939657] device ip6gre0 entered promiscuous mode [ 901.972721] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 901.979446] device syz_tun entered promiscuous mode [ 901.999883] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 902.008445] device ip6gretap0 entered promiscuous mode [ 902.016935] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 902.025682] device bridge0 entered promiscuous mode [ 902.031327] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 902.041447] device vcan0 entered promiscuous mode [ 902.048680] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 902.057922] device bond0 entered promiscuous mode [ 902.064636] device bond_slave_0 entered promiscuous mode [ 902.070240] device bond_slave_1 entered promiscuous mode [ 902.079521] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 902.087534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 902.097327] device team0 entered promiscuous mode [ 902.104204] device team_slave_0 entered promiscuous mode [ 902.109805] device team_slave_1 entered promiscuous mode [ 902.118867] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 902.126825] 8021q: adding VLAN 0 to HW filter on device team0 [ 902.136306] device dummy0 entered promiscuous mode [ 902.141878] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 902.150305] device nlmon0 entered promiscuous mode [ 902.158503] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 902.167097] device caif0 entered promiscuous mode 07:10:50 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xc00}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:50 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="66b9810000400f322ed30cbad104ec660f38df2b0fe21526660ff85e503ede1b0f20c06635000000800f22c0b800088ec00fae470b", 0x30f}], 0x1, 0x51, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) msgget(0x2, 0x0) msgrcv(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e00"/4096], 0x1, 0x1, 0x800) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0xa008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f00000016c0)={0x0, 0xae2a5ebaf61d7132}) ioctl$DRM_IOCTL_GEM_OPEN(r4, 0xc010640b, &(0x7f0000001700)={0x0, r5, 0x4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) recvmsg$can_raw(r3, &(0x7f0000000200)={&(0x7f0000000000)=@ethernet={0x0, @random}, 0x80, &(0x7f0000001580)=[{&(0x7f0000000100)=""/38, 0x26}, {&(0x7f0000000140)=""/169, 0xa9}, {&(0x7f0000001280)=""/181, 0xb5}, {&(0x7f0000001340)=""/104, 0x68}, {&(0x7f00000013c0)=""/205, 0xcd}, {&(0x7f00000014c0)=""/149, 0x95}], 0x6, &(0x7f0000001600)=""/88, 0x58}, 0x40002002) mbind(&(0x7f0000fe9000/0x3000)=nil, 0x3000, 0x4000, &(0x7f0000001680)=0x8, 0xfffffffffffffff8, 0x4) 07:10:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9effffff}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 902.171950] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 902.190781] device nr0 entered promiscuous mode 07:10:50 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0xffffffffffffff4a) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = open(&(0x7f0000000300)='.\x00', 0x81, 0x0) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x40, 0x0) fcntl$dupfd(r6, 0x406, r5) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 902.242098] protocol 88fb is buggy, dev hsr_slave_0 07:10:50 executing program 1: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x4, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000785000), 0x34a) close(r0) sendmmsg$alg(r1, &(0x7f0000236fc8)=[{0x8004000, 0x0, &(0x7f00000fff80), 0xc, &(0x7f00001e1e78)}], 0x4924924924926c8, 0x0) r2 = socket(0x10, 0x2, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000002c0)={{0xa, 0x4e22, 0x1f, @dev={0xfe, 0x80, [], 0x25}, 0x7f}, {0xa, 0x4e21, 0x8, @empty, 0x7fffffff}, 0x400, [0x4, 0x1000, 0x0, 0x7fffffff, 0x6, 0x9, 0x2, 0x200]}, 0x5c) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb), 0x0) pipe(&(0x7f0000000680)) r4 = socket$l2tp(0x18, 0x1, 0x1) ioctl$PPPIOCGFLAGS(r4, 0x40047452, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f0000000040)={'bcsf0\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x29}}}) getpid() r5 = getpgrp(0xffffffffffffffff) capget(&(0x7f0000000000)={0x0, r5}, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$system_posix_acl(r6, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000a00)=ANY=[@ANYBLOB="02020001", @ANYRES32, @ANYRES32, @ANYBLOB="b8e365400357609aeb2c35eb6346b93ee6a8ccac064b28045fb5ccc42eb61c604bd9bc6f06af127321df7559522954af9fbdf181f025e9a65d7a17310597d62a318833df89a57e5b53778aa3e66844fc416fc7e2cee11b08996b374e80f611201000be976c77795ccead35bdcf1b23c88334501831ff741891ff83bd8103282caf9b66fa23cc7ad8ce987b956942c2650306", @ANYBLOB='B', @ANYRES32=0x0, @ANYRESHEX, @ANYRESDEC=r7], 0x8, 0x2) syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x30000000000000, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000140)="67da1f1600be5e1e89443fca6c93737f7f652141e9cbab885cdf4ee4709de86a5de321ab10", 0x25}, {&(0x7f0000000180)="2ab665d6f569e4eb", 0x8}, {&(0x7f00000001c0)="c427be4137610a83ce1dbc716833e8a046316b99fa229b7e9da369e89dc3247e082a9102ef", 0x25}], 0x3, 0x0, 0x0, 0x8040001}, 0x14044010) r8 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_pts(r8, 0x4000000000000002) dup2(r8, r6) gettid() 07:10:50 executing program 4 (fault-call:22 fault-nth:3): ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 902.342485] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:51 executing program 1: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2a939, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000001600)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) stat(&(0x7f00000018c0)='./file0\x00', &(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) fcntl$setlease(r3, 0x400, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000001980)={{{@in=@dev, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@initdev}}, &(0x7f0000001a80)=0xe8) syz_mount_image$msdos(&(0x7f0000001680)='msdos\x00', &(0x7f00000016c0)='./file0\x00', 0x54a, 0x2, &(0x7f0000001880)=[{0x0, 0x0, 0x7fff}, {0x0, 0x0, 0x9}], 0x20, &(0x7f0000001c00)=ANY=[@ANYBLOB="7379735f69757461626ce52c756dfe7547be5a9b5569303030303000"/40, @ANYRESHEX=r2, @ANYRESDEC=r4, @ANYBLOB]) preadv(0xffffffffffffffff, &(0x7f0000001640)=[{&(0x7f0000000180)=""/42, 0x2a}, {&(0x7f0000001400)=""/33, 0x21}, {&(0x7f00000014c0)=""/233, 0xe9}, {0x0}], 0x4, 0x4) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000003c0)={&(0x7f0000001480)=""/16, 0x20000, 0x1000}, 0x18) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000080), 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000002c0)=0x14) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/vga_arbiter\x00', 0x420000, 0x0) ioctl$BLKDISCARD(0xffffffffffffffff, 0x1277, &(0x7f0000000000)=0xa2ea) open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r5 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000240)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000300), 0x12) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)) [ 902.495199] device nr0 entered promiscuous mode 07:10:51 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xc3ffffff}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:10:51 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xe00}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 902.612537] FAULT_INJECTION: forcing a failure. [ 902.612537] name fail_page_alloc, interval 1, probability 0, space 0, times 0 07:10:51 executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x8) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r5 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x40, 0x0, 0x0, 0xffffffff}, {0x80000006}]}, 0x10) connect$inet(r4, &(0x7f0000000080)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r6 = shmget(0x2, 0x1000, 0xa08, &(0x7f0000ffe000/0x1000)=nil) r7 = getpgid(0x0) shmctl$IPC_SET(r6, 0x1, &(0x7f0000000840)={{}, 0xb8fb, 0x0, 0x0, 0x8000, 0x0, r7, 0x7d}) shmctl$IPC_STAT(r6, 0x2, &(0x7f0000000180)=""/141) ioctl$BINDER_SET_MAX_THREADS(r3, 0x40046205, &(0x7f0000000080)=0x7) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0x800, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010a0200027400f801", 0x17}], 0x0, &(0x7f0000000040)={[{@fat=@errors_continue='errors=continue'}]}) [ 902.662086] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 902.736236] CPU: 1 PID: 23423 Comm: syz-executor.4 Not tainted 4.19.91-syzkaller #0 [ 902.744103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 902.753468] Call Trace: [ 902.756073] dump_stack+0x197/0x210 [ 902.759720] should_fail.cold+0xa/0x1b [ 902.763631] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 902.768760] ? __might_sleep+0x95/0x190 [ 902.772766] __alloc_pages_nodemask+0x1ee/0x750 [ 902.777490] ? __alloc_pages_slowpath+0x2870/0x2870 [ 902.782520] ? find_held_lock+0x35/0x130 [ 902.786607] ? __do_page_cache_readahead+0x3f1/0x720 [ 902.791722] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 902.797276] alloc_pages_current+0x107/0x210 [ 902.801714] __page_cache_alloc+0x2bd/0x450 [ 902.806067] ? kasan_check_read+0x11/0x20 [ 902.810233] __do_page_cache_readahead+0x1ce/0x720 [ 902.815181] ? read_pages+0x610/0x610 [ 902.818989] ? page_cache_sync_readahead+0x1d3/0x520 [ 902.824113] ondemand_readahead+0x543/0xcd0 [ 902.828471] page_cache_sync_readahead+0x281/0x520 [ 902.833410] generic_file_read_iter+0x16b6/0x2b90 [ 902.833435] ? save_stack+0xa9/0xd0 [ 902.833455] ? kasan_kmalloc+0xce/0xf0 [ 902.833471] ? __kmalloc+0x15d/0x750 [ 902.841942] ? do_sendfile+0x597/0xce0 [ 902.841965] ? filemap_range_has_page+0x380/0x380 [ 902.841986] ? rcu_read_unlock+0x16/0x60 [ 902.862381] ? percpu_ref_put_many+0x94/0x190 [ 902.866910] ext4_file_read_iter+0x180/0x3c0 [ 902.871338] generic_file_splice_read+0x42c/0x750 [ 902.876201] ? add_to_pipe+0x350/0x350 [ 902.880111] ? __inode_security_revalidate+0xda/0x120 [ 902.885331] ? security_file_permission+0x89/0x230 [ 902.890279] ? rw_verify_area+0x118/0x360 [ 902.894513] ? add_to_pipe+0x350/0x350 [ 902.898420] do_splice_to+0x127/0x180 [ 902.902243] splice_direct_to_actor+0x2d3/0x970 [ 902.906932] ? generic_pipe_buf_nosteal+0x10/0x10 [ 902.911794] ? do_splice_to+0x180/0x180 [ 902.915784] ? security_file_permission+0x89/0x230 [ 902.920731] ? rw_verify_area+0x118/0x360 [ 902.924891] do_splice_direct+0x1da/0x2a0 [ 902.929058] ? splice_direct_to_actor+0x970/0x970 [ 902.933920] ? security_file_permission+0x89/0x230 [ 902.938866] ? rw_verify_area+0x118/0x360 [ 902.943034] do_sendfile+0x597/0xce0 [ 902.946774] ? do_compat_pwritev64+0x1c0/0x1c0 [ 902.951373] ? fput+0x128/0x1a0 [ 902.954670] __x64_sys_sendfile64+0x1dd/0x220 [ 902.959176] ? __ia32_sys_sendfile+0x230/0x230 [ 902.963768] ? do_syscall_64+0x26/0x620 [ 902.967759] ? lockdep_hardirqs_on+0x415/0x5d0 [ 902.972349] ? trace_hardirqs_on+0x67/0x220 [ 902.976705] do_syscall_64+0xfd/0x620 [ 902.980525] entry_SYSCALL_64_after_hwframe+0x49/0xbe 07:10:51 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4000}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:10:51 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5865}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 902.985748] RIP: 0033:0x45a919 [ 902.988949] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 903.007851] RSP: 002b:00007fa119a57c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 903.007867] RAX: ffffffffffffffda RBX: 00007fa119a57c90 RCX: 000000000045a919 [ 903.007881] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000005 [ 903.007890] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 903.007904] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007fa119a586d4 [ 903.037393] R13: 00000000004c925e R14: 00000000004e0f88 R15: 000000000000000a 07:10:51 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffffff}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 903.223931] FAT-fs (loop2): Directory bread(block 2563) failed 07:10:51 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'team0\x00', 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000580)={{{@in=@multicast2, @in=@rand_addr=0x10001, 0x4e23, 0x1, 0x4e22, 0x0, 0xa, 0x20, 0x20, 0x88, r3, 0xee01}, {0x1, 0x1000, 0x3, 0x1ff, 0x0, 0xfffffffffffffff8, 0x9, 0x1}, {0x7, 0x7, 0x1f, 0x80000000}, 0x7, 0x6e6bbc, 0x1, 0x1, 0x0, 0x2}, {{@in6=@rand_addr="0d38ed404a506b2a5f4454dc14f2432f", 0x4d4, 0x6c}, 0xa, @in=@empty, 0x3502, 0x0, 0x0, 0x3, 0x1, 0x100, 0x4}}, 0xe8) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000140)='./file0\x00', 0x140, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept$alg(r7, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x8000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 903.292161] FAT-fs (loop2): Directory bread(block 2564) failed [ 903.300592] FAT-fs (loop2): Directory bread(block 2565) failed [ 903.314325] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:51 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6000}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 903.344075] FAT-fs (loop2): Directory bread(block 2566) failed [ 903.372190] FAT-fs (loop2): Directory bread(block 2567) failed 07:10:52 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfeffffff}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 903.411442] FAT-fs (loop2): Directory bread(block 2568) failed [ 903.426645] device nr0 entered promiscuous mode [ 903.466505] FAT-fs (loop2): Directory bread(block 2569) failed [ 903.516693] FAT-fs (loop2): Directory bread(block 2570) failed [ 903.586378] FAT-fs (loop2): Directory bread(block 2571) failed 07:10:52 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 903.639466] FAT-fs (loop2): Directory bread(block 2572) failed [ 903.646211] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:10:52 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6558}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 903.979198] device nr0 entered promiscuous mode [ 904.807886] device nr0 entered promiscuous mode [ 906.441591] audit: type=1400 audit(1577171455.008:1164): avc: denied { map } for pid=23478 comm="syz-executor.1" path="/sys/kernel/debug/kcov" dev="debugfs" ino=5881 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 906.604359] IPVS: ftp: loaded support on port[0] = 21 [ 906.774771] chnl_net:caif_netlink_parms(): no params data found [ 906.910172] bridge0: port 1(bridge_slave_0) entered blocking state [ 906.916785] bridge0: port 1(bridge_slave_0) entered disabled state [ 906.923996] device bridge_slave_0 entered promiscuous mode [ 906.930802] bridge0: port 2(bridge_slave_1) entered blocking state [ 906.937304] bridge0: port 2(bridge_slave_1) entered disabled state [ 906.944751] device bridge_slave_1 entered promiscuous mode [ 907.068903] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 907.079371] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 907.205087] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 907.213864] team0: Port device team_slave_0 added [ 907.219433] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 907.226756] team0: Port device team_slave_1 added [ 907.232267] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 907.239724] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 907.404376] device hsr_slave_0 entered promiscuous mode [ 907.442526] device hsr_slave_1 entered promiscuous mode [ 907.591740] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 907.599266] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 907.613337] bridge0: port 2(bridge_slave_1) entered blocking state [ 907.619689] bridge0: port 2(bridge_slave_1) entered forwarding state [ 907.626309] bridge0: port 1(bridge_slave_0) entered blocking state [ 907.632713] bridge0: port 1(bridge_slave_0) entered forwarding state [ 907.707786] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 907.714050] 8021q: adding VLAN 0 to HW filter on device bond0 [ 907.722551] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 907.731074] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 907.738569] bridge0: port 1(bridge_slave_0) entered disabled state [ 907.756901] bridge0: port 2(bridge_slave_1) entered disabled state [ 907.764894] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 907.776007] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 907.782306] 8021q: adding VLAN 0 to HW filter on device team0 [ 907.826379] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 907.838063] bridge0: port 1(bridge_slave_0) entered blocking state [ 907.844452] bridge0: port 1(bridge_slave_0) entered forwarding state [ 907.862659] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 907.870236] bridge0: port 2(bridge_slave_1) entered blocking state [ 907.876616] bridge0: port 2(bridge_slave_1) entered forwarding state [ 907.884816] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 907.915660] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 907.924945] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 907.932104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 907.940730] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 907.950616] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 907.958177] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 907.966157] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 907.976279] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 907.985759] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 907.993442] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 908.034485] device bridge_slave_1 left promiscuous mode [ 908.039970] bridge0: port 2(bridge_slave_1) entered disabled state [ 908.093789] device bridge_slave_0 left promiscuous mode [ 908.099249] bridge0: port 1(bridge_slave_0) entered disabled state [ 911.264732] device hsr_slave_1 left promiscuous mode [ 911.307517] device hsr_slave_0 left promiscuous mode [ 911.366725] team0 (unregistering): Port device team_slave_1 removed [ 911.378370] team0 (unregistering): Port device team_slave_0 removed [ 911.389720] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 911.435673] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 911.517803] bond0 (unregistering): Released all slaves [ 911.565747] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 911.571803] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 911.592523] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 911.599803] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 911.606580] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 911.614013] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 911.625020] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 911.724163] cgroup: cgroup2: unknown option "sys_iutablå" 07:11:00 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8100}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:11:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffa888}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:11:00 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) listxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=""/47, 0x2f) inotify_add_watch(r3, &(0x7f0000000040)='./file0\x00', 0x6000010) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000000)=@req={0xffff}, 0x10) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000400)=0x1000) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup3(r5, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$KVM_GET_IRQCHIP(0xffffffffffffffff, 0xc208ae62, 0x0) r7 = syz_open_dev$binderN(&(0x7f0000007100)='/dev/binder#\x00', 0x0, 0x2) fsetxattr$trusted_overlay_opaque(r7, &(0x7f0000007140)='trusted.overlay.opaque\x00', &(0x7f0000007180)='y\x00', 0x2, 0x7d89fa745d191581) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) 07:11:00 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$RTC_EPOCH_SET(r5, 0x4008700e, 0x2) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4213, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:11:00 executing program 1: kexec_load(0x7fff, 0x80000000000013f, &(0x7f0000001900)=[{&(0x7f00000007c0)="ba7021d44241b046144a47d67c3a54bf2d55ad4f6505ae47f0d43ab6bc1871e16b1ee8cdad6378d66fe87cd76f0bc2c12454d1a4045f92a944f5d3146b98a7157a0157f87eff49b366d57cffb5c9462f5c4c2b8375db00624bbc0286586cf6b6da56b4bc4306ac93da85f3fee95ce40b8e1911b72dd00e810b6dd8ddf5c71983f218fc556f095066302f4abde13017d519a8630da054f7bd3135709d85edb8fdd2f08d10dceaf032907002a9789172070e26e2eb08df69ab19b075ea120821bf4d07efd46e695ac8594d60087fb71a1ab82fca8e4d30a303206434e44dacca37e7f1ee499f5fe4e03ef25922e18b7af127057077333b4953c0cef2342a8db1edbda5ae7a2592cce1d854fdd1a0a108f8abfb89d35ada783b6381bf5b5f91c5947fbe1d323bef77b51d17702b7f5b2b8d31cb23178153d798cc7266463a3932670ae06ddfc3707b6111725d98367d2432164794c492f03e6d98ab65d83e3b478b45b3aed79add9b3a29e653ec90556842a9657b7054ad2a73bf540e97150180f7095565d5b4d778baf5caee96d5b228498afb2944f21bd6d933799e06c5833af5caac4d743d488d03e0763226bf7cd035854d14bc57b760a13f27ee0cae34cf4db10f4cb95eff571bd909b5594d0d2c138650c63fba3af82e344b2a3f37db78cf616ead8b85978afa802316509006e0a9eb8c96bd7ab4b9e6128959fb829f9f68df34e8fcd12b931b11e3c042a4354678bbf53ede949886b5cb3c060ec751e9b11ad8b84539c0aabb44c33cce32f1d194f721aa3bf71cc9620b8e9da477ecf0bacaad6ead6b421edf1629ecd5d5a9a36825fc9a6251da63327ddc2aa35e782fdea3371cd605433652b7e081e21393fa74e0f30314dd48258c0e639c0f040136d460913228d3cd84995b3b2c7da3d8c3a54cdaf969344680bdb0c9df592e7cc7a24be2f4a8433ccf3dafb07854cf0cb39741f530c3503dabd9bfe3fc8a92b632ab8b3a0958c2034b3b263226d869923f5d67c2c67a8a6d816289b1e6aa2166911f2c83a636480aa1285d7f090c704fb09177c47c4ddf7d55bb2ff0c19b3e4903b29a799d72a86ae749561532d18df4a6ae8ec120f0dc3bd7adcb87ced24bc6f59380abc9ad48ef61e0032b4585c6e26ba1e1e4660575dcc4ca2078a88a7bfc28b985e56a499bdbfc075565b07f30f1de18bf3a25a2e9b496dead095e17628797610ed376bff51dbb3b867aaeca446671dad92d0b76b17d7e99d3773be173d9277933fe253e0455fe42a37e8f1b6b308f689f84a8b37cab65500bc28266b7d53fce85bababcdab0a8922f0d6115d752afdde9dfa6879882a968e81588b78f1697f94bf0cccaa1eb78d4c012d08de0fbf9db1007aa5e05ed760a9035ca3cd9ea8a48b2cc977b510328762d7747bb5d49b01b1b56c799521fe4d4a1fc85ce90ab447b3ec539b9966d803531621780170f7f8900af36f42a090b26714521e0055c4257bddb7a7fef3357b1b681e01be078d97ce446ea83e7411d962b2d6b7d603eb1cc108e70eb9dffd744ed36c939905ca614461ca3e4fe54c20f90ae60321ed05abd4da837f7cd7cd0a8c26d4c024ca8ff53564cb20b587cd386788c89751b2d188bb3927244365b38c25d10456dd3456d1e9add391c5bceb709d0412306085ceb59150e3214f69a8a7c7af89757105b3d64cb201d0c973de2266f59b0bf8d0631531505b6accaced461486af79c4a898b78ec4e05aa13c77887385c22d48e17cf596c432f7d2c8987d246bdb26d149d8fd723ac35cbc1d2c0d8400cd1763824ebfbfe0ffe0bd5215c93841a5155db434286706f8989f7414740192eedaa374aba0ac30907f8f775443259971d8b7345b9a91a845504ec7096e0639d2c0182719805ff8a7d338e88697b15353adbcc11d029918cdc4f68f2bb0735aed10783940e408ee38f4b4ee59e1824c380ed27c57ee97e6d981332a52a9b2f914098c8413c7ffe20fafbfbb95cd6b2bd124f5787cff9701997e821fa25593b059ac16afbfff3040527d4f858d50d6e81c053f8e674ab943ab01bc98c793886d80ffadea7bc4b3841df132a527969a01d24f426fee10b81217b67294968a7d8844b6b757203be76128d0aff12091b06c8788e041d7f6fde15f7ac2992da9294c8236a43546b1591dd69107b6a65efe5a122a8c9e802d4dba596978d7f8a44a80dd1e06b723d8d773d3a2a7570150753e9bbcda53025cb126d680ce56d80d56823d3f775fd8d6c75b1ffa70715e7c458aa59894a328db35bc723cf52725d0b789b03ca86118c0eeecb4672bde928ed694c2fe917021d0fefc4d7b9545a0c0f5e46a38649691d3cc4f9ed88478956e11c0fad2010a2be21c6e9a4e23c184f88041d3a738e0953df88e00535e8f83f138f053f2b1d1010450fa7e92629ba6866bccfb3de2353a3c253cc317e9899343ba5d2db5ca3defa1398ea4d378ffdd9f1f6299340223f8a949ef465b2c2620cc5b81ef21eb0e2909e9bb02ee9d8b71cda5c29ce80eaef77957d1029ed46b30e558b2c2033c580b93635aeea004d5e90d4499661afaffa3c18da9151616662e0d2aea0aa1c6af6eb29db7ce74df1edf74e6475be4ae4758a920e42eb94966c3fc6921a91e89405d4b119ab7dc17ac8ed27d0292092ad352e8bc35ad3f9f1af06e226c9f0de0ec997fc7d78543eb30429411c56f76733d10de119f6bccf2f998d65a77cd116cb031237c11afedaf8de69b97e48102f91a9a8bdab431c326ba69464bd3ef807845e32e56b64306e27a4ff75c2600cc2bf2c519e299ef2380cc8d38c293cbddba3a23c2130ebe06423c23564cce56ba49ee05ef93392e548f1ebd48bae0879ebc7f139fbae35dd87ade8bb48cb53e05c1ab0d594a3c3852741aec48b5c1d7dc7675f9a0bcf2d2cf37abfeb952e9b27ffdb82ccf17815c11453c6c731f26e8b87ae9106bd3956f87baace0ab956fa0b1f8e6db4623c6986e760fb09fd16dc04c26864e468a705ee142770ffd48fb685d43c001b668f82bbf92ce0b8d3c9f3d2e97aaf0a0a315af161787bf4aff0f8aa5b514b570e39b7a2caaec90b7c2bd8249c97599c1f4f8103a23caf6ef5897b734714597088e9c0c206efe0a2c264d8d15b621e5c0484cf136fa5c8b20c00c1097f18116c21b0b2d6ed574f9269c1f24a24c4dd3b40620058469218d831d3cdc20645c1de011b1d7427ed79a4527379067b465c0125e2d87421614073d8a8e97b07f41bd0c1dbb36ac67fecfc4a4d0a7efd6d2af5e43c8ce9afe1aa14805a0ffba11a0a21eed701acc48caffb916809f8caddd69565dbc54d50122cb8bd5b85aeadc73926a4b19f08bbdeb794c2d74919bc011f0c50126a525f9e7cd66627e55deeb2dff96278d1f334c836c68b01afea4a55f537511479830957bdb5016a2aa381e4b6c7e59b83bb57c3594ea24f9a1415523c75328b210594b7a51770f2e922091121ecab613b16990f7c7601101a63084de80a893366823dcedd0873eb856a7f9191aa205e58c9051eacabd8d6f09f1849b00dea9904f08af28091aebfb9597ef5d1bf54371fd087e0207e7fada5e38e0a57f89f1c19f76d065733239a84a99724ee1aac68ff0adfc8f5a53017a1f0006626003c260c22926a7f61beab5acd3d2abfc91f832ec5f677b4373ebd17eb9f43572c52dab765cf87c113c777d3ad96aa3ccfc9f8c00e3e3ce6b866c6d571759e0034d4da8f26b5a49aff6015b7a6336cd7b3af139892940d63073283a4adc54d4deac990a4c46ef4b3cbf42628aec5cc21e7af66d68dd6d01fefa76ff5b25112eb74013b94fe6626cd12a59d5ab9a282069fb19c12086690c1a32e4df6ac8a6df68994b04f503d0a0f5106b795eea009684e990cef5fae1d86b0d266bd6fe52f9b9bdc7a4fb94180135b9bd0814bf164a0be47a13ccf9e53fefdbc86e455f0d792f00ed63ac10d374e1507fa21ecf7e77be0e160de1fe74da81997fb6cdf0bb681f29e7c7c6eb0a87a02a5f121210811d348b0eefcf979e2fce823b1f67e911b65002b20db75580e4fe60a0b801e30602158476f4edf53492b1387417d4ff3f3ab61b1a16de26f7eafbf604f42dd65916fc110884555a6a2a0e54c6b94b5135e62bbef3cfd47733e21e462427f45c8cf6f3cc2ca3c69511df04533fd1ef28c9b6287c275b427a00388dc4a2d1ea2798b389026a04350dc1dba90eaeeb616bbc18e57b11cee71a7e26728ca13aae45f6a67580265a4841873d09a52b5a1e0449540ba631290f8b76cd2881afc093f549bf781375f36a77c9bcfb6aa36e5969e2edad34a69a7d187446b6eefa6a9ed6712c43d514aecd4d189ad5026215e2a3ae0f2051348e21beec4551b051c66ec719d61a151f745818d5c5452d99591396ab81fbde1b5de87ebfa73aba8dc0a747362daba374af06355788cce94afee0e298859c1746167bbe5aa7c4fae0bea1574e20d58cab1ac4daa6423e0d7023f43438c91abe81caad7bf25045f90a638d2dfd327813f1e01f3be28755fa2792d1f881ffcc1167a300bf01231b7bc07abb59dc96b2b7f8383f26387bbefa3209e944179c00d6bb5c6f9f5761c1ba6a194ea8392753e6b4aae827e0bea99ab6fc17032ac5430e8a72a1279cc3fc4c17a6467ac667cef213aa066c9d65b79f810af5b523f10f8bccb5d9ccd4aad745305f08719a4cd8b6f5c710d6148e799bbe552345b5d9b58eea19a2adfe0dab408bb10fe33a32f8c1203a8913874742782c38c4b1b0d383d1ca1b08702a0b7f0235ae1839d0b77675f1d847ddae9f730328c32fb4c0653e990720cfd9aa48e94c9b59ce6f6a5683b2253814e098ec4144a1bebf6ccf5d5acd546205df52467c8d2f824485516d4429ae51624babc0d27118724c9ed45d353a11b9459020d0f7f6b22985e7faa784431645a83551c26b8f939569ea8482a1dcdec66f27113461b3ee6fd0425b03bd095b00a6c9c955c69863a56a848e54e657a689122c0a0ef4cdc2bb4893fa2e817fb24107b2f691173c2e06df1030fed3f64d561406951b3a5a716b228e68ad03698001c3aba88da9762091cab49a8fb7fa85dce19f0c970b2ad66cab19ec2b69ebd9225b29eaf7b2d69aa9b5494745d929fa2fb5ffd0bfd8f248b03e0e7128e6f9c52482c22d157622608f17fb177dec1d006ee0bc14658e7d7dc7a9a0d1043a5337c46de8648f5b4b527e0d6c6e8aa7c83056f6f135fa9c931b0075c932d9726a31bc8adb94977415e64328f0074d3b6f7786c011f2d68b6041cfb982cc8ff0a9e917ee9d28fdca32f5930c1e6d96ceca699203f2ed16bd5c4e44fca81b5a1f4ce7939105794f41e1e7e294191b65c23ed4088ca92a0f5ec0fbe0c367b70678d847c5c4f4b350091c50a4a3da83c64ff912b30018e6121ce7a6d960aba6e3b6cc3e8c7c5c7244056c646aaf3a2a6983beb5ff911b1d7a38139f7f49f3ebfe666c957e04d24da621c216ed6fd5ef3f29e45e7a59f7fdd743da8ce1148bb10637ecc3f09c5355985f59fd4e75520f70a4a3bfaee1677d045aa6816900a247e034e1e42145054a8e013cd2910d5f8a9683246cda625be61fcfd6fc625147af575bd7f2c96a7e488872c8dbdfc2269cc6ab3c753a2ca4e713a9b9b3fe7d09a77dc33d37cf547eb165e9a423717479e7fb18f7caa8f198e6023a559cc3f26664f148e4027e829cef2e6b6f0b0da1bc05661763beed72e35bf5dc71742c67e5766f8f609036442869fc807733488fa7b4ec308a918d65e5d5ab5", 0xff6, 0xa679}, {&(0x7f00000017c0)="da38d90e407f3dc34bcfa4de772decf5cc95a70d4029bc909f3d858c2460cf5b7aa0ed14263f48", 0x27, 0x7, 0x5}, {&(0x7f0000001800)="50371d15c01458a850c8532e807216e9ff2c0c52fdcee0f02da34b5834a99e5267a8b484c2d9b21ffeacacec5b0419c55a8e7998dbaf97ae4726c46c8045d53a8f66a70b1bb988d788", 0x49, 0x0, 0x100009}, {&(0x7f00000018c0), 0x0, 0x3, 0x7}], 0x2a0000) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'hsr0\x00'}) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x80, 0x2, 0x0, 0x81, 0x0, 0x401, 0x145400, 0xf, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x46ac, 0x2, @perf_config_ext, 0x21212, 0x2, 0x5, 0x0, 0x7, 0x401, 0x6fe8}, 0x0, 0x3, 0xffffffffffffffff, 0x15) socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r1) clock_gettime(0x0, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) openat$apparmor_thread_exec(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2480, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'hsr0\x00L\x00H\x00\x00\x00\x00\x00\x00\xff\x00', 0x1}) 07:11:00 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r0, 0xc0096616, &(0x7f00000000c0)=ANY=[@ANYBLOB="070000000002000000000000000000"]) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) r6 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r7, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) r9 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r9, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_DQBUF(r9, 0xc0585611, &(0x7f0000000100)={0xb5bf, 0x3, 0x4, 0x0, 0x6, {}, {0x5, 0x0, 0x3, 0x1, 0x1, 0x7, "df2879db"}, 0x85c, 0x3, @fd=r6, 0x7fff, 0x0, r3}) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 911.807653] cgroup: cgroup2: unknown option "sys_iutablå" [ 911.949036] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 911.974947] device lo left promiscuous mode [ 912.000167] device tunl0 left promiscuous mode [ 912.012479] net_ratelimit: 13 callbacks suppressed [ 912.012492] protocol 88fb is buggy, dev hsr_slave_0 [ 912.023212] protocol 88fb is buggy, dev hsr_slave_1 [ 912.028831] device gre0 left promiscuous mode [ 912.039209] device gretap0 left promiscuous mode [ 912.056179] device erspan0 left promiscuous mode [ 912.066224] device ip_vti0 left promiscuous mode [ 912.074690] device ip6_vti0 left promiscuous mode [ 912.081059] device sit0 left promiscuous mode [ 912.091484] device ip6tnl0 left promiscuous mode [ 912.099785] device ip6gre0 left promiscuous mode [ 912.113715] device syz_tun left promiscuous mode [ 912.127174] device ip6gretap0 left promiscuous mode [ 912.142238] device bridge0 left promiscuous mode [ 912.155509] device vcan0 left promiscuous mode [ 912.162104] protocol 88fb is buggy, dev hsr_slave_0 [ 912.167282] protocol 88fb is buggy, dev hsr_slave_1 [ 912.178594] device bond0 left promiscuous mode [ 912.189407] device bond_slave_0 left promiscuous mode [ 912.202647] device bond_slave_1 left promiscuous mode [ 912.217964] device team0 left promiscuous mode [ 912.228849] device team_slave_0 left promiscuous mode [ 912.237359] device team_slave_1 left promiscuous mode [ 912.246152] device dummy0 left promiscuous mode [ 912.256319] device nlmon0 left promiscuous mode [ 912.261961] device caif0 left promiscuous mode [ 912.278345] device nr0 entered promiscuous mode 07:11:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffff000}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:11:00 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xbf02}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 912.314321] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 912.342680] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 912.378497] device nr0 entered promiscuous mode 07:11:01 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x40000080806, 0x0) setsockopt$inet6_int(r0, 0x29, 0x33, &(0x7f0000000040)=0x7fb, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x404e20}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000003d40)=[{{0x0, 0xffffffbf, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}], 0x4000000000000d0, 0x0) prctl$PR_GET_KEEPCAPS(0x7) 07:11:01 executing program 2: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x4031, 0xffffffffffffffff, 0x0) mlock(&(0x7f00003df000/0x4000)=nil, 0x4000) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x3, 0x6000) fcntl$setflags(r0, 0x2, 0x1) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x40, 0x4000, 0x2, 0x7ff, 0x8001}, &(0x7f0000000040)=0x14) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000080)={r2, 0x2e, "2c841b3c4012b9e9bfaa4bdc81d080333dc546fa0f2be094d9212a9e863fa07b4cf234dfb5fc67a0fa53ba5c2010"}, &(0x7f00000000c0)=0x36) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000140)=0x1) [ 912.551315] audit: type=1400 audit(1577171461.118:1165): avc: denied { name_bind } for pid=23528 comm="syz-executor.1" src=20000 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 [ 912.593520] audit: type=1400 audit(1577171461.118:1166): avc: denied { node_bind } for pid=23528 comm="syz-executor.1" src=20000 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:node_t:s0 tclass=dccp_socket permissive=1 07:11:01 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x2000, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000180)={'icmp\x00'}, &(0x7f00000001c0)=0x1e) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0xffffffffffffffff) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) getsockopt$inet6_int(r1, 0x29, 0x1f, &(0x7f0000000280), &(0x7f00000002c0)=0x4) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000940)={0x0, @in6={{0xa, 0x4e20, 0xe, @loopback}}, 0x0, 0x7}, 0x0) sched_setaffinity(0x0, 0x3d31, &(0x7f0000000200)=0xa000000000000005) write$FUSE_STATFS(0xffffffffffffffff, &(0x7f0000000400)={0x60, 0x0, 0x5, {{0x2, 0x5, 0x5ee1ddab, 0x9, 0x10000, 0x7, 0x8001, 0x9}}}, 0x60) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = getpgrp(0x0) setpriority(0x0, r2, 0xffff) modify_ldt$read(0x0, &(0x7f0000000000)=""/51, 0x33) clone(0x4007fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=ANY=[@ANYBLOB="5b643a3a5d24303a42bcc682"], &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ceph\x00', 0x0, 0x0) [ 912.642246] protocol 88fb is buggy, dev hsr_slave_0 [ 912.647380] protocol 88fb is buggy, dev hsr_slave_1 [ 912.656778] audit: type=1400 audit(1577171461.138:1167): avc: denied { name_connect } for pid=23528 comm="syz-executor.1" dest=20000 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 [ 912.756990] ceph: device name is missing path (no : separator in [d::]$0:B¼Æ‚) [ 912.835269] ceph: device name is missing path (no : separator in [d::]$0:B¼Æ‚) 07:11:01 executing program 2: bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x5, 0x7}, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$TCGETS(r2, 0x5401, &(0x7f0000000040)) ioctl$GIO_FONT(r1, 0x4b60, &(0x7f0000000140)=""/54) r3 = dup(r0) ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f0000000100)={'ip6tnl0\x00', 0xff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_mount_image$jfs(&(0x7f0000002640)='jfs\x00', &(0x7f0000002680)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000004180)=ANY=[@ANYBLOB='umask=0']) [ 912.962113] protocol 88fb is buggy, dev hsr_slave_0 [ 912.967400] protocol 88fb is buggy, dev hsr_slave_1 07:11:01 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x40000080806, 0x0) setsockopt$inet6_int(r0, 0x29, 0x33, &(0x7f0000000040)=0x7fb, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x404e20}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000003d40)=[{{0x0, 0xffffffbf, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}], 0x4000000000000d0, 0x0) prctl$PR_GET_KEEPCAPS(0x7) [ 913.297345] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:11:01 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff7f}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 913.385073] device nr0 entered promiscuous mode 07:11:02 executing program 2: r0 = socket(0xa, 0x1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xbb) keyctl$set_reqkey_keyring(0x5, 0xfffffffffffffffe) [ 913.537936] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 913.585931] device lo entered promiscuous mode [ 913.618453] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 913.650921] device tunl0 entered promiscuous mode [ 913.681971] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 913.720887] device gre0 entered promiscuous mode [ 913.746496] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 913.765380] device gretap0 entered promiscuous mode [ 913.780762] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 913.805369] device erspan0 entered promiscuous mode [ 913.820438] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 913.832605] device ip_vti0 entered promiscuous mode [ 913.838379] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 913.850976] device ip6_vti0 entered promiscuous mode [ 913.857299] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 913.869474] device sit0 entered promiscuous mode [ 913.875625] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 913.887471] device ip6tnl0 entered promiscuous mode [ 913.893394] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 913.900284] device ip6gre0 entered promiscuous mode [ 913.918208] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 913.927199] device syz_tun entered promiscuous mode [ 913.933387] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 913.940172] device ip6gretap0 entered promiscuous mode [ 913.948655] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 913.961334] device bridge0 entered promiscuous mode [ 913.967503] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 913.979459] device vcan0 entered promiscuous mode [ 913.985295] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 913.991850] device bond0 entered promiscuous mode [ 914.002782] device bond_slave_0 entered promiscuous mode [ 914.008571] device bond_slave_1 entered promiscuous mode [ 914.020290] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 914.026908] 8021q: adding VLAN 0 to HW filter on device bond0 [ 914.034190] device team0 entered promiscuous mode [ 914.039048] device team_slave_0 entered promiscuous mode [ 914.044698] device team_slave_1 entered promiscuous mode [ 914.050646] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 914.056817] 8021q: adding VLAN 0 to HW filter on device team0 [ 914.063710] device dummy0 entered promiscuous mode [ 914.069119] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 914.075695] device nlmon0 entered promiscuous mode [ 914.080988] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 914.132158] device caif0 entered promiscuous mode [ 914.137129] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 07:11:02 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000100)='./file0\x00', 0x2100, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:11:02 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet(0x10, 0x3, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) read(0xffffffffffffffff, &(0x7f0000000140)=""/73, 0x49) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text16={0x10, &(0x7f0000000040)="66b9800000c00f326635010000000f30260fd18300000fc72a0faef7da20d9c7f30f2a8a00000f01cabaf80c66b8d1d2f18a66efbafc0cec2e2ef30f7f708b", 0x3f}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x36a, 0x0) fsetxattr$security_selinux(r6, &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000100)='/sbin/dhclient\x00', 0xf, 0x1) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d0]}) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 07:11:02 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xf000}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:11:02 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000400)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) r3 = socket$inet(0xa, 0x801, 0x84) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000440)={0x5a, {{0x2, 0x4e24, @broadcast}}, 0x1, 0x7, [{{0x2, 0x4e23, @multicast2}}, {{0x2, 0x4e20, @multicast1}}, {{0x2, 0x4e23, @local}}, {{0x2, 0x4e23, @multicast1}}, {{0x2, 0x4e23, @loopback}}, {{0x2, 0x4e22, @local}}, {{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2a}}}]}, 0x410) listen(r3, 0x83) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x34b, 0x0, 0x0, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000000)={0x5, 0x6, 0x4, 0x8, 0xfffffffd, {}, {0x4, 0xc, 0x2, 0x3, 0x5, 0xbd, "06b76297"}, 0x40, 0x2, @userptr=0xfe, 0x4, 0x0, r0}) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'tunl0\x00', @dev={[], 0x1f}}) 07:11:02 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff9e}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:11:02 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x80, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000100)) r6 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) write$apparmor_current(r6, &(0x7f0000000040)=@profile={'permprofile ', ')\x00'}, 0xe) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r7, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:11:02 executing program 2: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r0, 0xc0096616, &(0x7f00000000c0)=ANY=[@ANYBLOB="070000000002000000000000000000"]) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) r6 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r7 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r7, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r7, 0x0, 0x80001d00c0d0) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) r9 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r9, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_DQBUF(r9, 0xc0585611, &(0x7f0000000100)={0xb5bf, 0x3, 0x4, 0x0, 0x6, {}, {0x5, 0x0, 0x3, 0x1, 0x1, 0x7, "df2879db"}, 0x85c, 0x3, @fd=r6, 0x7fff, 0x0, r3}) ioctl$VIDIOC_OVERLAY(r8, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 914.366231] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 914.470246] device batadv0 entered promiscuous mode [ 914.496941] device vxcan0 entered promiscuous mode [ 914.507228] device vxcan1 entered promiscuous mode [ 914.524547] device netdevsim5 entered promiscuous mode [ 914.538177] device veth0 entered promiscuous mode [ 914.543736] device veth1 entered promiscuous mode [ 914.548895] device veth0_to_bridge entered promiscuous mode [ 914.560320] device veth1_to_bridge entered promiscuous mode [ 914.566871] device veth0_to_bond entered promiscuous mode [ 914.578748] device veth1_to_bond entered promiscuous mode [ 914.585327] device veth0_to_team entered promiscuous mode [ 914.591297] device veth1_to_team entered promiscuous mode [ 914.602754] device veth0_to_hsr entered promiscuous mode [ 914.608622] device veth1_to_hsr entered promiscuous mode [ 914.619076] device hsr0 entered promiscuous mode [ 914.625648] device wlan0 entered promiscuous mode [ 914.630785] device wlan1 entered promiscuous mode [ 914.641158] device veth2 entered promiscuous mode [ 914.647822] device veth3 entered promiscuous mode [ 914.657531] device veth4 entered promiscuous mode [ 914.663429] device veth5 entered promiscuous mode [ 914.668464] device veth6 entered promiscuous mode [ 914.676271] device veth7 entered promiscuous mode [ 914.681238] device veth8 entered promiscuous mode [ 914.687061] device veth9 entered promiscuous mode [ 914.691974] device veth10 entered promiscuous mode [ 914.699708] device veth11 entered promiscuous mode [ 914.705494] device veth12 entered promiscuous mode [ 914.710491] device veth13 entered promiscuous mode [ 914.718172] device veth14 entered promiscuous mode [ 914.722111] protocol 88fb is buggy, dev hsr_slave_0 [ 914.726268] device veth15 entered promiscuous mode [ 914.736017] device bridge1 entered promiscuous mode [ 914.766629] device nr0 entered promiscuous mode 07:11:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 914.787570] device nr0 entered promiscuous mode 07:11:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 914.808406] device nr0 entered promiscuous mode 07:11:03 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="9c01000001070302000000000000000003fcffff87010700080002000004000008000100ba370a2ca46ba3e16a0bdf0dc66af6076eeffd9d0de24ffc9d6c9d7e25723d18", @ANYRES32, @ANYBLOB="14008100fe8000000000000000000000000000bb08003000ac1414aa1e84f855c47b9f00e90ed3f5a516a5d44520792da8bf82b87f7a414985854ff5ea36aa6b754761ac0000a8a1d709c0b7c419fa797c67993f6e6d2f0da1e766b085ffd202bdc86c7fa2c890041fd409d41e20a3370ae0a38f3606038f58ce0e01b9c5d6ba862e50e6939c4cde2968d78204b2ef1cff5d561a289452afc9bcf02d918b67bf3c9fe1310dc09069aaf9ffffffd1bdd3f0544e12a621d5b434ac14a18eb61d09004775d50430b94bcf510fda796ad3d75da37467d18b395ee974354bd1ff55f1055498a74a5f473d4efe9f259c3838c568d008cff5c265674bfd867a103f3cbae9942bf4bd9017d132d71262383d2fb827a44fba2d4e78bafabd18ec74703e7a9e9b45b15e59704903000000000000437584be238e5bcbfae6e3747e8ab73af218dfe85079e1102df90800540047ce0000000000"], 0x19c}}, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2000000}]}, 0x1c}}, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000040)={&(0x7f0000000340)={0xc4, r3, 0x22cc67696562a89e, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xf}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfff}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x54, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x40000000}, 0x80) [ 914.968900] audit: type=1400 audit(1577171463.538:1168): avc: denied { write } for pid=23618 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 914.969272] netlink: 371 bytes leftover after parsing attributes in process `syz-executor.1'. [ 915.027739] netlink: 371 bytes leftover after parsing attributes in process `syz-executor.1'. 07:11:03 executing program 1: bind$rds(0xffffffffffffffff, 0x0, 0x0) r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x1300, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffffffffffffff7, r0, 0x0) r1 = socket(0x2, 0x4, 0x80) connect$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @loopback}}, 0x24) sendmmsg(r1, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000001001000001000000770000f200000000a6e217b91c3b0d873722b41afb8ed58f2109e448e6cc4bd0f11a26f4233e3ba1ff40e062a43f80b1bae2728316e63e58afdf284732bd1e1970881ddd3c9f310f827c195f3c5d57c67a08466517ba1300000000858003ffffffffffffffff3e26b5ca26bb434dbd0e4885c214e577bb081876e63e7c2834573905db8b54b33da7b9c7aefca1f9c49c6400000008000000000000000061e2448f23a7e49736a335440c5b7681c58dc647494f0dbc811becd7c487d283b2d0574510103af981adebcd7535c0b3a3df610d9975d1d957e04bcf3ac0bce6bd35f0aa3fe141fce0c3b410c2ab65977da598ffa069c0e9dc6aa9a06a56a0f71da2bcbb9234731b3d386c15d34a5918d6909192ec97032c320044fa934bf944d6d5ce621d91c17f1c4377a54c7febb46f83a7842816023b60417388196a22091c9f82e8e0291f4082d92d0ae76b94a18647bb44cbe9366a08fb3f0000644307c51085f7215fd44635e5967f21e8f59bd021f309d910cb5d37cb16450244ef261a37255a06c97f19fa0e68836543174745684037cc7bba99aa1cbefcdd62f799a5fb35abc5af3ab43a5fc40eb352e6ff078fad68182845f1f6b7ff8404b41fce73186e55193df865fa3e588048349b35e431914bfde3c07f1419dac11995aded30b44ead7142a7b397a913f6bac2eac4c199b1a163c3e6dd9e88d416b73746d0833ff3a766a4b094bc6d5c69bd6b19e0043ba97cab8506b298a96b4707000000b77270f84d17c3d89c98aec479773696f16e5b9cd5be452742ba37ca722200d5256a04cd2ff6008bd26f1fe85d60ce476bffc936ca19e9d003000000000000007f93d6eb3895739efb0934a5dd0e5d653a4372463a15a907594bcea971cee301b34a27fcc22424dec4c85a6b972d3a588a8608c21a5d499189e3c5546ff98a8c04bb0c95763152ac4e009a08115b580864d3134fefdd32aac160055ca3e88ad95a4f78226cf62b5c5f112e163982a0896e5bee8d47"], 0x18}}], 0x1, 0x4048000) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x37a2, 0x41802) 07:11:03 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1c, 0x400}, 0x11a0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r0, 0x8010500c, &(0x7f0000000080)) r1 = socket$alg(0x26, 0x5, 0x0) r2 = syz_open_procfs(0x0, &(0x7f000068b000)='io\x00') bind$alg(r1, &(0x7f0000bf6000)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-generic\x00'}, 0x58) r3 = socket$alg(0x26, 0x5, 0x0) r4 = syz_open_procfs(0x0, 0x0) bind$alg(r3, &(0x7f0000bf6000)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-generic\x00'}, 0x58) accept4$alg(r3, 0x0, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c80, 0x0) r5 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r5) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dmmidi(&(0x7f0000000900)='/dev/dmmidi#\x00', 0x2, 0x0) r7 = syz_open_dev$loop(0x0, 0x0, 0x100082) writev(r7, &(0x7f0000000000)=[{&(0x7f00000000c0)="df", 0x1}], 0x1) r8 = syz_open_procfs(0x0, &(0x7f000068b000)='io\x00') r9 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$SIOCX25SDTEFACILITIES(r9, 0x89eb, &(0x7f0000000280)={0x4, 0x7, 0x9, 0x8, 0x4, 0x1e, 0x20, "49513efb2ee0ae58b22f4e4654a527cbc4d2ce4f", "f25b1f691a7ffbbdfa93fbea4c09a6ca8bba4c62"}) r10 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x9, 0x82141) bind$isdn_base(0xffffffffffffffff, &(0x7f0000000200)={0x22, 0x1, 0x1, 0x33, 0x1}, 0x6) ioctl$UI_SET_PROPBIT(r10, 0x4004556e, 0x2000001c) bind$alg(r6, &(0x7f0000bf6000)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-generic\x00'}, 0x58) r11 = accept4$alg(r6, 0x0, 0x0, 0x0) sendfile(r11, r8, 0x0, 0x6) r12 = accept4$alg(r2, 0x0, 0x0, 0x0) sendfile(r12, r2, 0x0, 0x6) ioctl$DRM_IOCTL_GET_STATS(r2, 0x80f86406, &(0x7f00000000c0)=""/220) [ 915.481368] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 915.490102] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 915.513020] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 915.520016] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 915.529820] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 915.535755] [ 915.537702] ====================================================== [ 915.538727] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 915.544014] WARNING: possible circular locking dependency detected [ 915.544023] 4.19.91-syzkaller #0 Not tainted [ 915.544027] ------------------------------------------------------ [ 915.544034] syz-executor.1/23635 is trying to acquire lock: [ 915.544039] 000000002b5ba073 (&sig->cred_guard_mutex){+.+.}, at: do_io_accounting+0x1f4/0x830 [ 915.544069] [ 915.544069] but task is already holding lock: [ 915.551065] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 915.556596] 0000000096551fdb (&p->lock){+.+.}, at: seq_read+0x71/0x1110 [ 915.556623] [ 915.556623] which lock already depends on the new lock. [ 915.556623] [ 915.556626] [ 915.556626] the existing dependency chain (in reverse order) is: [ 915.556629] [ 915.556629] -> #3 (&p->lock){+.+.}: [ 915.556656] __mutex_lock+0xf7/0x1300 [ 915.556669] mutex_lock_nested+0x16/0x20 [ 915.556683] seq_read+0x71/0x1110 [ 915.565587] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 915.567437] do_iter_read+0x490/0x640 [ 915.574692] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 915.581785] vfs_readv+0xf0/0x160 [ 915.589658] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 915.593969] default_file_splice_read+0x478/0x970 [ 915.593980] do_splice_to+0x127/0x180 [ 915.593991] splice_direct_to_actor+0x2d3/0x970 [ 915.594002] do_splice_direct+0x1da/0x2a0 [ 915.594014] do_sendfile+0x597/0xce0 [ 915.594031] __x64_sys_sendfile64+0x1dd/0x220 [ 915.603224] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 915.609102] do_syscall_64+0xfd/0x620 [ 915.619286] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 915.621797] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 915.621802] [ 915.621802] -> #2 (sb_writers#4){.+.+}: [ 915.621823] __sb_start_write+0x208/0x360 [ 915.621841] mnt_want_write+0x3f/0xc0 [ 915.628738] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 915.630747] ovl_want_write+0x76/0xa0 [ 915.630765] ovl_create_object+0xb3/0x2c0 [ 915.636774] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 915.641035] ovl_create+0x28/0x30 [ 915.641046] lookup_open+0x12be/0x1ad0 [ 915.641061] path_openat+0x149a/0x45e0 [ 915.648524] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 915.651339] do_filp_open+0x1a1/0x280 [ 915.651355] do_sys_open+0x3fe/0x550 [ 915.657230] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 915.661541] __x64_sys_open+0x7e/0xc0 [ 915.661561] do_syscall_64+0xfd/0x620 [ 915.668190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 915.671221] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 915.678501] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 915.681043] [ 915.681043] -> #1 (&ovl_i_mutex_dir_key[depth]){++++}: [ 915.686776] 8021q: adding VLAN 0 to HW filter on device team0 [ 915.690275] down_read+0x3b/0xb0 [ 915.698532] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 915.700805] path_openat+0x1e59/0x45e0 [ 915.708865] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 915.712712] do_filp_open+0x1a1/0x280 [ 915.712725] do_open_execat+0x140/0x660 [ 915.712739] __do_execve_file.isra.0+0x15a4/0x2150 [ 915.712751] __x64_sys_execveat+0xed/0x130 [ 915.712763] do_syscall_64+0xfd/0x620 [ 915.712775] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 915.712786] [ 915.712786] -> #0 (&sig->cred_guard_mutex){+.+.}: [ 915.720149] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 915.722887] lock_acquire+0x16f/0x3f0 [ 915.722902] __mutex_lock+0xf7/0x1300 [ 915.722916] mutex_lock_killable_nested+0x16/0x20 [ 915.722926] do_io_accounting+0x1f4/0x830 [ 915.722941] proc_tgid_io_accounting+0x23/0x30 [ 915.729051] caif:caif_disconnect_client(): nothing to disconnect [ 915.733724] proc_single_show+0xf0/0x180 [ 915.733736] seq_read+0x4ca/0x1110 [ 915.733749] do_iter_read+0x490/0x640 [ 915.733761] vfs_readv+0xf0/0x160 [ 915.733777] default_file_splice_read+0x478/0x970 [ 915.936962] do_splice_to+0x127/0x180 [ 915.941273] splice_direct_to_actor+0x2d3/0x970 [ 915.946454] do_splice_direct+0x1da/0x2a0 [ 915.951106] do_sendfile+0x597/0xce0 [ 915.955326] __x64_sys_sendfile64+0x1dd/0x220 [ 915.960329] do_syscall_64+0xfd/0x620 [ 915.964637] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 915.970327] [ 915.970327] other info that might help us debug this: [ 915.970327] [ 915.978453] Chain exists of: [ 915.978453] &sig->cred_guard_mutex --> sb_writers#4 --> &p->lock [ 915.978453] [ 915.989112] Possible unsafe locking scenario: [ 915.989112] [ 915.995159] CPU0 CPU1 [ 915.999815] ---- ---- [ 916.004471] lock(&p->lock); [ 916.007566] lock(sb_writers#4); [ 916.013527] lock(&p->lock); [ 916.019137] lock(&sig->cred_guard_mutex); [ 916.023447] [ 916.023447] *** DEADLOCK *** [ 916.023447] [ 916.029504] 1 lock held by syz-executor.1/23635: [ 916.034306] #0: 0000000096551fdb (&p->lock){+.+.}, at: seq_read+0x71/0x1110 [ 916.041498] [ 916.041498] stack backtrace: [ 916.045988] CPU: 1 PID: 23635 Comm: syz-executor.1 Not tainted 4.19.91-syzkaller #0 [ 916.053832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 916.063181] Call Trace: [ 916.065828] dump_stack+0x197/0x210 [ 916.069441] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 916.074800] __lock_acquire+0x2e19/0x49c0 [ 916.079011] ? is_bpf_text_address+0xac/0x170 [ 916.083506] ? mark_held_locks+0x100/0x100 [ 916.087729] ? lockdep_hardirqs_on+0x415/0x5d0 [ 916.092319] ? trace_hardirqs_on_caller+0x6a/0x220 [ 916.097252] ? retint_kernel+0x2d/0x2d [ 916.101170] lock_acquire+0x16f/0x3f0 [ 916.104963] ? do_io_accounting+0x1f4/0x830 [ 916.109275] ? do_io_accounting+0x1f4/0x830 [ 916.113592] __mutex_lock+0xf7/0x1300 [ 916.117378] ? do_io_accounting+0x1f4/0x830 [ 916.121686] ? do_io_accounting+0x1f4/0x830 [ 916.126000] ? mark_held_locks+0xb1/0x100 [ 916.130185] ? __kmalloc_node+0x51/0x80 [ 916.134150] ? mutex_trylock+0x1e0/0x1e0 [ 916.138197] ? lockdep_hardirqs_on+0x415/0x5d0 [ 916.142776] ? retint_kernel+0x2d/0x2d [ 916.146657] ? trace_hardirqs_on_caller+0x6a/0x220 [ 916.151588] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 916.156335] ? retint_kernel+0x2d/0x2d [ 916.160211] mutex_lock_killable_nested+0x16/0x20 [ 916.165041] ? mutex_lock_killable_nested+0x16/0x20 [ 916.170044] do_io_accounting+0x1f4/0x830 [ 916.174178] ? proc_pid_stack+0x2c0/0x2c0 [ 916.178319] ? kasan_check_read+0x11/0x20 [ 916.182485] proc_tgid_io_accounting+0x23/0x30 [ 916.187158] proc_single_show+0xf0/0x180 [ 916.191229] seq_read+0x4ca/0x1110 [ 916.194777] do_iter_read+0x490/0x640 [ 916.198621] ? dup_iter+0x270/0x270 [ 916.202260] vfs_readv+0xf0/0x160 [ 916.205723] ? compat_rw_copy_check_uvector+0x400/0x400 [ 916.211196] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 916.216723] ? iov_iter_revert+0xa50/0xa50 [ 916.220949] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 916.225959] ? iov_iter_pipe+0xbe/0x2e0 [ 916.229921] default_file_splice_read+0x478/0x970 [ 916.234815] ? save_stack+0x45/0xd0 [ 916.238474] ? kasan_kmalloc+0xce/0xf0 [ 916.242358] ? __kmalloc+0x15d/0x750 [ 916.246071] ? iter_file_splice_write+0xbd0/0xbd0 [ 916.250899] ? retint_kernel+0x2d/0x2d [ 916.254784] ? percpu_ref_put_many+0x94/0x190 [ 916.259277] ? fsnotify+0x8ba/0xf00 [ 916.262899] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 916.268443] ? fsnotify_first_mark+0x210/0x210 [ 916.273023] ? __inode_security_revalidate+0xda/0x120 [ 916.278300] ? avc_policy_seqno+0xd/0x70 [ 916.282369] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 916.287386] ? security_file_permission+0x89/0x230 [ 916.292314] ? iter_file_splice_write+0xbd0/0xbd0 [ 916.297163] do_splice_to+0x127/0x180 [ 916.300962] splice_direct_to_actor+0x2d3/0x970 [ 916.305624] ? generic_pipe_buf_nosteal+0x10/0x10 [ 916.310460] ? do_splice_to+0x180/0x180 [ 916.314422] ? security_file_permission+0x89/0x230 [ 916.319334] ? rw_verify_area+0x118/0x360 [ 916.323472] do_splice_direct+0x1da/0x2a0 [ 916.327639] ? splice_direct_to_actor+0x970/0x970 [ 916.332486] ? security_file_permission+0x89/0x230 [ 916.337414] ? rw_verify_area+0x118/0x360 [ 916.341545] do_sendfile+0x597/0xce0 [ 916.345251] ? do_compat_pwritev64+0x1c0/0x1c0 [ 916.349869] ? trace_hardirqs_on_caller+0x6a/0x220 [ 916.354787] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 916.359528] __x64_sys_sendfile64+0x1dd/0x220 [ 916.364008] ? __ia32_sys_sendfile+0x230/0x230 [ 916.368574] do_syscall_64+0xfd/0x620 [ 916.372468] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 916.377651] RIP: 0033:0x45a919 [ 916.380826] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 916.399722] RSP: 002b:00007fb36caa5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 916.407438] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a919 [ 916.414692] RDX: 0000000000000000 RSI: 000000000000000d RDI: 0000000000000010 [ 916.421957] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 916.429214] R10: 0000000000000006 R11: 0000000000000246 R12: 00007fb36caa66d4 [ 916.436473] R13: 00000000004c925e R14: 00000000004e0f88 R15: 00000000ffffffff [ 916.462298] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 916.470315] chnl_net:chnl_net_open(): state disconnected [ 916.476051] device nr0 entered promiscuous mode [ 916.484631] kobject: 'rx-0' (00000000949d0293): kobject_cleanup, parent 00000000220ee47c [ 916.494618] kobject: 'loop5' (00000000e762f399): kobject_uevent_env [ 916.501116] kobject: 'rx-0' (00000000949d0293): auto cleanup 'remove' event [ 916.502243] kobject: 'loop5' (00000000e762f399): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 916.508290] kobject: 'rx-0' (00000000949d0293): kobject_uevent_env [ 916.539340] kobject: 'rx-0' (00000000949d0293): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 916.551507] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 916.558274] kobject: 'rx-0' (00000000949d0293): auto cleanup kobject_del [ 916.560202] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 916.568355] kobject: 'rx-0' (00000000949d0293): calling ktype release [ 916.581362] kobject: 'rx-0': free name [ 916.585775] kobject: 'tx-0' (00000000b84a4fab): kobject_cleanup, parent 00000000220ee47c [ 916.594104] kobject: 'tx-0' (00000000b84a4fab): auto cleanup 'remove' event [ 916.601241] kobject: 'tx-0' (00000000b84a4fab): kobject_uevent_env [ 916.607701] kobject: 'tx-0' (00000000b84a4fab): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 916.617962] kobject: 'tx-0' (00000000b84a4fab): auto cleanup kobject_del [ 916.624932] kobject: 'tx-0' (00000000b84a4fab): calling ktype release [ 916.631508] kobject: 'tx-0': free name [ 916.635444] kobject: 'queues' (00000000220ee47c): kobject_cleanup, parent (null) [ 916.643889] kobject: 'queues' (00000000220ee47c): calling ktype release [ 916.650634] kobject: 'queues' (00000000220ee47c): kset_release [ 916.656620] kobject: 'queues': free name [ 916.660890] kobject: 'nr0' (000000003213e40b): kobject_uevent_env [ 916.667369] kobject: 'nr0' (000000003213e40b): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 916.676709] kobject: 'nr0' (00000000dc7ee444): kobject_cleanup, parent (null) [ 916.687610] kobject: 'nr0' (00000000dc7ee444): calling ktype release [ 916.693449] kobject: 'nr0' (00000000ade72ee5): kobject_cleanup, parent (null) [ 916.694574] kobject: 'nr0': free name [ 916.709019] kobject: 'nr0' (00000000ade72ee5): calling ktype release [ 916.712123] kobject: 'nr0' (000000003213e40b): kobject_cleanup, parent (null) [ 916.723937] kobject: 'nr0': free name [ 916.725245] kobject: 'nr0' (000000003213e40b): calling ktype release [ 916.734894] kobject: 'loop0' (0000000014568201): kobject_uevent_env [ 916.741364] kobject: 'loop0' (0000000014568201): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 916.759776] kobject: 'nr0': free name [ 916.765201] kobject: 'nr0' (00000000006e7b6a): kobject_add_internal: parent: 'net', set: 'devices' [ 916.782945] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 916.783546] kobject: 'nr0' (00000000006e7b6a): kobject_uevent_env [ 916.789391] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 916.795779] kobject: 'nr0' (00000000006e7b6a): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 916.825776] kobject: 'queues' (000000002ec060c6): kobject_add_internal: parent: 'nr0', set: '' [ 916.831590] kobject: 'loop4' (000000001ef93463): kobject_uevent_env [ 916.836186] kobject: 'queues' (000000002ec060c6): kobject_uevent_env [ 916.848184] kobject: 'queues' (000000002ec060c6): kobject_uevent_env: filter function caused the event to drop! [ 916.848238] kobject: 'loop4' (000000001ef93463): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 916.858524] kobject: 'rx-0' (000000002dc521a1): kobject_add_internal: parent: 'queues', set: 'queues' [ 916.858579] kobject: 'rx-0' (000000002dc521a1): kobject_uevent_env [ 916.885530] kobject: 'rx-0' (000000002dc521a1): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 916.890517] audit: type=1800 audit(1577171465.458:1169): pid=23645 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="sda1" ino=16712 res=0 [ 916.896492] kobject: 'tx-0' (0000000056d7133f): kobject_add_internal: parent: 'queues', set: 'queues' [ 916.927045] kobject: 'tx-0' (0000000056d7133f): kobject_uevent_env [ 916.933446] kobject: 'tx-0' (0000000056d7133f): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 916.944939] kobject: 'rx-0' (000000002dc521a1): kobject_cleanup, parent 000000002ec060c6 [ 916.953359] kobject: 'rx-0' (000000002dc521a1): auto cleanup 'remove' event [ 916.960448] kobject: 'rx-0' (000000002dc521a1): kobject_uevent_env [ 916.967079] kobject: 'rx-0' (000000002dc521a1): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 916.977325] kobject: 'rx-0' (000000002dc521a1): auto cleanup kobject_del [ 916.984262] kobject: 'rx-0' (000000002dc521a1): calling ktype release [ 916.990823] kobject: 'rx-0': free name [ 916.994962] kobject: 'tx-0' (0000000056d7133f): kobject_cleanup, parent 000000002ec060c6 [ 917.003234] kobject: 'tx-0' (0000000056d7133f): auto cleanup 'remove' event [ 917.010371] kobject: 'tx-0' (0000000056d7133f): kobject_uevent_env [ 917.016785] kobject: 'tx-0' (0000000056d7133f): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 917.027093] kobject: 'tx-0' (0000000056d7133f): auto cleanup kobject_del [ 917.033987] kobject: 'tx-0' (0000000056d7133f): calling ktype release [ 917.040566] kobject: 'tx-0': free name [ 917.044788] kobject: 'queues' (000000002ec060c6): kobject_cleanup, parent (null) [ 917.053237] kobject: 'queues' (000000002ec060c6): calling ktype release [ 917.059995] kobject: 'queues' (000000002ec060c6): kset_release [ 917.066000] kobject: 'queues': free name [ 917.070277] kobject: 'nr0' (00000000006e7b6a): kobject_uevent_env [ 917.076667] kobject: 'nr0' (00000000006e7b6a): fill_kobj_path: path = '/devices/virtual/net/nr0' 07:11:05 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:11:05 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffffff0}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:11:05 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:11:05 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_read_part_table(0x0, 0x5, &(0x7f0000000340)=[{&(0x7f0000000000)="a3d68b85c7495e4d26fa2481b928bce7dabfbfb7f7ec7b7b0d7f062c3bfdc656828863b9076e292add", 0xb, 0xfff}, {&(0x7f0000000040)="463d2c5d781da22a272900faee084272996cf436ac0f20b85b8d2dcac1bd7d4d9ba0630c81a61a74b4b0564ff663799477ca55ebbfa134ff6cc613e4de92542cede8aa284abcbb97d2a30853851489f0f38962139c88388521434d8c993bdd7d8fee306b9d591c87e9661c58bb568d1c6a22850afe52bb18f64b04c3013d150c3d52486a2d4e24b35920a5a4370f71edfd14540204127c56ffd1cd438f8da1e9347016588e8b677128f2c9da84f26127fdf90ecd7efe9f8de722cd63d4749eb3c0516765fc4dd9f00b95e7347b29f68f8884d51ddbc6975d14754426a4f3c39ef40325f6bee9eb6b855194e37c85ec1f5bfe45562916d6f8b6", 0xf9, 0x10000}, {&(0x7f0000000640)="79025d43ab52dce7d1fd5cecedebcb236648fe7fc88dd446e50a1ebcb7dd921d6907057aa3403615cdfb7c32c96a2c0b4a38ea043380b734d9882b99ad1a4fe1af6baeb141ca581d01f0a07bc7e979e9f808df4ac5b44967854c14474f66b319d64eddb36eb010c748511a458182b65a9e7087af4902fa286671695f7d12dd9e81b76b7f9ebd9f2d7399112c833790b524356edbd5d03431d530050000000000000035cab1e481f8891679ec6a0d591fcc9d415006e55fa4d626e6e183eb34b04d82cc5a6042a0609e3aeef5a4516330f3c14073319f847a53e83e78e5a273f49a4c65131819db2625d111b5c4f780ac32", 0xbf, 0x9}, {&(0x7f0000000240)="6c7124450889222be73e645df7fb4cbb07ef4ad275d157e703cb2795866a0e4c8179cad9889535f8ce2bac77a79ceb54bdd80567e65bb31da3305164c7ca3a5a968724391aa429ebc34124658040ffbd611585f1f02fa3b39ab6dad7db1febebf29f8080740e27a54671268274ecde4a62735556b9e8d2a850835dfe6cca3d3d920a0e97921c2219672016a123fdb250775dd5e2f4f5dc328941", 0x9a, 0x1000}, {&(0x7f0000000300)="665971203bde6ff22972a8743d855b45179c4300a640cca96e4fd327cf8523525769fafc898a6af65ed7ef", 0x2b, 0x3}]) 07:11:05 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f00000000c0)={0x0, @bt={0x85, 0x1f, 0x1, 0x1, 0x80000000, 0x2, 0x8001, 0x505, 0x7f, 0xffffffd3, 0xffffffff, 0x6, 0x0, 0x7fff, 0x0, 0x11, {0x6, 0x10001}, 0x5, 0x20}}) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 917.132148] kobject: 'nr0' (00000000006e7b6a): kobject_cleanup, parent (null) [ 917.140464] kobject: 'nr0' (00000000006e7b6a): calling ktype release [ 917.147086] kobject: 'nr0': free name 07:11:05 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r7, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r8 = accept$inet6(r7, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000100)=0x1c) r9 = socket$inet6(0xa, 0x400000000001, 0x0) r10 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/video2\x00', 0x2, 0x0) close(r10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={r11}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r9, 0x84, 0x19, &(0x7f00000003c0)={r11, 0x5}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r8, 0x84, 0x75, &(0x7f0000000140)={r11, 0x9}, 0x8) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 917.183518] kobject: 'nr0' (00000000d1e35e64): kobject_add_internal: parent: 'net', set: 'devices' [ 917.187311] kobject: 'loop3' (000000007e58d161): kobject_uevent_env [ 917.199294] kobject: 'loop3' (000000007e58d161): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 917.205330] kobject: 'nr0' (00000000d1e35e64): kobject_uevent_env [ 917.219384] kobject: 'nr0' (00000000d1e35e64): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 917.245391] kobject: 'queues' (000000002ac65908): kobject_add_internal: parent: 'nr0', set: '' [ 917.248591] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 917.255183] kobject: 'queues' (000000002ac65908): kobject_uevent_env [ 917.264022] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 917.269214] kobject: 'queues' (000000002ac65908): kobject_uevent_env: filter function caused the event to drop! [ 917.288218] kobject: 'rx-0' (0000000016759fe0): kobject_add_internal: parent: 'queues', set: 'queues' [ 917.300206] kobject: 'rx-0' (0000000016759fe0): kobject_uevent_env [ 917.306965] kobject: 'rx-0' (0000000016759fe0): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 917.317406] kobject: 'tx-0' (00000000047dfaa1): kobject_add_internal: parent: 'queues', set: 'queues' [ 917.327043] kobject: 'tx-0' (00000000047dfaa1): kobject_uevent_env [ 917.338123] kobject: 'tx-0' (00000000047dfaa1): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 917.352517] netlink: 'syz-executor.1': attribute type 16 has an invalid length. [ 917.361168] device lo entered promiscuous mode [ 917.364070] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 917.366735] device tunl0 entered promiscuous mode [ 917.372666] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 917.377787] device gre0 entered promiscuous mode [ 917.392193] device gretap0 entered promiscuous mode [ 917.398041] device erspan0 entered promiscuous mode [ 917.404096] device ip_vti0 entered promiscuous mode [ 917.409836] device ip6_vti0 entered promiscuous mode [ 917.415705] device sit0 entered promiscuous mode [ 917.420995] device ip6tnl0 entered promiscuous mode [ 917.426762] device ip6gre0 entered promiscuous mode [ 917.432341] device syz_tun entered promiscuous mode [ 917.437821] device ip6gretap0 entered promiscuous mode [ 917.444639] device bridge0 entered promiscuous mode [ 917.450338] device vcan0 entered promiscuous mode [ 917.455461] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 917.462373] device bond0 entered promiscuous mode [ 917.467222] device bond_slave_0 entered promiscuous mode [ 917.473486] device bond_slave_1 entered promiscuous mode [ 917.480223] device team0 entered promiscuous mode [ 917.485204] device team_slave_0 entered promiscuous mode [ 917.490715] device team_slave_1 entered promiscuous mode [ 917.497299] device dummy0 entered promiscuous mode [ 917.503038] device nlmon0 entered promiscuous mode [ 917.508319] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 917.516443] caif:caif_disconnect_client(): nothing to disconnect [ 917.572046] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 917.580087] chnl_net:chnl_net_open(): state disconnected [ 917.585633] device caif0 entered promiscuous mode [ 917.590521] net_ratelimit: 6 callbacks suppressed [ 917.590527] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 917.610780] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:11:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:11:06 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 917.635965] kobject: 'nr0' (00000000b5d5e9d8): kobject_add_internal: parent: 'net', set: 'devices' [ 917.648096] kobject: 'nr0' (00000000b5d5e9d8): kobject_uevent_env [ 917.651473] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 917.659096] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 917.669960] kobject: 'nr0' (00000000b5d5e9d8): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 917.692967] kobject: 'loop5' (00000000e762f399): kobject_uevent_env [ 917.698384] kobject: 'queues' (000000006907c10e): kobject_add_internal: parent: 'nr0', set: '' [ 917.705080] kobject: 'loop5' (00000000e762f399): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 917.708971] kobject: 'queues' (000000006907c10e): kobject_uevent_env [ 917.727380] kobject: 'queues' (000000006907c10e): kobject_uevent_env: filter function caused the event to drop! [ 917.738036] kobject: 'rx-0' (00000000e6125baf): kobject_add_internal: parent: 'queues', set: 'queues' [ 917.747769] kobject: 'rx-0' (00000000e6125baf): kobject_uevent_env [ 917.754254] kobject: 'rx-0' (00000000e6125baf): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 917.764647] kobject: 'tx-0' (00000000847ff05a): kobject_add_internal: parent: 'queues', set: 'queues' [ 917.774212] kobject: 'tx-0' (00000000847ff05a): kobject_uevent_env [ 917.780557] kobject: 'tx-0' (00000000847ff05a): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' 07:11:06 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_read_part_table(0x0, 0x5, &(0x7f0000000340)=[{&(0x7f0000000000)="a3d68b85c7495e4d26fa2481b928bce7dabfbfb7f7ec7b7b0d7f062c3bfdc656828863b9076e292add", 0xb, 0xfff}, {&(0x7f0000000040)="463d2c5d781da22a272900faee084272996cf436ac0f20b85b8d2dcac1bd7d4d9ba0630c81a61a74b4b0564ff663799477ca55ebbfa134ff6cc613e4de92542cede8aa284abcbb97d2a30853851489f0f38962139c88388521434d8c993bdd7d8fee306b9d591c87e9661c58bb568d1c6a22850afe52bb18f64b04c3013d150c3d52486a2d4e24b35920a5a4370f71edfd14540204127c56ffd1cd438f8da1e9347016588e8b677128f2c9da84f26127fdf90ecd7efe9f8de722cd63d4749eb3c0516765fc4dd9f00b95e7347b29f68f8884d51ddbc6975d14754426a4f3c39ef40325f6bee9eb6b855194e37c85ec1f5bfe45562916d6f8b6", 0xf9, 0x10000}, {&(0x7f0000000640)="79025d43ab52dce7d1fd5cecedebcb236648fe7fc88dd446e50a1ebcb7dd921d6907057aa3403615cdfb7c32c96a2c0b4a38ea043380b734d9882b99ad1a4fe1af6baeb141ca581d01f0a07bc7e979e9f808df4ac5b44967854c14474f66b319d64eddb36eb010c748511a458182b65a9e7087af4902fa286671695f7d12dd9e81b76b7f9ebd9f2d7399112c833790b524356edbd5d03431d530050000000000000035cab1e481f8891679ec6a0d591fcc9d415006e55fa4d626e6e183eb34b04d82cc5a6042a0609e3aeef5a4516330f3c14073319f847a53e83e78e5a273f49a4c65131819db2625d111b5c4f780ac32", 0xbf, 0x9}, {&(0x7f0000000240)="6c7124450889222be73e645df7fb4cbb07ef4ad275d157e703cb2795866a0e4c8179cad9889535f8ce2bac77a79ceb54bdd80567e65bb31da3305164c7ca3a5a968724391aa429ebc34124658040ffbd611585f1f02fa3b39ab6dad7db1febebf29f8080740e27a54671268274ecde4a62735556b9e8d2a850835dfe6cca3d3d920a0e97921c2219672016a123fdb250775dd5e2f4f5dc328941", 0x9a, 0x1000}, {&(0x7f0000000300)="665971203bde6ff22972a8743d855b45179c4300a640cca96e4fd327cf8523525769fafc898a6af65ed7ef", 0x2b, 0x3}]) [ 917.798076] device nr0 entered promiscuous mode [ 917.812662] device nr0 entered promiscuous mode [ 917.834338] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 917.842274] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 917.894076] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 917.900790] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 917.930376] kobject: 'rx-0' (00000000e6125baf): kobject_cleanup, parent 000000006907c10e [ 917.938668] kobject: 'rx-0' (00000000e6125baf): auto cleanup 'remove' event [ 917.945812] kobject: 'rx-0' (00000000e6125baf): kobject_uevent_env [ 917.952235] kobject: 'rx-0' (00000000e6125baf): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 917.962493] kobject: 'rx-0' (00000000e6125baf): auto cleanup kobject_del [ 917.969358] kobject: 'rx-0' (00000000e6125baf): calling ktype release [ 917.976097] kobject: 'rx-0': free name [ 917.980027] kobject: 'tx-0' (00000000847ff05a): kobject_cleanup, parent 000000006907c10e [ 917.988306] kobject: 'tx-0' (00000000847ff05a): auto cleanup 'remove' event [ 917.995439] kobject: 'tx-0' (00000000847ff05a): kobject_uevent_env [ 918.001777] kobject: 'tx-0' (00000000847ff05a): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 918.012125] kobject: 'tx-0' (00000000847ff05a): auto cleanup kobject_del [ 918.018990] kobject: 'tx-0' (00000000847ff05a): calling ktype release [ 918.022259] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 918.025613] kobject: 'tx-0': free name [ 918.025635] kobject: 'queues' (000000006907c10e): kobject_cleanup, parent (null) [ 918.034012] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 918.036189] kobject: 'queues' (000000006907c10e): calling ktype release [ 918.061182] kobject: 'queues' (000000006907c10e): kset_release [ 918.067389] kobject: 'queues': free name [ 918.071767] kobject: 'nr0' (00000000b5d5e9d8): kobject_uevent_env [ 918.078156] kobject: 'nr0' (00000000b5d5e9d8): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 918.087443] netlink: 'syz-executor.1': attribute type 16 has an invalid length. [ 918.097666] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 918.105775] caif:caif_disconnect_client(): nothing to disconnect [ 918.142083] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 918.150100] chnl_net:chnl_net_open(): state disconnected [ 918.155655] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 918.170467] netlink: 'syz-executor.5': attribute type 16 has an invalid length. 07:11:06 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:11:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 918.191283] kobject: 'rx-0' (0000000016759fe0): kobject_cleanup, parent 000000002ac65908 [ 918.208359] kobject: 'loop0' (0000000014568201): kobject_uevent_env [ 918.218442] kobject: 'rx-0' (0000000016759fe0): auto cleanup 'remove' event [ 918.228373] kobject: 'loop0' (0000000014568201): fill_kobj_path: path = '/devices/virtual/block/loop0' 07:11:06 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffff}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 918.241803] kobject: 'rx-0' (0000000016759fe0): kobject_uevent_env [ 918.248554] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 918.253337] kobject: 'rx-0' (0000000016759fe0): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 918.259727] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 918.275848] kobject: 'rx-0' (0000000016759fe0): auto cleanup kobject_del [ 918.278194] kobject: 'loop5' (00000000e762f399): kobject_uevent_env [ 918.283631] kobject: 'rx-0' (0000000016759fe0): calling ktype release [ 918.291427] kobject: 'loop5' (00000000e762f399): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 918.297768] kobject: 'rx-0': free name [ 918.309902] kobject: 'tx-0' (00000000047dfaa1): kobject_cleanup, parent 000000002ac65908 [ 918.327349] kobject: 'tx-0' (00000000047dfaa1): auto cleanup 'remove' event [ 918.334818] kobject: 'tx-0' (00000000047dfaa1): kobject_uevent_env [ 918.341200] kobject: 'tx-0' (00000000047dfaa1): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 918.351453] kobject: 'tx-0' (00000000047dfaa1): auto cleanup kobject_del [ 918.358416] kobject: 'tx-0' (00000000047dfaa1): calling ktype release [ 918.365124] kobject: 'tx-0': free name [ 918.369021] kobject: 'queues' (000000002ac65908): kobject_cleanup, parent (null) [ 918.377456] kobject: 'queues' (000000002ac65908): calling ktype release [ 918.384243] kobject: 'queues' (000000002ac65908): kset_release [ 918.390212] kobject: 'queues': free name [ 918.394657] kobject: 'nr0' (00000000d1e35e64): kobject_uevent_env [ 918.400997] kobject: 'nr0' (00000000d1e35e64): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 918.411357] kobject: 'nr0' (00000000b5d5e9d8): kobject_cleanup, parent (null) [ 918.412131] netlink: 'syz-executor.1': attribute type 16 has an invalid length. [ 918.427101] kobject: 'nr0' (00000000b5d5e9d8): calling ktype release [ 918.427126] kobject: 'nr0': free name 07:11:07 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_read_part_table(0x0, 0x5, &(0x7f0000000340)=[{&(0x7f0000000000)="a3d68b85c7495e4d26fa2481b928bce7dabfbfb7f7ec7b7b0d7f062c3bfdc656828863b9076e292add", 0xb, 0xfff}, {&(0x7f0000000040)="463d2c5d781da22a272900faee084272996cf436ac0f20b85b8d2dcac1bd7d4d9ba0630c81a61a74b4b0564ff663799477ca55ebbfa134ff6cc613e4de92542cede8aa284abcbb97d2a30853851489f0f38962139c88388521434d8c993bdd7d8fee306b9d591c87e9661c58bb568d1c6a22850afe52bb18f64b04c3013d150c3d52486a2d4e24b35920a5a4370f71edfd14540204127c56ffd1cd438f8da1e9347016588e8b677128f2c9da84f26127fdf90ecd7efe9f8de722cd63d4749eb3c0516765fc4dd9f00b95e7347b29f68f8884d51ddbc6975d14754426a4f3c39ef40325f6bee9eb6b855194e37c85ec1f5bfe45562916d6f8b6", 0xf9, 0x10000}, {&(0x7f0000000640)="79025d43ab52dce7d1fd5cecedebcb236648fe7fc88dd446e50a1ebcb7dd921d6907057aa3403615cdfb7c32c96a2c0b4a38ea043380b734d9882b99ad1a4fe1af6baeb141ca581d01f0a07bc7e979e9f808df4ac5b44967854c14474f66b319d64eddb36eb010c748511a458182b65a9e7087af4902fa286671695f7d12dd9e81b76b7f9ebd9f2d7399112c833790b524356edbd5d03431d530050000000000000035cab1e481f8891679ec6a0d591fcc9d415006e55fa4d626e6e183eb34b04d82cc5a6042a0609e3aeef5a4516330f3c14073319f847a53e83e78e5a273f49a4c65131819db2625d111b5c4f780ac32", 0xbf, 0x9}, {&(0x7f0000000240)="6c7124450889222be73e645df7fb4cbb07ef4ad275d157e703cb2795866a0e4c8179cad9889535f8ce2bac77a79ceb54bdd80567e65bb31da3305164c7ca3a5a968724391aa429ebc34124658040ffbd611585f1f02fa3b39ab6dad7db1febebf29f8080740e27a54671268274ecde4a62735556b9e8d2a850835dfe6cca3d3d920a0e97921c2219672016a123fdb250775dd5e2f4f5dc328941", 0x9a, 0x1000}, {&(0x7f0000000300)="665971203bde6ff22972a8743d855b45179c4300a640cca96e4fd327cf8523525769fafc898a6af65ed7ef", 0x2b, 0x3}]) [ 918.453395] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 918.455370] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 918.462811] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 918.468205] caif:caif_disconnect_client(): nothing to disconnect [ 918.483916] protocol 88fb is buggy, dev hsr_slave_0 [ 918.483955] protocol 88fb is buggy, dev hsr_slave_1 [ 918.532098] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 918.540119] chnl_net:chnl_net_open(): state disconnected [ 918.545657] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 918.560689] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 918.569134] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 918.570356] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env 07:11:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 918.575677] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready [ 918.582672] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 918.588225] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 918.603812] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 918.617255] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready 07:11:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 918.627151] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 918.634383] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 918.641187] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 918.651400] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 918.663023] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready [ 918.669350] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 918.680143] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 918.687827] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 918.694530] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 918.700961] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 918.714705] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready 07:11:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 918.735244] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 918.742727] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready [ 918.749723] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 918.757055] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 918.763230] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 918.774318] 8021q: adding VLAN 0 to HW filter on device bond0 [ 918.783455] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 918.789745] 8021q: adding VLAN 0 to HW filter on device team0 [ 918.792668] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 918.799070] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 918.804136] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 918.809252] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 918.826631] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 918.834934] caif:caif_disconnect_client(): nothing to disconnect [ 918.862098] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 918.870112] chnl_net:chnl_net_open(): state disconnected [ 918.875669] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 918.890427] protocol 88fb is buggy, dev hsr_slave_0 [ 918.890456] protocol 88fb is buggy, dev hsr_slave_1 [ 918.918071] kobject: 'loop5' (00000000e762f399): kobject_uevent_env [ 918.924657] kobject: 'loop5' (00000000e762f399): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 919.202101] protocol 88fb is buggy, dev hsr_slave_0 [ 919.207220] protocol 88fb is buggy, dev hsr_slave_1 [ 919.234923] bridge0: port 3(gretap0) entered disabled state [ 921.907625] kobject: 'nr0' (00000000973affae): kobject_add_internal: parent: 'net', set: 'devices' [ 921.920903] kobject: 'nr0' (00000000973affae): kobject_uevent_env [ 921.928531] kobject: 'nr0' (00000000973affae): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 921.937751] kobject: 'queues' (0000000005243d96): kobject_add_internal: parent: 'nr0', set: '' [ 921.947196] kobject: 'queues' (0000000005243d96): kobject_uevent_env [ 921.953761] kobject: 'queues' (0000000005243d96): kobject_uevent_env: filter function caused the event to drop! [ 921.964051] kobject: 'rx-0' (0000000064de6b26): kobject_add_internal: parent: 'queues', set: 'queues' [ 921.973495] kobject: 'rx-0' (0000000064de6b26): kobject_uevent_env [ 921.979831] kobject: 'rx-0' (0000000064de6b26): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 921.990112] kobject: 'tx-0' (00000000fbdb4727): kobject_add_internal: parent: 'queues', set: 'queues' [ 921.999571] kobject: 'tx-0' (00000000fbdb4727): kobject_uevent_env [ 922.006016] kobject: 'tx-0' (00000000fbdb4727): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 922.017351] kobject: 'rx-0' (0000000064de6b26): kobject_cleanup, parent 0000000005243d96 [ 922.025630] kobject: 'rx-0' (0000000064de6b26): auto cleanup 'remove' event [ 922.032762] kobject: 'rx-0' (0000000064de6b26): kobject_uevent_env [ 922.039135] kobject: 'rx-0' (0000000064de6b26): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 922.049358] kobject: 'rx-0' (0000000064de6b26): auto cleanup kobject_del [ 922.056419] kobject: 'rx-0' (0000000064de6b26): calling ktype release [ 922.063068] kobject: 'rx-0': free name [ 922.067018] kobject: 'tx-0' (00000000fbdb4727): kobject_cleanup, parent 0000000005243d96 [ 922.075262] kobject: 'tx-0' (00000000fbdb4727): auto cleanup 'remove' event [ 922.082528] kobject: 'tx-0' (00000000fbdb4727): kobject_uevent_env [ 922.088867] kobject: 'tx-0' (00000000fbdb4727): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 922.099097] kobject: 'tx-0' (00000000fbdb4727): auto cleanup kobject_del [ 922.105990] kobject: 'tx-0' (00000000fbdb4727): calling ktype release [ 922.112583] kobject: 'tx-0': free name [ 922.116480] kobject: 'queues' (0000000005243d96): kobject_cleanup, parent (null) [ 922.124949] kobject: 'queues' (0000000005243d96): calling ktype release [ 922.131716] kobject: 'queues' (0000000005243d96): kset_release [ 922.137703] kobject: 'queues': free name [ 922.141966] kobject: 'nr0' (00000000973affae): kobject_uevent_env [ 922.148483] kobject: 'nr0' (00000000973affae): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 922.157764] kobject: 'nr0' (00000000d1e35e64): kobject_cleanup, parent (null) [ 922.167173] kobject: 'nr0' (00000000d1e35e64): calling ktype release [ 922.175949] kobject: 'nr0': free name [ 922.189704] kobject: 'loop0' (0000000014568201): kobject_uevent_env [ 922.192110] kobject: 'nr0' (00000000973affae): kobject_cleanup, parent (null) 07:11:10 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r5, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10800220}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x28, r6, 0x200, 0x70bd2b, 0x25dfdbfd, {{}, {}, {0x0, 0x14, 'broadcast-link\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x4040) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:11:10 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:11:10 executing program 1: socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:11:10 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_read_part_table(0x0, 0x5, &(0x7f0000000340)=[{&(0x7f0000000000)="a3d68b85c7495e4d26fa2481b928bce7dabfbfb7f7ec7b7b0d7f062c3bfdc656828863b9076e292add", 0xb, 0xfff}, {&(0x7f0000000040)="463d2c5d781da22a272900faee084272996cf436ac0f20b85b8d2dcac1bd7d4d9ba0630c81a61a74b4b0564ff663799477ca55ebbfa134ff6cc613e4de92542cede8aa284abcbb97d2a30853851489f0f38962139c88388521434d8c993bdd7d8fee306b9d591c87e9661c58bb568d1c6a22850afe52bb18f64b04c3013d150c3d52486a2d4e24b35920a5a4370f71edfd14540204127c56ffd1cd438f8da1e9347016588e8b677128f2c9da84f26127fdf90ecd7efe9f8de722cd63d4749eb3c0516765fc4dd9f00b95e7347b29f68f8884d51ddbc6975d14754426a4f3c39ef40325f6bee9eb6b855194e37c85ec1f5bfe45562916d6f8b6", 0xf9, 0x10000}, {&(0x7f0000000640)="79025d43ab52dce7d1fd5cecedebcb236648fe7fc88dd446e50a1ebcb7dd921d6907057aa3403615cdfb7c32c96a2c0b4a38ea043380b734d9882b99ad1a4fe1af6baeb141ca581d01f0a07bc7e979e9f808df4ac5b44967854c14474f66b319d64eddb36eb010c748511a458182b65a9e7087af4902fa286671695f7d12dd9e81b76b7f9ebd9f2d7399112c833790b524356edbd5d03431d530050000000000000035cab1e481f8891679ec6a0d591fcc9d415006e55fa4d626e6e183eb34b04d82cc5a6042a0609e3aeef5a4516330f3c14073319f847a53e83e78e5a273f49a4c65131819db2625d111b5c4f780ac32", 0xbf, 0x9}, {&(0x7f0000000240)="6c7124450889222be73e645df7fb4cbb07ef4ad275d157e703cb2795866a0e4c8179cad9889535f8ce2bac77a79ceb54bdd80567e65bb31da3305164c7ca3a5a968724391aa429ebc34124658040ffbd611585f1f02fa3b39ab6dad7db1febebf29f8080740e27a54671268274ecde4a62735556b9e8d2a850835dfe6cca3d3d920a0e97921c2219672016a123fdb250775dd5e2f4f5dc328941", 0x9a, 0x1000}, {&(0x7f0000000300)="665971203bde6ff22972a8743d855b45179c4300a640cca96e4fd327cf8523525769fafc898a6af65ed7ef", 0x2b, 0x3}]) 07:11:10 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:11:10 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r3, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r4, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r5, 0x200004) sendfile(r1, r5, 0x0, 0x80001d00c0d0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 922.204824] kobject: 'nr0' (00000000973affae): calling ktype release [ 922.205027] kobject: 'loop0' (0000000014568201): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 922.211423] kobject: 'nr0': free name [ 922.223531] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 922.231309] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 922.246245] kobject: 'loop3' (000000007e58d161): kobject_uevent_env [ 922.281928] kobject: 'loop3' (000000007e58d161): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 922.293146] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready [ 922.294938] kobject: 'loop4' (000000001ef93463): kobject_uevent_env [ 922.311000] kobject: 'loop4' (000000001ef93463): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 922.312849] IPv6: ADDRCONF(NETDEV_UP): tunl0: link is not ready 07:11:10 executing program 1: socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 922.328154] IPv6: ADDRCONF(NETDEV_UP): gre0: link is not ready [ 922.344780] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 922.348764] IPv6: ADDRCONF(NETDEV_UP): gretap0: link is not ready [ 922.357667] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 922.360181] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' 07:11:10 executing program 1: socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 922.367585] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 922.388575] IPv6: ADDRCONF(NETDEV_UP): erspan0: link is not ready [ 922.397444] IPv6: ADDRCONF(NETDEV_UP): ip_vti0: link is not ready [ 922.405147] IPv6: ADDRCONF(NETDEV_UP): ip6_vti0: link is not ready [ 922.412238] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 922.426092] IPv6: ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready 07:11:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) [ 922.446272] IPv6: ADDRCONF(NETDEV_UP): ip6gre0: link is not ready [ 922.453478] IPv6: ADDRCONF(NETDEV_UP): syz_tun: link is not ready [ 922.461595] IPv6: ADDRCONF(NETDEV_UP): ip6gretap0: link is not ready [ 922.469144] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 922.475708] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 922.476469] IPv6: ADDRCONF(NETDEV_UP): vcan0: link is not ready 07:11:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) [ 922.484644] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 922.489043] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 922.526683] 8021q: adding VLAN 0 to HW filter on device bond0 [ 922.534646] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 922.540870] 8021q: adding VLAN 0 to HW filter on device team0 07:11:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) [ 922.544653] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 922.548974] IPv6: ADDRCONF(NETDEV_UP): dummy0: link is not ready [ 922.558406] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 922.560345] IPv6: ADDRCONF(NETDEV_UP): nlmon0: link is not ready [ 922.575760] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 922.585076] caif:caif_disconnect_client(): nothing to disconnect [ 922.598988] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 922.607886] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 922.616296] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 922.625746] chnl_net:chnl_net_open(): state disconnected [ 922.632588] net_ratelimit: 6 callbacks suppressed 07:11:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) [ 922.632597] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 922.650057] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 922.652242] protocol 88fb is buggy, dev hsr_slave_0 [ 922.660410] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 922.663704] protocol 88fb is buggy, dev hsr_slave_1 [ 922.686409] kobject: 'nr0' (00000000a626965a): kobject_add_internal: parent: 'net', set: 'devices' [ 922.701454] kobject: 'nr0' (00000000a626965a): kobject_uevent_env [ 922.708374] kobject: 'nr0' (00000000a626965a): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 922.719373] kobject: 'queues' (00000000dd1848b1): kobject_add_internal: parent: 'nr0', set: '' [ 922.722564] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 922.729968] kobject: 'queues' (00000000dd1848b1): kobject_uevent_env [ 922.735587] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 922.744255] kobject: 'queues' (00000000dd1848b1): kobject_uevent_env: filter function caused the event to drop! [ 922.764972] kobject: 'rx-0' (0000000056a9e562): kobject_add_internal: parent: 'queues', set: 'queues' [ 922.774788] kobject: 'rx-0' (0000000056a9e562): kobject_uevent_env [ 922.781191] kobject: 'rx-0' (0000000056a9e562): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 922.791584] kobject: 'tx-0' (0000000045bdad9f): kobject_add_internal: parent: 'queues', set: 'queues' [ 922.801267] kobject: 'tx-0' (0000000045bdad9f): kobject_uevent_env [ 922.807747] kobject: 'tx-0' (0000000045bdad9f): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 922.818775] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 922.829291] kobject: 'nr0' (00000000feec4be9): kobject_add_internal: parent: 'net', set: 'devices' [ 922.836057] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 922.843954] kobject: 'nr0' (00000000feec4be9): kobject_uevent_env [ 922.850819] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 922.851413] kobject: 'nr0' (00000000feec4be9): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 922.874123] kobject: 'loop5' (00000000e762f399): kobject_uevent_env [ 922.874774] kobject: 'queues' (0000000098e1886e): kobject_add_internal: parent: 'nr0', set: '' [ 922.881258] kobject: 'loop5' (00000000e762f399): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 922.896666] kobject: 'queues' (0000000098e1886e): kobject_uevent_env [ 922.906441] kobject: 'queues' (0000000098e1886e): kobject_uevent_env: filter function caused the event to drop! [ 922.917180] kobject: 'rx-0' (000000003152a5e6): kobject_add_internal: parent: 'queues', set: 'queues' [ 922.926797] kobject: 'rx-0' (000000003152a5e6): kobject_uevent_env [ 922.933157] kobject: 'rx-0' (000000003152a5e6): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 922.943525] kobject: 'tx-0' (00000000fbb958dd): kobject_add_internal: parent: 'queues', set: 'queues' [ 922.953007] kobject: 'tx-0' (00000000fbb958dd): kobject_uevent_env [ 922.959353] kobject: 'tx-0' (00000000fbb958dd): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 922.970220] device nr0 entered promiscuous mode [ 922.977585] device nr0 entered promiscuous mode [ 922.986277] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 922.995542] caif:caif_disconnect_client(): nothing to disconnect [ 923.032085] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 923.040031] chnl_net:chnl_net_open(): state disconnected [ 923.045576] protocol 88fb is buggy, dev hsr_slave_0 [ 923.045638] protocol 88fb is buggy, dev hsr_slave_1 [ 923.055864] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 923.084561] kobject: 'loop0' (0000000014568201): kobject_uevent_env [ 923.091170] kobject: 'loop0' (0000000014568201): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 923.153059] kobject: 'rx-0' (0000000056a9e562): kobject_cleanup, parent 00000000dd1848b1 [ 923.161301] kobject: 'rx-0' (0000000056a9e562): auto cleanup 'remove' event [ 923.168732] kobject: 'rx-0' (0000000056a9e562): kobject_uevent_env [ 923.175154] kobject: 'rx-0' (0000000056a9e562): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 923.185414] kobject: 'rx-0' (0000000056a9e562): auto cleanup kobject_del [ 923.192402] kobject: 'rx-0' (0000000056a9e562): calling ktype release [ 923.198976] kobject: 'rx-0': free name [ 923.202931] kobject: 'tx-0' (0000000045bdad9f): kobject_cleanup, parent 00000000dd1848b1 [ 923.211150] kobject: 'tx-0' (0000000045bdad9f): auto cleanup 'remove' event [ 923.218264] kobject: 'tx-0' (0000000045bdad9f): kobject_uevent_env [ 923.224624] kobject: 'tx-0' (0000000045bdad9f): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 923.234827] kobject: 'tx-0' (0000000045bdad9f): auto cleanup kobject_del [ 923.241731] kobject: 'tx-0' (0000000045bdad9f): calling ktype release [ 923.248330] kobject: 'tx-0': free name [ 923.252278] kobject: 'queues' (00000000dd1848b1): kobject_cleanup, parent (null) [ 923.260674] kobject: 'queues' (00000000dd1848b1): calling ktype release [ 923.267722] kobject: 'queues' (00000000dd1848b1): kset_release [ 923.273723] kobject: 'queues': free name [ 923.277983] kobject: 'nr0' (00000000a626965a): kobject_uevent_env [ 923.284345] kobject: 'nr0' (00000000a626965a): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 923.295809] kobject: 'rx-0' (000000003152a5e6): kobject_cleanup, parent 0000000098e1886e [ 923.304312] kobject: 'rx-0' (000000003152a5e6): auto cleanup 'remove' event [ 923.311481] kobject: 'rx-0' (000000003152a5e6): kobject_uevent_env [ 923.317914] kobject: 'rx-0' (000000003152a5e6): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 923.328213] kobject: 'rx-0' (000000003152a5e6): auto cleanup kobject_del [ 923.335139] kobject: 'rx-0' (000000003152a5e6): calling ktype release [ 923.341754] kobject: 'rx-0': free name [ 923.345790] kobject: 'tx-0' (00000000fbb958dd): kobject_cleanup, parent 0000000098e1886e [ 923.354099] kobject: 'tx-0' (00000000fbb958dd): auto cleanup 'remove' event [ 923.361218] kobject: 'tx-0' (00000000fbb958dd): kobject_uevent_env [ 923.362081] protocol 88fb is buggy, dev hsr_slave_0 [ 923.367602] kobject: 'tx-0' (00000000fbb958dd): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 923.372607] protocol 88fb is buggy, dev hsr_slave_1 [ 923.382782] kobject: 'tx-0' (00000000fbb958dd): auto cleanup kobject_del [ 923.395533] kobject: 'tx-0' (00000000fbb958dd): calling ktype release [ 923.402142] kobject: 'tx-0': free name [ 923.406033] kobject: 'queues' (0000000098e1886e): kobject_cleanup, parent (null) [ 923.414449] kobject: 'queues' (0000000098e1886e): calling ktype release [ 923.421199] kobject: 'queues' (0000000098e1886e): kset_release [ 923.427201] kobject: 'queues': free name [ 923.431450] kobject: 'nr0' (00000000feec4be9): kobject_uevent_env [ 923.437858] kobject: 'nr0' (00000000feec4be9): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 923.447724] kobject: 'nr0' (00000000a626965a): kobject_cleanup, parent (null) [ 923.456013] kobject: 'nr0' (00000000a626965a): calling ktype release [ 923.462624] kobject: 'nr0': free name [ 923.482134] kobject: 'nr0' (00000000feec4be9): kobject_cleanup, parent (null) [ 923.490391] kobject: 'nr0' (00000000feec4be9): calling ktype release [ 923.498126] kobject: 'nr0': free name [ 923.503084] kobject: 'nr0' (000000000055eade): kobject_add_internal: parent: 'net', set: 'devices' [ 923.513231] kobject: 'nr0' (000000000055eade): kobject_uevent_env [ 923.519587] kobject: 'nr0' (000000000055eade): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 923.528823] kobject: 'queues' (00000000a3017f46): kobject_add_internal: parent: 'nr0', set: '' [ 923.538243] kobject: 'queues' (00000000a3017f46): kobject_uevent_env [ 923.544905] kobject: 'queues' (00000000a3017f46): kobject_uevent_env: filter function caused the event to drop! [ 923.560283] kobject: 'rx-0' (00000000dd21acf8): kobject_add_internal: parent: 'queues', set: 'queues' [ 923.569952] kobject: 'rx-0' (00000000dd21acf8): kobject_uevent_env [ 923.581387] kobject: 'rx-0' (00000000dd21acf8): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 923.591728] kobject: 'tx-0' (00000000f1fe007e): kobject_add_internal: parent: 'queues', set: 'queues' [ 923.605380] kobject: 'tx-0' (00000000f1fe007e): kobject_uevent_env [ 923.611805] kobject: 'tx-0' (00000000f1fe007e): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 923.624961] device nr0 entered promiscuous mode [ 923.631128] kobject: 'nr0' (00000000b67706f5): kobject_add_internal: parent: 'net', set: 'devices' [ 923.640844] kobject: 'nr0' (00000000b67706f5): kobject_uevent_env [ 923.648092] kobject: 'nr0' (00000000b67706f5): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 923.657470] kobject: 'queues' (0000000024e20071): kobject_add_internal: parent: 'nr0', set: '' [ 923.667007] kobject: 'queues' (0000000024e20071): kobject_uevent_env [ 923.673558] kobject: 'queues' (0000000024e20071): kobject_uevent_env: filter function caused the event to drop! [ 923.683816] kobject: 'rx-0' (0000000093754cc9): kobject_add_internal: parent: 'queues', set: 'queues' [ 923.693278] kobject: 'rx-0' (0000000093754cc9): kobject_uevent_env [ 923.699617] kobject: 'rx-0' (0000000093754cc9): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 923.709877] kobject: 'tx-0' (0000000027572ed6): kobject_add_internal: parent: 'queues', set: 'queues' [ 923.719363] kobject: 'tx-0' (0000000027572ed6): kobject_uevent_env [ 923.725742] kobject: 'tx-0' (0000000027572ed6): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 923.737078] kobject: 'rx-0' (0000000093754cc9): kobject_cleanup, parent 0000000024e20071 [ 923.745377] kobject: 'rx-0' (0000000093754cc9): auto cleanup 'remove' event [ 923.752506] kobject: 'rx-0' (0000000093754cc9): kobject_uevent_env [ 923.758843] kobject: 'rx-0' (0000000093754cc9): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 923.769215] kobject: 'rx-0' (0000000093754cc9): auto cleanup kobject_del [ 923.776128] kobject: 'rx-0' (0000000093754cc9): calling ktype release [ 923.782832] kobject: 'rx-0': free name [ 923.786748] kobject: 'tx-0' (0000000027572ed6): kobject_cleanup, parent 0000000024e20071 [ 923.795010] kobject: 'tx-0' (0000000027572ed6): auto cleanup 'remove' event [ 923.802146] kobject: 'tx-0' (0000000027572ed6): kobject_uevent_env [ 923.808485] kobject: 'tx-0' (0000000027572ed6): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 923.818708] kobject: 'tx-0' (0000000027572ed6): auto cleanup kobject_del [ 923.825591] kobject: 'tx-0' (0000000027572ed6): calling ktype release [ 923.832202] kobject: 'tx-0': free name [ 923.836097] kobject: 'queues' (0000000024e20071): kobject_cleanup, parent (null) [ 923.844636] kobject: 'queues' (0000000024e20071): calling ktype release [ 923.851392] kobject: 'queues' (0000000024e20071): kset_release [ 923.857380] kobject: 'queues': free name [ 923.861688] kobject: 'nr0' (00000000b67706f5): kobject_uevent_env [ 923.868078] kobject: 'nr0' (00000000b67706f5): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 923.940922] kobject: 'rx-0' (00000000dd21acf8): kobject_cleanup, parent 00000000a3017f46 [ 923.949259] kobject: 'rx-0' (00000000dd21acf8): auto cleanup 'remove' event [ 923.956428] kobject: 'rx-0' (00000000dd21acf8): kobject_uevent_env [ 923.962840] kobject: 'rx-0' (00000000dd21acf8): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 923.973079] kobject: 'rx-0' (00000000dd21acf8): auto cleanup kobject_del [ 923.979974] kobject: 'rx-0' (00000000dd21acf8): calling ktype release [ 923.986591] kobject: 'rx-0': free name [ 923.990499] kobject: 'tx-0' (00000000f1fe007e): kobject_cleanup, parent 00000000a3017f46 [ 923.998746] kobject: 'tx-0' (00000000f1fe007e): auto cleanup 'remove' event [ 924.005889] kobject: 'tx-0' (00000000f1fe007e): kobject_uevent_env [ 924.012268] kobject: 'tx-0' (00000000f1fe007e): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-0' [ 924.022509] kobject: 'tx-0' (00000000f1fe007e): auto cleanup kobject_del [ 924.029373] kobject: 'tx-0' (00000000f1fe007e): calling ktype release [ 924.036011] kobject: 'tx-0': free name [ 924.039905] kobject: 'queues' (00000000a3017f46): kobject_cleanup, parent (null) [ 924.048452] kobject: 'queues' (00000000a3017f46): calling ktype release [ 924.055229] kobject: 'queues' (00000000a3017f46): kset_release [ 924.061200] kobject: 'queues': free name [ 924.065570] kobject: 'nr0' (000000000055eade): kobject_uevent_env [ 924.071910] kobject: 'nr0' (000000000055eade): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 924.081238] kobject: 'nr0' (00000000b67706f5): kobject_cleanup, parent (null) 07:11:12 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) syz_read_part_table(0x0, 0x5, &(0x7f0000000340)=[{&(0x7f0000000000)="a3d68b85c7495e4d26fa2481b928bce7dabfbfb7f7ec7b7b0d7f062c3bfdc656828863b9076e292add", 0xb, 0xfff}, {&(0x7f0000000040)="463d2c5d781da22a272900faee084272996cf436ac0f20b85b8d2dcac1bd7d4d9ba0630c81a61a74b4b0564ff663799477ca55ebbfa134ff6cc613e4de92542cede8aa284abcbb97d2a30853851489f0f38962139c88388521434d8c993bdd7d8fee306b9d591c87e9661c58bb568d1c6a22850afe52bb18f64b04c3013d150c3d52486a2d4e24b35920a5a4370f71edfd14540204127c56ffd1cd438f8da1e9347016588e8b677128f2c9da84f26127fdf90ecd7efe9f8de722cd63d4749eb3c0516765fc4dd9f00b95e7347b29f68f8884d51ddbc6975d14754426a4f3c39ef40325f6bee9eb6b855194e37c85ec1f5bfe45562916d6f8b6", 0xf9, 0x10000}, {&(0x7f0000000640)="79025d43ab52dce7d1fd5cecedebcb236648fe7fc88dd446e50a1ebcb7dd921d6907057aa3403615cdfb7c32c96a2c0b4a38ea043380b734d9882b99ad1a4fe1af6baeb141ca581d01f0a07bc7e979e9f808df4ac5b44967854c14474f66b319d64eddb36eb010c748511a458182b65a9e7087af4902fa286671695f7d12dd9e81b76b7f9ebd9f2d7399112c833790b524356edbd5d03431d530050000000000000035cab1e481f8891679ec6a0d591fcc9d415006e55fa4d626e6e183eb34b04d82cc5a6042a0609e3aeef5a4516330f3c14073319f847a53e83e78e5a273f49a4c65131819db2625d111b5c4f780ac32", 0xbf, 0x9}, {&(0x7f0000000240)="6c7124450889222be73e645df7fb4cbb07ef4ad275d157e703cb2795866a0e4c8179cad9889535f8ce2bac77a79ceb54bdd80567e65bb31da3305164c7ca3a5a968724391aa429ebc34124658040ffbd611585f1f02fa3b39ab6dad7db1febebf29f8080740e27a54671268274ecde4a62735556b9e8d2a850835dfe6cca3d3d920a0e97921c2219672016a123fdb250775dd5e2f4f5dc328941", 0x9a, 0x1000}, {&(0x7f0000000300)="665971203bde6ff22972a8743d855b45179c4300a640cca96e4fd327cf8523525769fafc898a6af65ed7ef", 0x2b, 0x3}]) 07:11:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 07:11:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) 07:11:12 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 07:11:12 executing program 4: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x0, 0x5f) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x32d7, 0x4000a0) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000400)=ANY=[@ANYBLOB="3f0000000000000002004e22ac1e0101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002004e23000000000000000000000000000000000000000000000000000000000000000000000000f7007f3ce8500df200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000045357bd46ef2a1ca0a2430ffd62be3b900000000"], 0x110) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0xc0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) [ 924.089748] kobject: 'nr0' (00000000b67706f5): calling ktype release [ 924.096378] kobject: 'nr0': free name [ 924.125094] kobject: 'loop4' (000000001ef93463): kobject_uevent_env [ 924.128418] kobject: 'nr0' (000000000055eade): kobject_cleanup, parent (null) [ 924.132076] kobject: 'loop4' (000000001ef93463): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 924.146678] netlink: 'syz-executor.5': attribute type 16 has an invalid length. [ 924.162978] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 924.165174] kobject: 'nr0' (000000000055eade): calling ktype release [ 924.176876] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 924.199989] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 924.207783] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 924.208558] kobject: 'nr0': free name 07:11:12 executing program 3: ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x400000000803, 0x5f) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2200}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0xb8, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xa4, 0x5, [@TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10a45676}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xccbf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe813}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x90000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x97f8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x10}, 0x5508f1d0a2e112a9) close(r1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r4 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002012, r4, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) faccessat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r5, 0x80045006, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x210000) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xccf82b8c3d0385e2, 0x0) ftruncate(r6, 0x200004) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r6, 0x0, 0x80001d00c0d0) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x82000, 0x0) ioctl$VIDIOC_OVERLAY(r7, 0x4004560e, &(0x7f00000001c0)=0x1aee) socket$nl_netfilter(0x10, 0x3, 0xc) 07:11:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 07:11:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 924.246802] kobject: 'loop5' (00000000e762f399): kobject_uevent_env [ 924.259539] kobject: 'loop5' (00000000e762f399): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 924.286452] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env 07:11:12 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) syz_read_part_table(0x0, 0x5, &(0x7f0000000340)=[{&(0x7f0000000000)="a3d68b85c7495e4d26fa2481b928bce7dabfbfb7f7ec7b7b0d7f062c3bfdc656828863b9076e292add", 0xb, 0xfff}, {&(0x7f0000000040)="463d2c5d781da22a272900faee084272996cf436ac0f20b85b8d2dcac1bd7d4d9ba0630c81a61a74b4b0564ff663799477ca55ebbfa134ff6cc613e4de92542cede8aa284abcbb97d2a30853851489f0f38962139c88388521434d8c993bdd7d8fee306b9d591c87e9661c58bb568d1c6a22850afe52bb18f64b04c3013d150c3d52486a2d4e24b35920a5a4370f71edfd14540204127c56ffd1cd438f8da1e9347016588e8b677128f2c9da84f26127fdf90ecd7efe9f8de722cd63d4749eb3c0516765fc4dd9f00b95e7347b29f68f8884d51ddbc6975d14754426a4f3c39ef40325f6bee9eb6b855194e37c85ec1f5bfe45562916d6f8b6", 0xf9, 0x10000}, {&(0x7f0000000640)="79025d43ab52dce7d1fd5cecedebcb236648fe7fc88dd446e50a1ebcb7dd921d6907057aa3403615cdfb7c32c96a2c0b4a38ea043380b734d9882b99ad1a4fe1af6baeb141ca581d01f0a07bc7e979e9f808df4ac5b44967854c14474f66b319d64eddb36eb010c748511a458182b65a9e7087af4902fa286671695f7d12dd9e81b76b7f9ebd9f2d7399112c833790b524356edbd5d03431d530050000000000000035cab1e481f8891679ec6a0d591fcc9d415006e55fa4d626e6e183eb34b04d82cc5a6042a0609e3aeef5a4516330f3c14073319f847a53e83e78e5a273f49a4c65131819db2625d111b5c4f780ac32", 0xbf, 0x9}, {&(0x7f0000000240)="6c7124450889222be73e645df7fb4cbb07ef4ad275d157e703cb2795866a0e4c8179cad9889535f8ce2bac77a79ceb54bdd80567e65bb31da3305164c7ca3a5a968724391aa429ebc34124658040ffbd611585f1f02fa3b39ab6dad7db1febebf29f8080740e27a54671268274ecde4a62735556b9e8d2a850835dfe6cca3d3d920a0e97921c2219672016a123fdb250775dd5e2f4f5dc328941", 0x9a, 0x1000}, {&(0x7f0000000300)="665971203bde6ff22972a8743d855b45179c4300a640cca96e4fd327cf8523525769fafc898a6af65ed7ef", 0x2b, 0x3}]) [ 924.297420] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 924.336770] kobject: 'loop3' (000000007e58d161): kobject_uevent_env 07:11:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) [ 924.356583] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 924.360871] kobject: 'loop3' (000000007e58d161): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 924.375602] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 924.395093] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env 07:11:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) [ 924.402850] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 924.472455] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 924.479111] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' 07:11:13 executing program 2: syz_read_part_table(0x0, 0x5, &(0x7f0000000340)=[{&(0x7f0000000000)="a3d68b85c7495e4d26fa2481b928bce7dabfbfb7f7ec7b7b0d7f062c3bfdc656828863b9076e292add", 0xb, 0xfff}, {&(0x7f0000000040)="463d2c5d781da22a272900faee084272996cf436ac0f20b85b8d2dcac1bd7d4d9ba0630c81a61a74b4b0564ff663799477ca55ebbfa134ff6cc613e4de92542cede8aa284abcbb97d2a30853851489f0f38962139c88388521434d8c993bdd7d8fee306b9d591c87e9661c58bb568d1c6a22850afe52bb18f64b04c3013d150c3d52486a2d4e24b35920a5a4370f71edfd14540204127c56ffd1cd438f8da1e9347016588e8b677128f2c9da84f26127fdf90ecd7efe9f8de722cd63d4749eb3c0516765fc4dd9f00b95e7347b29f68f8884d51ddbc6975d14754426a4f3c39ef40325f6bee9eb6b855194e37c85ec1f5bfe45562916d6f8b6", 0xf9, 0x10000}, {&(0x7f0000000640)="79025d43ab52dce7d1fd5cecedebcb236648fe7fc88dd446e50a1ebcb7dd921d6907057aa3403615cdfb7c32c96a2c0b4a38ea043380b734d9882b99ad1a4fe1af6baeb141ca581d01f0a07bc7e979e9f808df4ac5b44967854c14474f66b319d64eddb36eb010c748511a458182b65a9e7087af4902fa286671695f7d12dd9e81b76b7f9ebd9f2d7399112c833790b524356edbd5d03431d530050000000000000035cab1e481f8891679ec6a0d591fcc9d415006e55fa4d626e6e183eb34b04d82cc5a6042a0609e3aeef5a4516330f3c14073319f847a53e83e78e5a273f49a4c65131819db2625d111b5c4f780ac32", 0xbf, 0x9}, {&(0x7f0000000240)="6c7124450889222be73e645df7fb4cbb07ef4ad275d157e703cb2795866a0e4c8179cad9889535f8ce2bac77a79ceb54bdd80567e65bb31da3305164c7ca3a5a968724391aa429ebc34124658040ffbd611585f1f02fa3b39ab6dad7db1febebf29f8080740e27a54671268274ecde4a62735556b9e8d2a850835dfe6cca3d3d920a0e97921c2219672016a123fdb250775dd5e2f4f5dc328941", 0x9a, 0x1000}, {&(0x7f0000000300)="665971203bde6ff22972a8743d855b45179c4300a640cca96e4fd327cf8523525769fafc898a6af65ed7ef", 0x2b, 0x3}]) 07:11:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) [ 924.538433] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 924.548273] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 924.564913] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 924.571575] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' 07:11:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 924.584356] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 924.591990] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' 07:11:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff79, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffffc3}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x8, 0x10, 0x5}]}, 0x30}}, 0x0) [ 924.642404] kobject: 'loop2' (00000000245e4df2): kobject_uevent_env [ 924.650116] kobject: 'loop2' (00000000245e4df2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 924.722390] protocol 88fb is buggy, dev hsr_slave_0 [ 924.727505] protocol 88fb is buggy, dev hsr_slave_1 [ 924.736363] kobject: 'loop1' (000000005a9ed8b9): kobject_uevent_env [ 924.744099] kobject: 'loop1' (000000005a9ed8b9): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 924.766766] bridge0: port 3(gretap0) entered disabled state [ 925.436264] kobject: 'nr0' (000000008236cd64): kobject_add_internal: parent: 'net', set: 'devices' [ 925.446565] kobject: 'nr0' (000000008236cd64): kobject_uevent_env [ 925.452969] kobject: 'nr0' (000000008236cd64): fill_kobj_path: path = '/devices/virtual/net/nr0' [ 925.462184] kobject: 'queues' (00000000b3c7e8fc): kobject_add_internal: parent: 'nr0', set: '' [ 925.471558] kobject: 'queues' (00000000b3c7e8fc): kobject_uevent_env [ 925.478081] kobject: 'queues' (00000000b3c7e8fc): kobject_uevent_env: filter function caused the event to drop! [ 925.488372] kobject: 'rx-0' (000000007cdcca65): kobject_add_internal: parent: 'queues', set: 'queues' [ 925.497870] kobject: 'rx-0' (000000007cdcca65): kobject_uevent_env [ 925.504413] kobject: 'rx-0' (000000007cdcca65): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-0' [ 925.514645] kobject: 'tx-0' (00000000568eedda): kobject_add_internal: parent: 'queues', set: 'queues' [ 925.524153] kobject: 'tx-0' (00000000568eedda): kobject_uevent_env