0370] loop1: p61 start 10 is beyond EOD, truncated [ 1086.356317][T10370] loop1: p62 start 10 is beyond EOD, truncated [ 1086.362496][T10370] loop1: p63 start 10 is beyond EOD, truncated [ 1086.368779][T10370] loop1: p64 start 10 is beyond EOD, truncated [ 1086.375060][T10370] loop1: p65 start 10 is beyond EOD, truncated [ 1086.381216][T10370] loop1: p66 start 10 is beyond EOD, truncated [ 1086.387457][T10370] loop1: p67 start 10 is beyond EOD, truncated [ 1086.393656][T10370] loop1: p68 start 10 is beyond EOD, truncated [ 1086.399867][T10370] loop1: p69 start 10 is beyond EOD, truncated [ 1086.406135][T10370] loop1: p70 start 10 is beyond EOD, truncated [ 1086.412311][T10370] loop1: p71 start 10 is beyond EOD, truncated [ 1086.418859][T10370] loop1: p72 start 10 is beyond EOD, truncated [ 1086.425215][T10370] loop1: p73 start 10 is beyond EOD, truncated [ 1086.431532][T10370] loop1: p74 start 10 is beyond EOD, truncated [ 1086.438193][T10370] loop1: p75 start 10 is beyond EOD, truncated [ 1086.444452][T10370] loop1: p76 start 10 is beyond EOD, truncated [ 1086.450631][T10370] loop1: p77 start 10 is beyond EOD, truncated [ 1086.458598][T10370] loop1: p78 start 10 is beyond EOD, truncated [ 1086.464887][T10370] loop1: p79 start 10 is beyond EOD, truncated [ 1086.471038][T10370] loop1: p80 start 10 is beyond EOD, truncated [ 1086.477281][T10370] loop1: p81 start 10 is beyond EOD, truncated [ 1086.483621][T10370] loop1: p82 start 10 is beyond EOD, truncated [ 1086.489977][T10370] loop1: p83 start 10 is beyond EOD, truncated [ 1086.496176][T10370] loop1: p84 start 10 is beyond EOD, truncated [ 1086.502563][T10370] loop1: p85 start 10 is beyond EOD, truncated [ 1086.508794][T10370] loop1: p86 start 10 is beyond EOD, truncated [ 1086.515253][T10370] loop1: p87 start 10 is beyond EOD, truncated [ 1086.521467][T10370] loop1: p88 start 10 is beyond EOD, truncated [ 1086.528171][T10370] loop1: p89 start 10 is beyond EOD, truncated [ 1086.534520][T10370] loop1: p90 start 10 is beyond EOD, truncated [ 1086.540683][T10370] loop1: p91 start 10 is beyond EOD, truncated [ 1086.547242][T10370] loop1: p92 start 10 is beyond EOD, truncated [ 1086.553625][T10370] loop1: p93 start 10 is beyond EOD, truncated [ 1086.559850][T10370] loop1: p94 start 10 is beyond EOD, truncated [ 1086.566078][T10370] loop1: p95 start 10 is beyond EOD, truncated [ 1086.572238][T10370] loop1: p96 start 10 is beyond EOD, truncated [ 1086.578474][T10370] loop1: p97 start 10 is beyond EOD, truncated [ 1086.584701][T10370] loop1: p98 start 10 is beyond EOD, truncated [ 1086.597351][T10370] loop1: p99 start 10 is beyond EOD, truncated [ 1086.603552][T10370] loop1: p100 start 10 is beyond EOD, truncated [ 1086.610103][T10370] loop1: p101 start 10 is beyond EOD, truncated [ 1086.620682][T10370] loop1: p102 start 10 is beyond EOD, truncated [ 1086.627058][T10370] loop1: p103 start 10 is beyond EOD, truncated [ 1086.633341][T10370] loop1: p104 start 10 is beyond EOD, truncated [ 1086.640189][T10370] loop1: p105 start 10 is beyond EOD, truncated [ 1086.646585][T10370] loop1: p106 start 10 is beyond EOD, truncated [ 1086.652824][T10370] loop1: p107 start 10 is beyond EOD, truncated [ 1086.659514][T10370] loop1: p108 start 10 is beyond EOD, truncated [ 1086.665974][T10370] loop1: p109 start 10 is beyond EOD, truncated [ 1086.672258][T10370] loop1: p110 start 10 is beyond EOD, truncated [ 1086.678592][T10370] loop1: p111 start 10 is beyond EOD, truncated [ 1086.684913][T10370] loop1: p112 start 10 is beyond EOD, truncated [ 1086.691152][T10370] loop1: p113 start 10 is beyond EOD, truncated [ 1086.697660][T10370] loop1: p114 start 10 is beyond EOD, truncated [ 1086.703903][T10370] loop1: p115 start 10 is beyond EOD, truncated [ 1086.710295][T10370] loop1: p116 start 10 is beyond EOD, truncated [ 1086.716581][T10370] loop1: p117 start 10 is beyond EOD, truncated [ 1086.722917][T10370] loop1: p118 start 10 is beyond EOD, truncated [ 1086.729443][T10370] loop1: p119 start 10 is beyond EOD, truncated [ 1086.735780][T10370] loop1: p120 start 10 is beyond EOD, truncated [ 1086.742016][T10370] loop1: p121 start 10 is beyond EOD, truncated [ 1086.748740][T10370] loop1: p122 start 10 is beyond EOD, truncated [ 1086.755070][T10370] loop1: p123 start 10 is beyond EOD, truncated [ 1086.761389][T10370] loop1: p124 start 10 is beyond EOD, truncated [ 1086.768056][T10370] loop1: p125 start 10 is beyond EOD, truncated [ 1086.774365][T10370] loop1: p126 start 10 is beyond EOD, truncated [ 1086.780609][T10370] loop1: p127 start 10 is beyond EOD, truncated [ 1086.787037][T10370] loop1: p128 start 10 is beyond EOD, truncated [ 1086.793272][T10370] loop1: p129 start 10 is beyond EOD, truncated [ 1086.799606][T10370] loop1: p130 start 10 is beyond EOD, truncated [ 1086.805896][T10370] loop1: p131 start 10 is beyond EOD, truncated [ 1086.812127][T10370] loop1: p132 start 10 is beyond EOD, truncated [ 1086.818940][T10370] loop1: p133 start 10 is beyond EOD, truncated [ 1086.825257][T10370] loop1: p134 start 10 is beyond EOD, truncated [ 1086.831492][T10370] loop1: p135 start 10 is beyond EOD, truncated [ 1086.837775][T10370] loop1: p136 start 10 is beyond EOD, truncated [ 1086.844092][T10370] loop1: p137 start 10 is beyond EOD, truncated [ 1086.850325][T10370] loop1: p138 start 10 is beyond EOD, truncated [ 1086.857006][T10370] loop1: p139 start 10 is beyond EOD, truncated [ 1086.863250][T10370] loop1: p140 start 10 is beyond EOD, truncated [ 1086.869549][T10370] loop1: p141 start 10 is beyond EOD, truncated [ 1086.876265][T10370] loop1: p142 start 10 is beyond EOD, truncated [ 1086.882547][T10370] loop1: p143 start 10 is beyond EOD, truncated [ 1086.888857][T10370] loop1: p144 start 10 is beyond EOD, truncated [ 1086.895327][T10370] loop1: p145 start 10 is beyond EOD, truncated [ 1086.901585][T10370] loop1: p146 start 10 is beyond EOD, truncated [ 1086.907967][T10370] loop1: p147 start 10 is beyond EOD, truncated [ 1086.914282][T10370] loop1: p148 start 10 is beyond EOD, truncated [ 1086.920516][T10370] loop1: p149 start 10 is beyond EOD, truncated [ 1086.926832][T10370] loop1: p150 start 10 is beyond EOD, truncated [ 1086.933078][T10370] loop1: p151 start 10 is beyond EOD, truncated [ 1086.939619][T10370] loop1: p152 start 10 is beyond EOD, truncated [ 1086.945936][T10370] loop1: p153 start 10 is beyond EOD, truncated [ 1086.952317][T10370] loop1: p154 start 10 is beyond EOD, truncated [ 1086.958614][T10370] loop1: p155 start 10 is beyond EOD, truncated [ 1086.965323][T10370] loop1: p156 start 10 is beyond EOD, truncated [ 1086.971670][T10370] loop1: p157 start 10 is beyond EOD, truncated [ 1086.978304][T10370] loop1: p158 start 10 is beyond EOD, truncated [ 1086.985157][T10370] loop1: p159 start 10 is beyond EOD, truncated [ 1086.991496][T10370] loop1: p160 start 10 is beyond EOD, truncated [ 1086.997780][T10370] loop1: p161 start 10 is beyond EOD, truncated [ 1087.004131][T10370] loop1: p162 start 10 is beyond EOD, truncated [ 1087.010434][T10370] loop1: p163 start 10 is beyond EOD, truncated [ 1087.016758][T10370] loop1: p164 start 10 is beyond EOD, truncated [ 1087.023017][T10370] loop1: p165 start 10 is beyond EOD, truncated [ 1087.029323][T10370] loop1: p166 start 10 is beyond EOD, truncated [ 1087.036059][T10370] loop1: p167 start 10 is beyond EOD, truncated [ 1087.042523][T10370] loop1: p168 start 10 is beyond EOD, truncated [ 1087.048846][T10370] loop1: p169 start 10 is beyond EOD, truncated [ 1087.055133][T10370] loop1: p170 start 10 is beyond EOD, truncated [ 1087.061384][T10370] loop1: p171 start 10 is beyond EOD, truncated [ 1087.067790][T10370] loop1: p172 start 10 is beyond EOD, truncated [ 1087.074496][T10370] loop1: p173 start 10 is beyond EOD, truncated [ 1087.080743][T10370] loop1: p174 start 10 is beyond EOD, truncated [ 1087.087085][T10370] loop1: p175 start 10 is beyond EOD, truncated [ 1087.093325][T10370] loop1: p176 start 10 is beyond EOD, truncated [ 1087.100229][T10370] loop1: p177 start 10 is beyond EOD, truncated [ 1087.106577][T10370] loop1: p178 start 10 is beyond EOD, truncated [ 1087.112876][T10370] loop1: p179 start 10 is beyond EOD, truncated [ 1087.119214][T10370] loop1: p180 start 10 is beyond EOD, truncated [ 1087.125554][T10370] loop1: p181 start 10 is beyond EOD, truncated [ 1087.131795][T10370] loop1: p182 start 10 is beyond EOD, truncated [ 1087.138078][T10370] loop1: p183 start 10 is beyond EOD, truncated [ 1087.144581][T10370] loop1: p184 start 10 is beyond EOD, truncated [ 1087.150822][T10370] loop1: p185 start 10 is beyond EOD, truncated [ 1087.157280][T10370] loop1: p186 start 10 is beyond EOD, truncated [ 1087.163654][T10370] loop1: p187 start 10 is beyond EOD, truncated [ 1087.169965][T10370] loop1: p188 start 10 is beyond EOD, truncated [ 1087.176291][T10370] loop1: p189 start 10 is beyond EOD, truncated [ 1087.182523][T10370] loop1: p190 start 10 is beyond EOD, truncated [ 1087.189237][T10370] loop1: p191 start 10 is beyond EOD, truncated [ 1087.195560][T10370] loop1: p192 start 10 is beyond EOD, truncated [ 1087.201801][T10370] loop1: p193 start 10 is beyond EOD, truncated [ 1087.208563][T10370] loop1: p194 start 10 is beyond EOD, truncated [ 1087.214860][T10370] loop1: p195 start 10 is beyond EOD, truncated [ 1087.221098][T10370] loop1: p196 start 10 is beyond EOD, truncated [ 1087.227440][T10370] loop1: p197 start 10 is beyond EOD, truncated [ 1087.233682][T10370] loop1: p198 start 10 is beyond EOD, truncated [ 1087.239976][T10370] loop1: p199 start 10 is beyond EOD, truncated [ 1087.246293][T10370] loop1: p200 start 10 is beyond EOD, truncated [ 1087.252531][T10370] loop1: p201 start 10 is beyond EOD, truncated [ 1087.258861][T10370] loop1: p202 start 10 is beyond EOD, truncated [ 1087.265194][T10370] loop1: p203 start 10 is beyond EOD, truncated [ 1087.271447][T10370] loop1: p204 start 10 is beyond EOD, truncated [ 1087.277736][T10370] loop1: p205 start 10 is beyond EOD, truncated [ 1087.284048][T10370] loop1: p206 start 10 is beyond EOD, truncated [ 1087.290291][T10370] loop1: p207 start 10 is beyond EOD, truncated [ 1087.296931][T10370] loop1: p208 start 10 is beyond EOD, truncated [ 1087.303177][T10370] loop1: p209 start 10 is beyond EOD, truncated [ 1087.309496][T10370] loop1: p210 start 10 is beyond EOD, truncated [ 1087.316046][T10370] loop1: p211 start 10 is beyond EOD, truncated [ 1087.322758][T10370] loop1: p212 start 10 is beyond EOD, truncated [ 1087.329106][T10370] loop1: p213 start 10 is beyond EOD, truncated [ 1087.335414][T10370] loop1: p214 start 10 is beyond EOD, truncated [ 1087.341661][T10370] loop1: p215 start 10 is beyond EOD, truncated [ 1087.348020][T10370] loop1: p216 start 10 is beyond EOD, truncated [ 1087.354528][T10370] loop1: p217 start 10 is beyond EOD, truncated [ 1087.360797][T10370] loop1: p218 start 10 is beyond EOD, truncated [ 1087.367113][T10370] loop1: p219 start 10 is beyond EOD, truncated [ 1087.373349][T10370] loop1: p220 start 10 is beyond EOD, truncated [ 1087.379706][T10370] loop1: p221 start 10 is beyond EOD, truncated [ 1087.386039][T10370] loop1: p222 start 10 is beyond EOD, truncated [ 1087.392280][T10370] loop1: p223 start 10 is beyond EOD, truncated [ 1087.398568][T10370] loop1: p224 start 10 is beyond EOD, truncated [ 1087.405233][T10370] loop1: p225 start 10 is beyond EOD, truncated [ 1087.411870][T10370] loop1: p226 start 10 is beyond EOD, truncated [ 1087.418150][T10370] loop1: p227 start 10 is beyond EOD, truncated [ 1087.424877][T10370] loop1: p228 start 10 is beyond EOD, truncated [ 1087.431158][T10370] loop1: p229 start 10 is beyond EOD, truncated [ 1087.437435][T10370] loop1: p230 start 10 is beyond EOD, truncated [ 1087.443680][T10370] loop1: p231 start 10 is beyond EOD, truncated [ 1087.449992][T10370] loop1: p232 start 10 is beyond EOD, truncated [ 1087.456260][T10370] loop1: p233 start 10 is beyond EOD, truncated [ 1087.462496][T10370] loop1: p234 start 10 is beyond EOD, truncated [ 1087.468866][T10370] loop1: p235 start 10 is beyond EOD, truncated [ 1087.475280][T10370] loop1: p236 start 10 is beyond EOD, truncated [ 1087.481559][T10370] loop1: p237 start 10 is beyond EOD, truncated [ 1087.487975][T10370] loop1: p238 start 10 is beyond EOD, truncated [ 1087.494448][T10370] loop1: p239 start 10 is beyond EOD, truncated [ 1087.500738][T10370] loop1: p240 start 10 is beyond EOD, truncated [ 1087.507066][T10370] loop1: p241 start 10 is beyond EOD, truncated [ 1087.513301][T10370] loop1: p242 start 10 is beyond EOD, truncated [ 1087.520021][T10370] loop1: p243 start 10 is beyond EOD, truncated [ 1087.526384][T10370] loop1: p244 start 10 is beyond EOD, truncated [ 1087.532726][T10370] loop1: p245 start 10 is beyond EOD, truncated [ 1087.539374][T10370] loop1: p246 start 10 is beyond EOD, truncated [ 1087.545806][T10370] loop1: p247 start 10 is beyond EOD, truncated [ 1087.552477][T10370] loop1: p248 start 10 is beyond EOD, truncated [ 1087.558788][T10370] loop1: p249 start 10 is beyond EOD, truncated [ 1087.565625][T10370] loop1: p250 start 10 is beyond EOD, truncated [ 1087.571924][T10370] loop1: p251 start 10 is beyond EOD, truncated [ 1087.578211][T10370] loop1: p252 start 10 is beyond EOD, truncated [ 1087.584634][T10370] loop1: p253 start 10 is beyond EOD, truncated [ 1087.590915][T10370] loop1: p254 start 10 is beyond EOD, truncated [ 1087.597196][T10370] loop1: p255 start 10 is beyond EOD, truncated 10:42:19 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, 0x0, &(0x7f0000000100)) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000280)={0x1f, @none}, 0xa) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:19 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r9], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:19 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) r1 = socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) write$FUSE_DIRENTPLUS(r2, &(0x7f00000002c0)={0xc0, 0x0, 0x8, [{{0x3, 0x3, 0xffffffffffffffe0, 0x3, 0x84, 0x4, {0x0, 0xfff, 0x537c, 0x0, 0x1, 0x1, 0x9, 0xffffffda, 0x3, 0xcbba, 0xff, 0xee01}}, {0x0, 0x7fffffff, 0x15, 0x0, '/proc/self/net/pfkey\x00'}}]}, 0xc0) bind$bt_rfcomm(r2, &(0x7f0000000280)={0x1f, @none, 0x84}, 0xa) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0xff00) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, 0x0) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:19 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:19 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x2, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) [ 1087.736477][T10416] validate_nla: 5 callbacks suppressed [ 1087.736485][T10416] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1087.751836][T10413] print_req_error: 12 callbacks suppressed [ 1087.751847][T10413] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 1087.771075][ T8819] __loop_clr_fd: partition scan of loop1 failed (rc=-16) 10:42:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1087.771678][T10414] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 1087.824242][ T2634] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1087.835435][ T2634] buffer_io_error: 10 callbacks suppressed [ 1087.835444][ T2634] Buffer I/O error on dev loop1p2, logical block 0, async page read [ 1087.849897][ T2634] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1087.861128][ T2634] Buffer I/O error on dev loop1p2, logical block 0, async page read [ 1087.869464][ T2634] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1087.880571][ T2634] Buffer I/O error on dev loop1p2, logical block 0, async page read [ 1087.889195][ T2634] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1087.900210][ T2634] Buffer I/O error on dev loop1p2, logical block 0, async page read [ 1087.908585][ T2634] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1087.919646][ T2634] Buffer I/O error on dev loop1p2, logical block 0, async page read [ 1087.930282][ T2634] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1087.941307][ T2634] Buffer I/O error on dev loop1p2, logical block 0, async page read [ 1087.956152][ T2635] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1087.967184][ T2635] Buffer I/O error on dev loop1p2, logical block 0, async page read 10:42:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:19 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1087.975688][ T2635] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1087.986646][ T2635] Buffer I/O error on dev loop1p2, logical block 0, async page read [ 1087.995890][ T2635] Buffer I/O error on dev loop1p2, logical block 0, async page read [ 1088.004158][ T2635] Buffer I/O error on dev loop1p2, logical block 0, async page read 10:42:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1088.079021][T10425] debugfs: File 'dropped' in directory 'loop0' already present! [ 1088.106468][T10425] debugfs: File 'msg' in directory 'loop0' already present! 10:42:20 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) r1 = socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) write$FUSE_DIRENTPLUS(r2, &(0x7f00000002c0)={0xc0, 0x0, 0x8, [{{0x3, 0x3, 0xffffffffffffffe0, 0x3, 0x84, 0x4, {0x0, 0xfff, 0x537c, 0x0, 0x1, 0x1, 0x9, 0xffffffda, 0x3, 0xcbba, 0xff, 0xee01}}, {0x0, 0x7fffffff, 0x15, 0x0, '/proc/self/net/pfkey\x00'}}]}, 0xc0) bind$bt_rfcomm(r2, &(0x7f0000000280)={0x1f, @none, 0x84}, 0xa) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0xff00) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, 0x0) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1088.198390][T10425] debugfs: File 'trace0' in directory 'loop0' already present! 10:42:20 executing program 1: setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) dup(0xffffffffffffffff) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1088.245238][T10438] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:20 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1088.418634][T10444] debugfs: File 'dropped' in directory 'loop0' already present! [ 1088.483501][T10444] debugfs: File 'msg' in directory 'loop0' already present! [ 1088.498662][T10450] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1088.548564][T10444] debugfs: File 'trace0' in directory 'loop0' already present! 10:42:20 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x4}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:20 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) r1 = socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) write$FUSE_DIRENTPLUS(r2, &(0x7f00000002c0)={0xc0, 0x0, 0x8, [{{0x3, 0x3, 0xffffffffffffffe0, 0x3, 0x84, 0x4, {0x0, 0xfff, 0x537c, 0x0, 0x1, 0x1, 0x9, 0xffffffda, 0x3, 0xcbba, 0xff, 0xee01}}, {0x0, 0x7fffffff, 0x15, 0x0, '/proc/self/net/pfkey\x00'}}]}, 0xc0) bind$bt_rfcomm(r2, &(0x7f0000000280)={0x1f, @none, 0x84}, 0xa) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0xff00) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, 0x0) 10:42:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:21 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$tun(r0, &(0x7f0000000180)={@void, @val, @mpls={[], @ipv6=@gre_packet={0x0, 0x6, '\x00', 0x44, 0x2f, 0x0, @rand_addr="54326d5498a42373620e6eb5d9a5785a", @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}, {}, {}, {0x689}}}}}}, 0x76) 10:42:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:21 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x3, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:21 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) r1 = socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) write$FUSE_DIRENTPLUS(r2, &(0x7f00000002c0)={0xc0, 0x0, 0x8, [{{0x3, 0x3, 0xffffffffffffffe0, 0x3, 0x84, 0x4, {0x0, 0xfff, 0x537c, 0x0, 0x1, 0x1, 0x9, 0xffffffda, 0x3, 0xcbba, 0xff, 0xee01}}, {0x0, 0x7fffffff, 0x15, 0x0, '/proc/self/net/pfkey\x00'}}]}, 0xc0) bind$bt_rfcomm(r2, &(0x7f0000000280)={0x1f, @none, 0x84}, 0xa) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0xff00) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, 0x0) 10:42:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1089.206403][T10474] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:21 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) r1 = socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) write$FUSE_DIRENTPLUS(r2, &(0x7f00000002c0)={0xc0, 0x0, 0x8, [{{0x3, 0x3, 0xffffffffffffffe0, 0x3, 0x84, 0x4, {0x0, 0xfff, 0x537c, 0x0, 0x1, 0x1, 0x9, 0xffffffda, 0x3, 0xcbba, 0xff, 0xee01}}, {0x0, 0x7fffffff, 0x15, 0x0, '/proc/self/net/pfkey\x00'}}]}, 0xc0) bind$bt_rfcomm(r2, &(0x7f0000000280)={0x1f, @none, 0x84}, 0xa) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0xff00) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, 0x0) 10:42:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1089.437819][T10490] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:21 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x4}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:21 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) write$FUSE_DIRENTPLUS(r1, &(0x7f00000002c0)={0xc0, 0x0, 0x8, [{{0x3, 0x3, 0xffffffffffffffe0, 0x3, 0x84, 0x4, {0x0, 0xfff, 0x537c, 0x0, 0x1, 0x1, 0x9, 0xffffffda, 0x3, 0xcbba, 0xff, 0xee01}}, {0x0, 0x7fffffff, 0x15, 0x0, '/proc/self/net/pfkey\x00'}}]}, 0xc0) bind$bt_rfcomm(r1, &(0x7f0000000280)={0x1f, @none, 0x84}, 0xa) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1089.647482][T10501] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:22 executing program 1: lsetxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7940000000000, 0x400000000000000}, 0x1010, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000040), 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000000c0)=[@mss={0x2, 0xffffffff}, @timestamp, @window, @mss={0x2, 0x91c}], 0x4) sendmmsg(r1, &(0x7f0000004b40), 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x28001) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000140)={0xa0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYRESHEX], 0x1}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000100), 0x618) close(r1) shutdown(r1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) alarm(0x2) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000000c0)=[@mss, @timestamp, @window={0x3, 0x0, 0xfffe}, @mss={0x2, 0x3}], 0x6dd9207777e1701) sendmmsg(r3, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) sendmsg$IPVS_CMD_GET_DEST(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000100), 0x618) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) dup2(r4, r4) bind$pptp(0xffffffffffffffff, &(0x7f00000001c0)={0x18, 0x2, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_PROTO_DOWN={0x8, 0x4}]}, 0x30}}, 0x0) 10:42:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:22 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:22 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) write$FUSE_DIRENTPLUS(r1, &(0x7f00000002c0)={0xc0, 0x0, 0x8, [{{0x3, 0x3, 0xffffffffffffffe0, 0x3, 0x84, 0x4, {0x0, 0xfff, 0x537c, 0x0, 0x1, 0x1, 0x9, 0xffffffda, 0x3, 0xcbba, 0xff, 0xee01}}, {0x0, 0x7fffffff, 0x15, 0x0, '/proc/self/net/pfkey\x00'}}]}, 0xc0) bind$bt_rfcomm(r1, &(0x7f0000000280)={0x1f, @none, 0x84}, 0xa) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:22 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x4, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:22 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x4}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1090.591378][T10517] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1090.833801][T10532] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:22 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) write$FUSE_DIRENTPLUS(r1, &(0x7f00000002c0)={0xc0, 0x0, 0x8, [{{0x3, 0x3, 0xffffffffffffffe0, 0x3, 0x84, 0x4, {0x0, 0xfff, 0x537c, 0x0, 0x1, 0x1, 0x9, 0xffffffda, 0x3, 0xcbba, 0xff, 0xee01}}, {0x0, 0x7fffffff, 0x15, 0x0, '/proc/self/net/pfkey\x00'}}]}, 0xc0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1091.070906][T10543] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1091.333200][T10525] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1091.410731][T10550] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready 10:42:23 executing program 1: lsetxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7940000000000, 0x400000000000000}, 0x1010, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000040), 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000000c0)=[@mss={0x2, 0xffffffff}, @timestamp, @window, @mss={0x2, 0x91c}], 0x4) sendmmsg(r1, &(0x7f0000004b40), 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x28001) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000140)={0xa0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYRESHEX], 0x1}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000100), 0x618) close(r1) shutdown(r1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) alarm(0x2) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000000c0)=[@mss, @timestamp, @window={0x3, 0x0, 0xfffe}, @mss={0x2, 0x3}], 0x6dd9207777e1701) sendmmsg(r3, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) sendmsg$IPVS_CMD_GET_DEST(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000100), 0x618) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) dup2(r4, r4) bind$pptp(0xffffffffffffffff, &(0x7f00000001c0)={0x18, 0x2, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_PROTO_DOWN={0x8, 0x4}]}, 0x30}}, 0x0) 10:42:23 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:23 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:23 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1091.554288][T10556] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:24 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x5, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:24 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:24 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:24 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:24 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:24 executing program 1: lsetxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7940000000000, 0x400000000000000}, 0x1010, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000040), 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000000c0)=[@mss={0x2, 0xffffffff}, @timestamp, @window, @mss={0x2, 0x91c}], 0x4) sendmmsg(r1, &(0x7f0000004b40), 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x28001) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000140)={0xa0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYRESHEX], 0x1}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000100), 0x618) close(r1) shutdown(r1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) alarm(0x2) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000000c0)=[@mss, @timestamp, @window={0x3, 0x0, 0xfffe}, @mss={0x2, 0x3}], 0x6dd9207777e1701) sendmmsg(r3, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) sendmsg$IPVS_CMD_GET_DEST(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000100), 0x618) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) dup2(r4, r4) bind$pptp(0xffffffffffffffff, &(0x7f00000001c0)={0x18, 0x2, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_PROTO_DOWN={0x8, 0x4}]}, 0x30}}, 0x0) 10:42:24 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:24 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:24 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:24 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:25 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x6, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:25 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:25 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:25 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:25 executing program 1: lsetxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7940000000000, 0x400000000000000}, 0x1010, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000040), 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000000c0)=[@mss={0x2, 0xffffffff}, @timestamp, @window, @mss={0x2, 0x91c}], 0x4) sendmmsg(r1, &(0x7f0000004b40), 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x28001) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000140)={0xa0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYRESHEX], 0x1}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000100), 0x618) close(r1) shutdown(r1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) alarm(0x2) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000000c0)=[@mss, @timestamp, @window={0x3, 0x0, 0xfffe}, @mss={0x2, 0x3}], 0x6dd9207777e1701) sendmmsg(r3, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) sendmsg$IPVS_CMD_GET_DEST(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000100), 0x618) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) dup2(r4, r4) bind$pptp(0xffffffffffffffff, &(0x7f00000001c0)={0x18, 0x2, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_PROTO_DOWN={0x8, 0x4}]}, 0x30}}, 0x0) 10:42:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1093.451486][T10620] validate_nla: 3 callbacks suppressed [ 1093.451492][T10620] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:25 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:25 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1093.729478][T10633] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:25 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1093.955427][T10643] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:26 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x7, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:26 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:26 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:26 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x80}, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$inet6(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r1, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000840)=@l2tp={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000000700)=[{&(0x7f00000002c0)=""/77, 0x4d}, {&(0x7f0000000340)=""/114, 0x72}, {&(0x7f00000008c0)=""/222, 0xde}, {&(0x7f0000000580)=""/97, 0x61}, {&(0x7f0000000600)=""/214, 0xd6}], 0x5}, 0x20f4}], 0x2, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f0000002340)="bb8f9f640903127a53527c6fbfe65d43b0e0586f2d40c7e7df58cac83420e83662d6e39bb6d5430622431454eedeeaee423d8f210bc3525fa7927c18d5fbc91ab13c2041136047d8da9375934d00f325499bfe7712208d387d41c31821c2a22d1325b556528e9b790b74053d1ed631c6ec8126d37c87216173138c00cef396868029af5b76bebac5e38b74d8bbc6ae66b6e202b6d505710377710ea7d43edf00e1a4c1c670bb4c263ce777da81abdd5ba5a5c82f67232f9b4d6f21b2e6afa8b38e4642b0daa2acbc0478d89b88e8b2094d4248855e5e81992e60be3afff0f3c3799350615489a901a659abdeca0c615a622ebf64175f990320e0356d4a11ed62eef72b709c23dd65942e8b534d7d775d370c1e43866f1eb9972af1a9cef42e701798a53dc92a242aadbac343e1765cf8ea5665e22deda69777e52b1e9e5d3edc022256939e1eee013448294911139d5b9c6241049fecdf9b31f4cdf6cff65d71b5071ef70e1798347c8846aa5b905e83050e3e606986ed3f603d18c5cdeb11cda1ce3abddea9376231af130e19fc7601ec1ab8cb5a7de9e2174547f18225b09a54fc8720dbb91eb69c1be88e601c3c9df4f2758f39a5151951b9c6dbb419ffd783a34c9fad10f201b8724d31865e2fc1fcf48db2be713053b43a0e3943c1e2b08e8a26e946c439d891db2a80b5ffa054bc8d0177d3214056250c61a537d2ec7630fb90395df2cd6aa9c5e573365db580520bdc3f1c6b2be992e1516a4b810a11935dc780699e461d9715f70c6d103ff49bf168f3cff4c0d0d6ba5671fcd2975450b0e1a3474139cb0f2d3476fcd87a8bccbeb2f5f8a821017b879aa5b9d1fafa9f4c429a74cd2da782114d97bf031746a817dd0293c4eddc3a9ecb5afe496f4971474ccd827449409f07cf94dda2e7dbe8520b5afff10a7e3b0b4289a167fc692635b5b7426d9e771b95860b09a3e752c867213c772e48ba30a78feecc7ff26e63e1749c62b52d377ac5cc52db830c965e04ccfcfb24ceacc69cfdc2094124dd27b2d68f699476a2562bab1de117ffc2b0702ee8b0b77f85fecec3a25b37ab7eb06232c9a73b4470f1727c82581d81942abf42d3ea37957927ad3dbd0ebe46678a9f4d25c47acaac83c14210a54b71fed40df017e2be27f01e3e6ea3ea381ca14efd202858e6535ad4f79a8cdf47e385b740a70c14e3651731a45cc0ca4a56f2e903cad0384efcc364caf67e09551d35c682ebc90a9286c4d274ba1b8ced742ede4e55a62db7ef9a96fde2add05b41599fd72a79ba280cc125cb266ef21b7eeafe3ee6aa78eef33fc66454549c3ec298cb683a55a32208cf6ce88b560166159d59e65f30540f62c5437652ea7f2a02f87ca242dd2250f58e75938a9a3ded51ae6598c2aba53287ff5cdaab17be7f4310f8e07e310d52778de79e1c2e4391b254be38910aa1cf6e1ca0e75d24be97d59f7025f16c232d08b7a43a01ab5d106fbd549529b74e319c58f50438765ef0e3dc394eeb75dec41b3d80435b17520c97f5cd7ee692fb86d188fb0089fbf737dc1b96b9cc49be23a38a8cd92e5075f349993d7866369dd25eccbe1481477a05fee14e0edd1617921d7fcaa8fdc642e63b64388fa5b63442ff1466b1938d02546750b01ed9c980282ccbe10f204741249aed88c555ed6fdf7f68af9209807a71bbf4f31bef5a4223466da74ba8b034df529aef6ec6610a0d25973961e50e02af22d0ca8be1b9804a5918acbdb536e8f2f441ec9d640ed15133ee747440c86fc4526c9195954528673d25c8390170f3c19cb0b0c30b9e634c7ebae96946ae97c19eabca92226da925d22be37abbe0740938ea899ec42fd529a3b1063981e4c154219df5cf5af60a29b5a8ee530905725a14b28900eae937e705401ba8f632a7bca00d9724a992afdc9ed14aac71b8e3a7ee5ca095888feb195b4e083c3b611a1c2f8d092febe3b9f5f0df61e8d3c31a643c935b76bc1ad4265164e755484beb06610510bc51e8c6da8d71123bbe83a5e4128f41cf5c486d6a60496c300c406f990bee485cbdef794f2663ee66d2b18d8e55210c25c04b1a0c6d9c5f904e72806d2d4f5e5439bcdf146343cdffe4d0d70d42a9959cff9bd50c37cd478b0b0add16aae4dc839b46bca2ac7547144b6a422aed5e2db661bcb31a82bc0fc678e71a6cb090ef772860f3008b4152b5d281033be4a77b367baec3ab8ce7c83c601b11c8199bafcd15161a5454a6a982dbc3c2e3a5172b6a63e4904817075754eccbb0188c9cb2e5da9600f567485014887463b40f189b7ec3c5c0f36d502509e402c285765c78417ce6b3aab130ee790300000000000000e73a14554ee5e4995e32b3fe4075e247eb9bdeef64d1a7436c9b5782fb2f84f74e4c6e976289729c37b5bb8200a9480d181a6b11f5ec229b818134b8334967ae935ac1d81be4776fae4cb68b6fa330e93bd8de388b38455d569159bcd166df030a6dfedf28caf4608de7243f5df2c76f6680c301d819dc67d24d2f780432a931700a253b0a5b075195c6dbfd1fe17a1c11a3dffa872a07b877adc66d069fffb6d8326e1998c5a337c3d530250cae335ceffcf81dc438a47e73490d050a053813dbe6674e42c91ae94b4a881440000000b08b4bcd6ddf4058c4e08d4dc83d5fbd843ee27eaf50b297c220350260d9abbeeb6deb921e50cae0ea590cfb6f00fb3c71520f565bb769705e2481ef27cf537d29f163c9fe3d39ed9fd18dc8b0c976cd302283e430807a9d751357f89092532d89fe280c69ad36e34e1b5da9dea13fd19d0434c760fe295dfd9b9e63453c7853914c50b1b77ccd4b33c8b1f31fcb1aec040ffe2f02728d8ea84297bac2e22230ebd1488c503b05b2e433cc37ce9fc123b7d3eb244b452ae9a841e73b664c8f6621ea5a4c9ff9c1da032255311f2c063a682baf4c97e7ba552bf71af4bd64f43872b846d15c65c487089be272cfa24a33f8c50930ea0bc4b089505fb8e9e688d35a978813c38add66548d7575727ded0e7e64a5ce897da6b940df4c3dddb8b4871d773f6ebf02058509000000000000006caf18777ae68d2bfcfb2225961fcd10538ba664fd053a443320072707533ab761b9397bd0559126b84fe9196463ae50633017ea2d80940311d9c867102b1017f34af1965d8eb61be616a0d40656e2bbb750aee6f74f788c8acb2578e8686f5f8da6a19e979c152b7ee7c7f16902120588e2ff630144b5f929ffc593e946d9717c5968aa16c2d73d689fb5cce117acda3e23e5e0116de1cb6bddfa1a84cefb22c1e2c3753017696f27b9aec5d44f15411247643b84dd4410e784b4eb5b9c68fea671976f9b51c6526e2ddb40659611b0b3bcc7e249c77396fdb8c864ea9318f9de7fd3936fcbdc732c2f8b9556ec9afeb15d5e2df890351d66074d53dddc6e8dba8c91d733623ac95a49eb69c7de37ff2364ccddb01f6500750a012c2acf32a9f6bbd9e92d17ef858fbc34575db414ea42ad87a65b11ae5506469db256c421328f45aec73bdf18562447dc2840bbe9fc84dedd0fe6276fa174f21210d40193530ec7a70a9e60bfd6b00cba4d483be59950f16fa0dbd089b5fd0bb078badfcf42270cc62fe37be22b0d81f755263d74636fa466d2574ca62b58c649936d21e949de73ea45df3acade6609413f56fc218d6f11947bf1fd629d38d8acce90ee3c1a51117601ae126bec537e3e76ce7ecc53cfeefee8aaa104aa853a65aadf27bac9849ee0122793b11cd8e4f32fb07afa39e439cb738c30a6df958160aac15c26032a61aaf614b2e6601581fb0ab8d115e045005dee3df8ea42643cbcbb0b111130c42c94b7e874cfee50d5c2eb13b3a38c417fce9d740b7d43120431a7d44bc3934ee87b112401cbee3553837b6a0b4b3faaceb46eca4064301c8060870350e256ac9d5557f674536b9d9717a82fa211e7dfb52ca410d8a4f2f6b733c2a082f247538a6c40f56cf64204e62515db692f32733ff6f4b0787ef305d5e80881375467ae603ac3600e688c42f89a4fea4fdda09a8d59e19457c654a98c8129a8c65bae3310af2b170729e18400c915d0a2f4c4fc51747846630b95ec181228bda7ef48ad389815aa82de6c4a3b0746c28c01f9ec697ff17f095e1cf9d2fe78fdab9cbb1ca7aefc8af6a0cd98444735fad79e394a8f9c2fd358c3cde4ca6d57a620d0bb52dc6ff93f034b596f407c21511cc2c5ec8b0ede7f5c0acca61939ac7f2cad820c15133e69507eaa739e9a88936f4a74f0ad1574a1591f31f582a76157d89805cb3ba5e8d10509bf7a08e928653b4f05ba797a06765b74c8759fc34178624c08a2b99e59bcff5d33af2b0f9176b56c35f4da31c751a4c2fd88a1997cd9fc9bbf78220731d4c8cea23be1fd29c36b34d8458b7021ebcfafdc7e54096e517da3eb684298f742532d776164d9c9658e5faca0a3b08afca1bc27ed357884f49fe51bd0c38057f4288f1917e36e3865310b5eed140aef6150ae363293cf7467abd5e06cd7af5e2c49e7c5253a1155741e380bccb023a0faed93d9a64512d72436f1ef4ac0904a413e45164c23413bd57274a0a951c41a9a43aed094d4ea5c480ce64663cc9d36723179e2b19a48e9277a6591bbd888a06e0f2f142cd4495be4ba7274d69ba32a2788b935b2f18c5f336cb9de062829e2e0bb476efb36c3f53a766c14314f31637a464ac59d378ad7f51bef8d88715613653a427038e0d3e4dc3948bb1d70eb55c91c92f7510b1c0387253b458d2c90d17238f9eb239c680179a6c1e0759be367963e3b4d7395fd3911626582a094e6a8d0e746242f94267a4c57d5b2360ce3a6f7f3e3c10e124a54ed24d1585bc7b731cf731c94ee00ebf070b999b9bf28d76bfec9dcf12fcce2b9c4444c706ec6b943b5f39e9151a764ba1cd0cd6c1c7cdc3aa824cf17da705be27a18fbee41be39d6ae4dd4312f5f4bfee2c5bb21d941666f9d79b0f80c9b1bace84a05d2b0e3be1c3fd04d72b4b0124595c435813969d413960fddc858730a43613bd5d7c99163ef7423bc2b2f46e6ce05355d7e6dc5f5f9ff1a283070127b5e91621e765cbedbebbb86df7c977e8fbdd18774da4d2d6e169d244ba91b07f6a9ac71778e99271493855b57884a9cdb55ea4e8506b1a43ad485b4293f320d1935ec83561b9a5eda41327afd838e772eb596d7f69b10b86f1c443c8e3c35e86c43817eb73f31c8966ea69682b823d75a1aa6091b10d4447226767745d3b2e7d4a4d04c906750e5919b264981b30e9503c63260430b7ad0d42f39f538cd045acddcfe9b1c6de212b44ce17948365704f9422153e1911cb5d3a40f993a2ce986fb0f0014a872f4fcb86890193da6e9d7baee2aa07a755856943ed2a7c2b63a2e2812bec1ab22336e1e3f4d64eeb100"/3848, 0xf08) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f00000004c0)="2d7c148d9e70b32cd81e4e4fedcf1e9312d37fd2558871e9d9996a597910ad9b00d5c2d8cb313252d9f9274567789d1437a18beea97369288e0d9a4a137ba8a931a80e137d6dad359a3b53a59282961c0d9779f0dc65c7d7c9b713f69ecb939a278101a1dcbbaea4afd3d4ce37b2a004b198cbedc9be1096154a415a1b0d7f0d28aeacf81f9793e0bc413c8b70a2139eff30ac4a", 0xfffffdc6) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ab64}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000000c0)=0x6, 0x4) r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x8}, 0x0) socket$inet(0x2b, 0x1, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r5, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) 10:42:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:26 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1094.841129][T10659] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:26 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:26 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x210007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendto$inet(r0, &(0x7f00000012c0)="03268a927f1f6587b967483041ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba", 0x7ff8, 0x2, 0x0, 0x27) [ 1095.080056][T10678] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:27 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:27 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1095.263678][T10688] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:27 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x8, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:27 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:27 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:27 executing program 1: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) readv(0xffffffffffffffff, &(0x7f0000002340), 0x0) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f00000000c0)=""/37) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) rt_sigaction(0x7, &(0x7f0000000580)={&(0x7f00000002c0)="011fc483490ad3e7f2400f1b0ec4c3ad0d6900b8652e660f596987c4437d08ba0000008100d89206000000c40235ba680ac403f1696709bfc481de5e6b05", 0x1, &(0x7f0000000300)="3626660fe86fdcca4d00c4019915511766420fe17e0b0f3805f08fe878cd9189000000a4f2400f1a2a836305fe400f50c565ded1", {[0xf651]}}, &(0x7f0000000640)={&(0x7f00000005c0)="c4c26d8eb71c711973c462bd8c751dc4817968ec2e66460f72f20046f98f88588f62d058470ffd89704ca9bac40268f79e81ffffff660f38de19260f38ca2e", 0x0, &(0x7f0000000600)="c42179c4e800c481735c71e165660f383d3500800000c4c1adfcb80f0000002a293ef3476df3420faecb1500800000dee8f246ac"}, 0x8, &(0x7f0000000680)) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) setxattr$security_capability(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000240)=@v2={0x2000000, [{0x6b, 0x7}, {0x3}]}, 0x14, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000780)='/proc/self/net/pfkey\x00', 0x82000, 0x0) sendto$unix(r3, &(0x7f00000007c0)="4f37a2ccce67a49bb2dee8be5c8e1ff2111125a62deb33a68f7e5bb6d0e39332dcad268d1cf7f4d6be611cea88c1354811ec84579c0777cf701b1e181aab8d4438ce402e2bcf58a64f559877c1c146008a4704b73d45d307422b265a8699000e42e98e72d2e18dddaa2a3cab577769c73d30bde21847aff0972bfcb0b39a3b1c444da6ee8fd1989bb7fabcf3dd6d3501fb4345f3c2ae36a405d927954ff0bb156ea82af0476abdfba2fa40b5abe3931a991822168d8339c97717d6fb48ec0b2a24c8c491abd3ea14d5049c4fb2f298873d4d0c8b9672fdac0d526b34a22fd09805d31430d1a40870c55e79165828dfcc491c2a4e0c0e2a3f669820921404d479465bd9c18ad48f80a13147690f8532033b694d8ebbf6403d0ce3c7e2d7670075cfa14d379bc62c55647f190d0e23d25a63c8b3d1ad5c761208a8b339d2eff7adcfd134e442129a9223abc86b2084a2bda6e39654fa61b86443078e461cb322c90f825e22b3b095bb50cc6175bcd638a015d6a63f66ef274d3f8750448b451e9eda5d5057319c812c31bc926c884629100361ddc695b4d6c4420e9d776818808f59f02e97b02dbc4ef311473ab02ae582e4ebcabc586337d2e581cd2d5c3c107329e46a10a805827082f4455a16558550ad54a6395c1545d9d96b9a5432110b3ca95f654d24c233d8f48e9e10e78980b70b8ae68b9a85a0e9e371f128b600f2ef760b92cc44ec028c51b25522b9795ac7565714a62d84965f37f267abd17a858a9f47e207c46a2be1d223d17661d44e52a3c211bbd3f6c939d5c0a91e034f7b062093a29e8a8df5d386cc7c43546fae0097a9207091831bf298f59a68b6d316f2f449b064bb9ffc6b422cc6ead43ca634da34298b0ee656243aab8331585009144d3c63c2375ac6e6af5b71d806c18e2f8a5eb5ed5fa96bf2484fd5ac17158b62df448f0896ed5a251ada865f38ae180ad75ea86cdc8434fe7a1a6ccdd4b039276b725e9d9ee540e2fd222c25a4c6034da3e7c6835757f51a9c7fa4f9f55271ca9e5442350bf4b0fcd3955f77c16812067fef5327fc5b6739b21c23ed00a39fef60357b2df6578042e424279d0b491b8b07992120507eb57aa427ad9d0fc4a37e901ae8bf7a18996b63d442199e6a02c2d7abd2797ac21639333d5874a6326c5425b8f3e360db668e974ed70146e21cc4234ae1aeacb4cc5c6ba75e904729e8f55b706aaa442104bc23df5fa9eee9d6515b42d76b5bfbdd084f0a0f9d52d5b176d6276bc5513a3cbba453b991542aaa6cdd010d111fad6dce8e629443c8fd6f5d01bf43f7fffa3c8f9d11bbf530b9d33145759889694e529e2ca921a3125b77288d35805b1c714084cbdb8f28a40c504efe12b1c48dc6327f694d66b86ac364ddabf43ff81fd88426d62eeb2c401f63752b7b1ad8eae1b9f20b710dc78f41f76cf7ad860355b8a95a4af956d417e62583db2bf2d3902e2a66c4b15183d91bbc456f71aac925d2ef386ee982c4f3951551d2365444d5bff172d6fd28742aa9a6ab213cf8f73bad9b0bc7d14e3ffd27e977df0c438d6800c54a0089768d0238d293cfb617269aae411e0ec1ca1809a1f03e4c6f17972fda803caf8a8b3124737375983e4a9cd686dcaf2c20807072a0275539e7e33fbc1b73127b4d71bde1cf31ca00809f989f1580f49b0ba5e9b277fe0606212fd47b1becd485387971c847abc77bf6d9542966b994caf394f5dfb98f525cb7c08f4273967a304e0ce878ae219e8a61d4e81f54ace1dbda266d79f9f3ef3c60e19ea28bcacc75abdb0242cb8142baba84b0c64507d4cd92d04676a84ccecb9f1a628889b62474b7c72b84510e91f639c991b8d1102788f1d7f649dd69602c35f401211aed8cb713e37716645fb3a5156b5f3985bcc4083574eadc3daf269a7564f552a2e64d28ebbf4fe39c164aad5a393ae5e943a96f272682d61dc3d92df1d667a55028e546bb5fdaddad208159352f91afc845e311f1a4299b26354b216bb7c45fedc00fed849426a3def54d0e2cca431b23a90b60524fb7a0fe945415e22f4b4c6b71ec9bfa9cec129b6c597670cc74f680d710b4e5e1675b9e9907095361354f066f099fd990e6ca9130657ac87c12c97f2e3bceeae06013221aff9f9873f4958c233b446f1eee6be956f4ae7f57e198de1a68dd30a00bbc15fdc7b85344eefe18e3347dee35e3a1eed0d9044bfa37d4c80e82ff03e06b37d49f0ca4a7fe5657eb507974efa941b9aeba14546c2e14d9a541c3bba34023967ada8b2fbfed5541f378c83515fd042bd3aaa7d42178b9adfcfc31477fbfd7350920f1759f2dca680f4f075bc0ab009e9363324bd7bbfb3a958897cfc97f526ff3fff3b8ad790451a13b1ce13966cfd342d257881a62f372faf988e13cc4924d8c56d45951b93344e06daa95d7df51f07291630a2c09c9f98e8a7fae6613a58e03dab9c98d08fc4f76bc879b401606dace14324554f038bc2bb69b291f4a0287f1e7694d5e07382d3c91aa883fa7c23044ed1b7f3e3012091681be46e959d16569ef5c15de54d3fc85b3a0a056a2695367dd78bd92a76e54b8adad2711e4159c31402d90c4db3daa6b433fd10bec581a59722a6e788f1daa04cd2b549b5c233aac9df774350bd09fa472b76f96a582ee18bd9446b370b49a48c7465a065c73ac77a27546ee840143642071e90faa4428449b162b3e30e69c7836d8f832b7f4de07f4906840d8dd16272140abb34096b7cfa7a409230db38a0d6543525623420c83696dccec0fb59659472174a08ba82f64d6032f928c9e1d8789ddd1bc59b66fb34bbe55e093ae1a2274d03b0d40f053af8434eef91fb8c4955acd793f6ab22d0f1a359efd184f257c3ba320be46ede17d3ef59518a1225bd748f1fdd8f747c0c49802fdae8a7d7e7b031db8e2d66b6cd2c266cde2524a53d496678582bdfd08ec6ee7cb1fc7f774c4c14c87b8f8aea7cd97bbf50dd6a4bcd9a61129b16cff7b355812c3e16c25aacd3f129b7289c70c91a04b77cc16a3aeba0c4fe80fa16298ebdf75e78aa16ecc7e7c45358fe9fd617d51a6c1412559ca51e61f75c97be218c8503fbe299588d2ecf2abc7a17470a2991c48fc9654b28357eadce3ebd6d710915bd664f7794ea703d69b594f5a4f16b72a3d8e45a6bdb2938b8fa03477c1b150554ca35d5df4ad6d8ee49e7cbcf74ad2e6979610dbcd43a3ba4399bb5fb0e352a33ce168fe7059ffb13b07df0e3df5ff67a25001f08b491e041de0e451947a375197474e4ce603c981ddc8dc2ae7ba5128a32f0778830b08fbb183cc88656f478b8cf4d5dea2c1105b31a89b8998cc1c1fb43bbb5783222b5feb6cd1bb7fa08e36e419fd4603e14e832f51d1739d436950d850f3f4763c2b8c85fcf543ef30fcedb62acba01229615aada68a79f5c976649c078ff9f6277a2ba35619a5862ea1aae26a9c7ed0c40d90b72b6121953b8bf2bfb84e46408ca018474623c5ae1d3f90907e0767f356f50e5972896ec5efcd25a18ad4ab14966e4930a2b5c206c7b82c702c1246e921d204749e4b78a0054d67808bd443f96de445861755719aff3e634ed76feef2f465e365f6da5216808af6ac60ef1b887ebf4303912b211bc15e6c338f5fb687e5914079bd6b8d80f8513b812ad3ed696d8da653992293999b06107d83c2b593a67fd936bec4bcdb15f47b7985138da3371bded571124eb6a8e752bdb1540a7c005ecf80aab3be9cfcdf83ccfdbb20a1da293f810748193361dc6c4e86da7073f13f484568d261b0c1f363bb997c16f3e7bfc9df30648881e2385d2fbcce866dbae9c7b25c4ec84c53c55d9fef41403ba96b1fba6998609dca939db5a12574f00dcbb2b4bad0ebd240be8b075d94ab16ad6345f66914eb07b1cf430d2c2c43789213b37ec08bb22384185feeb2516b113a08f2793d192d9168568c25a9205c15e660900c288bc614331b865fe52b217149df41c650cdb262a8dc615ba4da3dc38c545a9c52ec7a38d2eb9bfa78361c681a7020e1ad352c3fd04e9ddede88c89bd7fb7244cf561add6c819da68e5f90f93661c373f21e75a02eb8305de18384e7a3e857e5b57f5043b50f8aa2bea2e0539b047baf64fb4738d44e77cb1b49a1236b5b07085e3130d485897f9b55ff5e7c7cecf0cc11f038d0f84c7f5891771ed70443f1727bb9fd559d01ed98eb1352a9981ad4348417ce68da8aaa769c354521892d9a708cdd35a4061a6beea9959bb01c9a51aea9fdbf1ccf2e75b5d3fda7d4770811ec81e309b57d156c4a9d25226bf2beb70a986512e1c52efaca8a3021301fcbc01eda5faf681c5a154573f060e8b6ffa7d630ee3ae354c4ac04674c1f78675839b34fbf92a230cd7deb304feed431d684fc5115f241f0ff5cc70dbf203e3b1ee5bf2c25d5328c37cf28b32182357f1c82899941f1191bcfcf74157c51855e19c6ba4e4435f62a2465914dfd0c02a6e6ece911d69b11a1214219027529c5e4db7e391af27b408910cfa29e08b30eb011aea12bf1cbcbda9607035e0b9205fc5523af91cdcc4dc474c6046c1e1a56f3e2186284c96fa53cf0bf9fedf6905208689a7ee742b4ca475e56a731bcd71f4bc9aea2b9a51097807369f2c91a088df065dfb9810aae801032e90e32e9f08e9441e741510964ebeeda4528192393dd54b971135960b165a722ceea0bcb6ccb9b3e8529b63bfd79fcba10b66ae8e16eb468b461a61bc07aa2e0cb09991262cddcac4fa3c83bc6447174dbaa1774c881e7e55545880438775a50ed0e1979d15a462e9722d95ab63d88195d79480f3769950f29ab145f562535a22fb5a037ed9b64a0e0178801a7ddd28b80096b8ac0985601833fd58b0f6efd3d1cbb501fde433505bd2b6f47314c8e26efae2a66a38a0a22557ef745cf384d773c9563ee04c866c0c915ce076dfa06f5d2a888f006be3e4bc7cde2d50c24b4c6927e41cd492c578317ff7a2f7a8919be2a71f1d2e0427b52d20cd4ea799620000ebef12896847ae031f0aabadba6cd8f8b7a8551c0f4d185b363fa4e5f02eddb72303b6bcd2cf828edf52b27c88cf051986b2051edf6f936af1106ecdf049468a8ba4b0698fd0805165d5f663890a817959e0641e7dad5ed99d086d1f04359debe78d03adfba409fefedaa9ae5fea5551b783f3baaf026074c728288c2d3989d5ed169a9f7ed693de659994e43aae9e1a69601c0af54f49d5430d61ba3d8ab5077b0585a5ff26edbfed454c8cdff6e5a052a7b705d19621ac5e9504479bd845d4fa2d0ad9c23a68dabefc0e85fea071cec5212b57363e22d7b185a03fd981f6b861fa694f2aca52b34d8a47de7ae46f7e094f36b922e08d5bd31f1f66f0499e961c87aa4e190542af4fdfea0b6542c28046cc9842d93da9e90c3be77079f1a9494f799a0a7b4d7eae7382c69f39bf2ac7a5f26ccbed59492a7d538dff210eb47f9c928f87038bfa7d968b717836077fd5a72d454938862e7bf98680ee748c29225c888f7cf7b1cbd2eeadaeabdde1d9e06d89c63183374b2b2494d5c008d20743f2643ab07452fac3103ad8002bf8da953c8b94a17ac561d9e8d755ac9e58ab5eb40a8648d8b0143401c6b9c5f154c87fb8e2420dc47d7c32086d88c3f28505b681fa34ccba448fa3d9e44078202d6e1d698b107173132d039c04f160e948d37d18d8a0050d804c345031901e0d024a074f2aa662c49ad286a0964b3ebe4ec63b230b4d2afc734c5002c792242fe2b88978c2f1d2eecb3aaa9eb42cdd803cb69bd67", 0x1000, 0x4004c, &(0x7f00000017c0)=@file={0x1, './file0\x00'}, 0x6e) creat(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x3, 0x1, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r2, 0x8250aea6, &(0x7f0000000340)=""/220) perf_event_open(&(0x7f000000a000)={0x2, 0x70, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x8000000200036150, 0x800007b, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = socket(0x100000000018, 0x0, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup3(r5, r6, 0x0) dup3(r7, r4, 0x0) socket(0x100000000018, 0x0, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r8, r9, 0x0) r10 = socket(0x100000000018, 0x0, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r13 = dup3(r11, r12, 0x0) dup3(r13, r10, 0x0) socket(0x100000000018, 0x0, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r14, r15, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) 10:42:27 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005070000", @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1095.942046][T10705] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:27 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:27 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:28 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x0, 0x0) open(0x0, 0x0, 0x0) creat(0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) writev(r0, &(0x7f0000000380)=[{&(0x7f0000000200)="e5", 0x1}], 0x1) lseek(r0, 0x0, 0x3) 10:42:28 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1096.187795][T10724] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:28 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x11, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:28 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:28 executing program 1: statx(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x0, 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) 10:42:28 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1096.930274][T10746] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:28 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005070000", @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:28 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x0, 0x0) creat(0x0, 0x0) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) writev(r0, &(0x7f0000000380)=[{&(0x7f0000000200)="e5", 0x1}], 0x1) lseek(r0, 0x0, 0x3) 10:42:28 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:29 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) [ 1097.182221][T10765] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:29 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:29 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x48, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:29 executing program 1: setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:29 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:29 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:29 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005070000", @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:30 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1098.172739][T10790] debugfs: File 'dropped' in directory 'loop0' already present! [ 1098.208862][T10790] debugfs: File 'msg' in directory 'loop0' already present! [ 1098.314802][T10790] debugfs: File 'trace0' in directory 'loop0' already present! 10:42:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:30 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:30 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700000000000000", @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:30 executing program 1: setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1098.520105][T10814] validate_nla: 3 callbacks suppressed [ 1098.520112][T10814] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1098.667273][T10818] debugfs: File 'dropped' in directory 'loop0' already present! [ 1098.694693][T10818] debugfs: File 'msg' in directory 'loop0' already present! [ 1098.739949][T10818] debugfs: File 'trace0' in directory 'loop0' already present! 10:42:31 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x5c, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:31 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:31 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:31 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:31 executing program 1: setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1099.219876][T10833] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:31 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:31 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700000000000000", @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:31 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:31 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x7a00000000000000) 10:42:31 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1099.470646][T10849] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:31 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, 0x0, 0x0, 0x7a00000000000000) 10:42:31 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1099.647538][T10857] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1099.738125][T10839] debugfs: File 'dropped' in directory 'loop0' already present! [ 1099.764133][T10839] debugfs: File 'msg' in directory 'loop0' already present! [ 1099.783890][T10839] debugfs: File 'trace0' in directory 'loop0' already present! [ 1099.822437][T10863] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:32 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0xe4, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:32 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) bind$bt_rfcomm(0xffffffffffffffff, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4008af04, &(0x7f0000000180)=0x0) 10:42:32 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, 0x0, 0x0, 0x7a00000000000000) 10:42:32 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) llistxattr(0x0, &(0x7f0000000580)=""/4096, 0x1000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:32 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:32 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700000000000000", @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1100.501446][T10877] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:32 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:32 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, 0x0, 0x0, 0x7a00000000000000) [ 1100.648880][T10882] debugfs: File 'dropped' in directory 'loop0' already present! [ 1100.659157][T10882] debugfs: File 'msg' in directory 'loop0' already present! [ 1100.687091][T10891] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:32 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1100.695984][T10882] debugfs: File 'trace0' in directory 'loop0' already present! [ 1100.711577][T10884] debugfs: File 'dropped' in directory 'loop0' already present! [ 1100.731958][T10884] debugfs: File 'msg' in directory 'loop0' already present! 10:42:32 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:32 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 1100.765435][T10884] debugfs: File 'trace0' in directory 'loop0' already present! 10:42:32 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) bind$bt_rfcomm(0xffffffffffffffff, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4008af04, &(0x7f0000000180)=0x0) [ 1100.912910][T10900] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1101.078301][T10905] debugfs: File 'dropped' in directory 'loop0' already present! [ 1101.092209][T10905] debugfs: File 'msg' in directory 'loop0' already present! [ 1101.152014][T10905] debugfs: File 'trace0' in directory 'loop0' already present! 10:42:33 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:33 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 10:42:33 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:33 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:33 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) bind$bt_rfcomm(0xffffffffffffffff, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4008af04, &(0x7f0000000180)=0x0) [ 1101.701080][T10927] debugfs: File 'dropped' in directory 'loop0' already present! [ 1101.718191][T10925] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 10:42:33 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1101.743759][T10927] debugfs: File 'msg' in directory 'loop0' already present! [ 1101.770287][T10927] debugfs: File 'trace0' in directory 'loop0' already present! 10:42:33 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) bind$bt_rfcomm(0xffffffffffffffff, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4008af04, &(0x7f0000000180)=0x0) [ 1101.943662][T10937] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:33 executing program 5: 10:42:33 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) socket$inet6(0xa, 0xe, 0x81) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1102.108343][T10945] debugfs: File 'dropped' in directory 'loop0' already present! [ 1102.159067][T10945] debugfs: File 'msg' in directory 'loop0' already present! [ 1102.193168][T10945] debugfs: File 'trace0' in directory 'loop0' already present! 10:42:34 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x2, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:34 executing program 5: 10:42:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:34 executing program 1: 10:42:34 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) unshare(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:34 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:34 executing program 5: 10:42:34 executing program 1: 10:42:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:34 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:34 executing program 5: 10:42:34 executing program 1: 10:42:35 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x3, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:35 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:35 executing program 1: 10:42:35 executing program 5: 10:42:35 executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:35 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1103.734803][T11003] validate_nla: 3 callbacks suppressed [ 1103.734810][T11003] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:35 executing program 5: 10:42:35 executing program 1: 10:42:35 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:35 executing program 1: 10:42:35 executing program 5: [ 1103.960844][T11014] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:35 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1104.164323][T11023] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:36 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x4, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:36 executing program 1: 10:42:36 executing program 5: 10:42:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:36 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/19, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:36 executing program 5: [ 1104.789825][T11036] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:36 executing program 1: 10:42:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:36 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:36 executing program 1: 10:42:37 executing program 5: [ 1105.072399][T11048] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:38 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x5, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:38 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:38 executing program 5: 10:42:38 executing program 1: 10:42:38 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:38 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/19, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1106.145712][T11062] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:38 executing program 1: 10:42:38 executing program 5: 10:42:38 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:38 executing program 1: [ 1106.307021][T11080] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:38 executing program 5: close(0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_DELSET={0x120, 0xb, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFTA_SET_USERDATA={0xf7, 0xd, 0x1, 0x0, "e89cc3d8aeb00dd069145a0de3fa1e74930ab5de0c451cb4f3b14e5e106000000000d7b354c08902869b4777adcea8fc2bfbbb7ff6de09b398a259ac497fb1307b5dec62a80e9ade428039b4cfca6f2be6e4d4db1f042bfa34523d278f8aba8af836574787714237d2d641ba863d52f348219ee06ef275825f90c3fd6cf3d7e65f60ef1f922c79fe282a9a2679e111079a0ef77e580ce5d9978bcadffe7f3114211ea9755ea0dfbc6e375e04fae227338d1d38ae23948dc3040a64a6b47da2af3cc81b7c1846bfc87536cbe1783963afd7e87e06350bfde85b4422a20896ede29d12b6d2b5ba87f7c9a53fb154faaf3b944bcc"}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14}}, 0x1a8}}, 0x0) 10:42:38 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:38 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:38 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:38 executing program 1: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x4, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$alg(r0, &(0x7f0000236fc8)=[{0x8004000, 0x0, &(0x7f00000fff80), 0x0, &(0x7f0000000140)=[@assoc]}], 0x2a, 0x0) 10:42:38 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/19, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:38 executing program 5: pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f0000000080)="580000001400379b9fb63b47", 0xc}], 0x1) close(r2) socket$netlink(0x10, 0x3, 0x4) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@vsock={0x28, 0x0, 0x54e7547e02afa628}, 0x80) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffdc, 0x0) 10:42:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1107.081834][T11105] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:39 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:39 executing program 1: r0 = socket$inet(0x2, 0xa, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000e68000)={0x2, 0x0, @multicast1}, 0x10) 10:42:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1107.217125][T11117] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1107.228378][T11119] syz-executor.1 uses obsolete (PF_INET,SOCK_PACKET) 10:42:39 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:39 executing program 1: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000016000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) syz_open_dev$sndpcmp(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000fb, 0x0, 0x3], 0x0, 0x205211}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000300)={0x0, 0x0, @pic={0x0, 0x8}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) dup(0xffffffffffffffff) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f0000a8a000)) [ 1107.351253][T11127] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:39 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:40 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x7, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:40 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:40 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:40 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$sndpcmp(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000300)={0x0, 0x0, @pic={0x0, 0x8}}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, 0x0, 0x0) write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f0000000040)={0x7}, 0x7) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1c01) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc058565d, 0x0) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, &(0x7f0000000100)) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) 10:42:40 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x7a05, 0x1700) pwrite64(r3, &(0x7f0000000400)="4ebefa1e923f1e018b6e53bf4815b78e1f2ef9212b93090c1ff6b35c208d50aef3fd759f995b53dd37c58cf8332b8a6b66575478e02ef0145bf122ba2e2c53a7ec45e375683475a6495f8d7b7a088f5e32dc266569074319bf8c8d3d8007cc92e2ba0d9082c41b63e330f353a3f675a98d2e74a08e38400f7f5eb113a0e25fd90115d57a7acdcab1128cf4f9c719f3f29d460c507f8a2a6594d259217d32eae9be93c6ed17a67ae2e7e689a31fa8449da12fd62bf423cff702b09e6ee1ff0e698b8bb517819eb712ba2b34b54b28b79d9399d920d5a5507e8a85f37060dfe3051f06f8d7cc9b068495ee5d5fcce85410bcd9f91d1f198353ce94b2e03370e43875c1a035bb88fd26fbb5b1252e2056d6b67e2b2f424051a40ad9170e76a81a6ca4f149ff643db76f8f2c1aa8024a6279952027489bbad6479e47ea5ba9e47d8136df398665f6cdfd15e93cfbf2ce1151afe9321ed63fe7100e704b232646fc1e0e936b90cceaaa70225ce71640e10316d2cc637355eddb3c4e16ff1635fa4e65a66eb5ab2cbf9d6f063e05f0e46fcc14bf31eedfb9f33c215fc14946cc6f7493924442e939f71ac4bd3e35e78857f9624c663f3669a47a7146e3249ee3eaaf681f371d515af5b934f9252c7ac2a164bf318fc2b194ee087b2b28ed5e4618c0906fc3f32c43a3b9e08a2e0d509f65a7de909e8c3c535f1d8cb9c236716e5ad709", 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x15d4b87) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 10:42:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:40 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x15464, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000050774000000dff0df250001a381", @ANYRES32=0x0, @ANYBLOB="7fff0002811200001c0012000b0001006d616373656300e10b00020005000b00010000000a000540020000000000000008000a0009d35b587e27a8b0b9cad4a128c1aa7cf68a72e18b043723262ef1db55855e9b9c3c4f3d85375cfa53566d1becb85f7297cb072cd567309e4df2d41485c9b6a83c953a21aa4f22f55716d40a207530362bc729067a2c1827fb817eec56022b28d49a32965d048e336c6476967ed3c425b32265056d7425271b24a7a00c7f44c83d98fd505c6a5bed", @ANYRES32, @ANYBLOB="6326ffc30340a59af4c3650421f9a53779861026cd4f7ae2dcfdaef81c581d1b4223e49887ee68e87ed537d5b2e957e1fac165be3eb34c5174f627927737456b54921f664921e1615264cc762c189704152109b0dff9eb9ca92da732cc5b460a46383502d39192ed1257af1867305485dc560b67fa9950386e7d44374265b739aa0ef8918e45feb997445e598790400e81a0a90106099ffc4061064fb95e437e5d5f0594c091"], 0x50}}, 0x0) 10:42:40 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x7a05, 0x1700) pwrite64(r3, &(0x7f0000000400)="4ebefa1e923f1e018b6e53bf4815b78e1f2ef9212b93090c1ff6b35c208d50aef3fd759f995b53dd37c58cf8332b8a6b66575478e02ef0145bf122ba2e2c53a7ec45e375683475a6495f8d7b7a088f5e32dc266569074319bf8c8d3d8007cc92e2ba0d9082c41b63e330f353a3f675a98d2e74a08e38400f7f5eb113a0e25fd90115d57a7acdcab1128cf4f9c719f3f29d460c507f8a2a6594d259217d32eae9be93c6ed17a67ae2e7e689a31fa8449da12fd62bf423cff702b09e6ee1ff0e698b8bb517819eb712ba2b34b54b28b79d9399d920d5a5507e8a85f37060dfe3051f06f8d7cc9b068495ee5d5fcce85410bcd9f91d1f198353ce94b2e03370e43875c1a035bb88fd26fbb5b1252e2056d6b67e2b2f424051a40ad9170e76a81a6ca4f149ff643db76f8f2c1aa8024a6279952027489bbad6479e47ea5ba9e47d8136df398665f6cdfd15e93cfbf2ce1151afe9321ed63fe7100e704b232646fc1e0e936b90cceaaa70225ce71640e10316d2cc637355eddb3c4e16ff1635fa4e65a66eb5ab2cbf9d6f063e05f0e46fcc14bf31eedfb9f33c215fc14946cc6f7493924442e939f71ac4bd3e35e78857f9624c663f3669a47a7146e3249ee3eaaf681f371d515af5b934f9252c7ac2a164bf318fc2b194ee087b2b28ed5e4618c0906fc3f32c43a3b9e08a2e0d509f65a7de909e8c3c535f1d8cb9c236716e5ad709", 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x15d4b87) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) 10:42:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1108.753101][T11180] validate_nla: 4 callbacks suppressed [ 1108.753108][T11180] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1108.812134][T11167] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1108.837323][T11167] device tunl0 entered promiscuous mode [ 1108.878394][T11167] device tunl0 left promiscuous mode 10:42:41 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:41 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:41 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x8000001000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2f0000001c0005c5ffffff080d0000000200001f01000000190102c9130001000180000050000000586700a28663b3", 0x2f}], 0x1}, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:42:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000001c0)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb, 0x1, 'macsec\x00'}, {0x4c02}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x14]}]}, 0x40}}, 0x0) 10:42:41 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1109.429814][T11195] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1109.457680][T11197] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1109.462507][T11195] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 10:42:41 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000340)=0x1, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x2, @loopback}, 0x1c) 10:42:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x485ec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9, "74de546f"}, 0x68, 0x0, @offset, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 10:42:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1109.545634][T11207] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:41 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:41 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) open$dir(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f00000001c0)={[{0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x4}, {0x10000}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 1109.754948][T11222] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:42 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:42 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:42 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:42 executing program 1: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) 10:42:42 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1110.556574][T11250] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:42 executing program 1: set_mempolicy(0x0, &(0x7f0000000140), 0x0) socket(0x11, 0x0, 0x0) r0 = creat(&(0x7f0000001c00)='./bus\x00', 0x0) r1 = socket(0x2, 0x803, 0xff) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) socket$xdp(0x2c, 0x3, 0x0) r2 = dup(r1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x800fe) sendfile(r2, r3, 0x0, 0x8000fffffffe) 10:42:42 executing program 5: perf_event_open(&(0x7f0000000300)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x800, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x5) write$binfmt_misc(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="5300000044a6aeabec2e1520000000000000001000fff64017db9820000000003b08d403f7ff633b27e59aa144175dd106736d17c3f2c876c699010000000000000025da3f0fc7ec6e2656000008004902e181baf9451cd8489f9c5c951d2c0945c08ba8c552fc99a7422007653872ecb4f63acdf680812d274014ae40b88f15ff2258dd247239ece16a61fd063f026ed736da971f7ee096d74c92fad7e34bd5f0e4542636c2cb6222bc224609aba9e68d66d7e6241bf25e627da1af58de103c2cd02af1ea185a7d54e80ac2db56f739e0330c79308646735006c58990ac99dc0e95c9cf09f72229f105014d5f667a74e9b7bbfba93635644c55c23d459c23c61a071a32adc648b7909ddb361153b0234deeb094367a34b636735b0cbaf0763bc7c06659d8836aec9714a2b19a46a5c92dced60634288a1b2c01d3ee2e3ede"], 0x13f) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) msgget$private(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0x7, 0x10300) sendmsg$TIPC_CMD_GET_LINKS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x24, 0x0, 0x100, 0x70bd25, 0x25dfdc02, {{}, {}, {0x8}}, ["", ""]}, 0x24}}, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000300)="1400000013000507ed008064d200100005000080", 0x14}], 0x1}, 0x0) recvmsg$kcm(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) 10:42:42 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1110.728760][ T27] audit: type=1804 audit(1581590562.651:46): pid=11261 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir157053383/syzkaller.a0wSec/1250/bus" dev="sda1" ino=16545 res=1 [ 1110.735426][T11263] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1110.761543][ C1] sd 0:0:1:0: [sg0] tag#6976 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 1110.771974][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB: Test Unit Ready [ 1110.778478][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.788097][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.797704][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.807416][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.817086][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.826816][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.836427][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.846035][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[70]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.855780][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[80]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.865385][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[90]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10:42:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semctl$SEM_STAT_ANY(0x0, 0x0, 0x14, 0x0) [ 1110.875010][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[a0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.884622][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[b0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.894267][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[c0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.903843][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[d0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.913562][ C1] sd 0:0:1:0: [sg0] tag#6976 CDB[e0]: 00 00 00 00 00 00 00 00 00 00 00 00 10:42:42 executing program 5: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000300)="1400000013000507ed008064d200100005000080", 0x14}], 0x1}, 0x0) [ 1110.949632][ C1] sd 0:0:1:0: [sg0] tag#6977 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 1110.960054][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB: Test Unit Ready [ 1110.966549][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.976845][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.986570][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1110.996186][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.005793][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.015397][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.025000][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.029532][ T27] audit: type=1804 audit(1581590562.741:47): pid=11267 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir157053383/syzkaller.a0wSec/1250/bus" dev="sda1" ino=16545 res=1 [ 1111.034619][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[70]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.034638][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[80]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.034655][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[90]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.034673][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[a0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.034690][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[b0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.034720][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[c0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.115914][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[d0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1111.125527][ C1] sd 0:0:1:0: [sg0] tag#6977 CDB[e0]: 00 00 00 00 00 00 00 00 00 00 00 00 10:42:43 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:43 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:43 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl(r0, 0xffffffffffff0000, &(0x7f00000002c0)="11bac435630a0980710f1946b5313948889fe56e85ae3c5e14ee3ae92b6735b8666e4de901000080000000007409e7068e00c54c94eb19a0b4") 10:42:43 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:43 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:43 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000001c0)={[{0x0, 0x0, 0x2, 0x4}, {0x4}, {0x10000}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$SIOCGETNODEID(0xffffffffffffffff, 0x89e1, &(0x7f00000002c0)) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x0, 0x0) [ 1111.855848][T11289] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:43 executing program 5: pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) close(r2) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000940)={0x26, 'hash\x00', 0x0, 0x0, 'vmac64(aes-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="cb56b6cc0407008b65d8b4ac2ca35c66", 0x10) r4 = accept4$alg(r2, 0x0, 0x0, 0x0) r5 = memfd_create(&(0x7f0000000440)='\x84h\x00\x80\x02\x00\x00\x00\xd2\xfa9\x7f\xe0\'\a\x00_\x05\x85\x90u\xdd$\xd0\xb39\x1b#`\xd5\xa8f\xb13\xef\xbe\x02\xa6\xf1\xff#H\xdc^\xab\x02\xec\xd8$\xc5\xa9\xce\xc1X\xaf \v3\x84\xa4\xd8\xd3\xb2', 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r4, 0x0, 0x2000000000a, 0x0) 10:42:43 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:43 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1112.048700][T11312] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:44 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:44 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:44 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1112.260901][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:44 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:44 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:44 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:44 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:44 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000001c0)={[{0x0, 0x0, 0x2, 0x4}, {0x4}, {0x10000}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$SIOCGETNODEID(0xffffffffffffffff, 0x89e1, &(0x7f00000002c0)) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x0, 0x0) 10:42:44 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:45 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1113.031105][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:45 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:45 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1113.258465][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:45 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:45 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000001c0)={[{0x0, 0x0, 0x2, 0x4}, {0x4}, {0x10000}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$SIOCGETNODEID(0xffffffffffffffff, 0x89e1, &(0x7f00000002c0)) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x0, 0x0) [ 1113.413522][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:45 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:45 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:45 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:45 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000001c0)={[{0x0, 0x0, 0x2, 0x4}, {0x4}, {0x10000}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$SIOCGETNODEID(0xffffffffffffffff, 0x89e1, &(0x7f00000002c0)) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x0, 0x0) [ 1113.803339][T11386] validate_nla: 4 callbacks suppressed [ 1113.803346][T11386] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:47 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:47 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:47 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:47 executing program 1: syz_emit_ethernet(0x46, &(0x7f0000000580)={@local, @random="4a2c0100", @void, {@ipv6={0x86dd, @dccp_packet={0x0, 0x6, "14f7ff", 0x0, 0x21, 0x0, @local, @mcast2, {[], {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "05004f", 0x0, "2c8ce2"}}}}}}}, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') fchdir(r0) 10:42:47 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:47 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4}, [@nested={0x4, 0xe}]}, 0x18}}, 0x0) [ 1116.039068][T11413] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:48 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:48 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:48 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1116.246153][T11428] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:48 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1116.448862][T11438] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:48 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:48 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:48 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:48 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) stat(0x0, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fchown(0xffffffffffffffff, 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1116.613368][T11444] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:49 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:49 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:49 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:49 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x5) sendfile(r1, r0, 0x0, 0x800) 10:42:49 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1117.186736][T11472] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1117.214669][T11474] sg_write: process 3673 (syz-executor.1) called from kernel context, this is not allowed. 10:42:49 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1117.241779][T11475] debugfs: File 'dropped' in directory 'loop0' already present! [ 1117.304425][T11475] debugfs: File 'msg' in directory 'loop0' already present! [ 1117.400493][T11475] debugfs: File 'trace0' in directory 'loop0' already present! [ 1117.400783][T11486] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:49 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:49 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:49 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x7ffffffffffff92, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000180)=0x6, 0x4) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 10:42:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:49 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1117.563466][T11495] debugfs: File 'dropped' in directory 'loop0' already present! [ 1117.617900][T11495] debugfs: File 'msg' in directory 'loop0' already present! [ 1117.626382][T11500] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1117.634389][T11495] debugfs: File 'trace0' in directory 'loop0' already present! 10:42:50 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:50 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:50 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1118.190778][T11513] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:50 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:50 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1118.233802][T11516] debugfs: File 'dropped' in directory 'loop0' already present! [ 1118.255157][T11516] debugfs: File 'msg' in directory 'loop0' already present! 10:42:50 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1118.311730][T11516] debugfs: File 'trace0' in directory 'loop0' already present! [ 1118.319876][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:50 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:50 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1118.389262][T11524] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:50 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1118.494438][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:50 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1118.675332][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:51 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:51 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000280)={0x0, 0x8, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100000001e6c0000000000000000000a20000000000a01000000000000000000000000000900010073797a300000000038000000120a01050000000000000000000000000400048009000200dd387d00000000000900010073797a30000000000800034000000001140000001100df0000000000000000000000000a3378dbfaf9b31c8428455b61d2537f54a3f2b826a1acc0f49ab489a500a2fdc31ba6b5c6579557f92f429a40d5a2f5b94e62b953767975084be84845d6ab84e9a9220a22db4cf86dc3"], 0x80}}, 0x0) 10:42:51 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:51 executing program 5: setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:51 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32], 0x2}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:51 executing program 5: setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1119.344700][T11569] validate_nla: 1 callbacks suppressed [ 1119.344707][T11569] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:42:51 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000280)={0x0, 0x8, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100000001e6c0000000000000000000a20000000000a01000000000000000000000000000900010073797a300000000038000000120a01050000000000000000000000000400048009000200dd387d00000000000900010073797a30000000000800034000000001140000001100df0000000000000000000000000a3378dbfaf9b31c8428455b61d2537f54a3f2b826a1acc0f49ab489a500a2fdc31ba6b5c6579557f92f429a40d5a2f5b94e62b953767975084be84845d6ab84e9a9220a22db4cf86dc3"], 0x80}}, 0x0) 10:42:51 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:51 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105482) r1 = memfd_create(&(0x7f0000000000)='\x00', 0x0) pwritev(r1, &(0x7f0000000440), 0x0, 0x81000) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) write(r0, &(0x7f0000000000), 0x52698b21) 10:42:51 executing program 5: setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1119.612818][T11584] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:52 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) 10:42:52 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:52 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:52 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32], 0x2}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:52 executing program 1: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0}, 0x0) perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x2, &(0x7f00000000c0)) 10:42:52 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000973000000000200000000000000000000000000000000000000000000000000000000000000000000000000008000"/110], 0xb8}}, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x43, &(0x7f0000000140)=@dstopts={0x0, 0x1, [], [@ra, @ra]}, 0x10) [ 1120.253200][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 1120.281562][T11609] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:52 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:52 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) 10:42:52 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1120.440588][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 1120.471139][T11625] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) [ 1120.570871][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:53 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x2, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:53 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:53 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x0, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x0, 0x3ff}) 10:42:53 executing program 1: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='oom_score_adj\x00') writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)='-0', 0x20000002}], 0x1) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0xa, 0xfa00, {0x0, &(0x7f0000000000), 0x111}}, 0x20) r2 = socket(0x2000000000000021, 0x2, 0x1000000000000a) connect$rxrpc(r2, &(0x7f00000001c0)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x24) sendmmsg(r2, &(0x7f0000005c00)=[{{0x0, 0x7b, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001000000434b1a0ecccf80a7281c591244d4892e79ae7fd0a58f3388aff143ce6b75762a726d602fe6a1d4652c8151a131105792e169e2efeae0f5ecbb29a6b4572cb0a5d5f8e59006aa0d490b32b490378f7e193ac2d080872df2439c6d39f0825e35fea624c18a685487b623389f7c277520e1a9688acb70e6d731228c09e1bd991c217faa80853aca5fd42e682037347ff1bf134fda7e128b99cfec9b1edb1b9920db3ad2f7438481c106fe7c7c0e4c2e2a00a815f10000000000"], 0x18}}], 0x40000000000037b, 0xc0fc) close(r2) socket(0x10, 0x803, 0x0) 10:42:53 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32], 0x2}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x0, 0x3ff}) [ 1121.228372][T11651] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:53 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl(r0, 0xffffffffffff0000, &(0x7f00000002c0)="11bac435630a0980710f1946b5313948889fe56e85ae3c5e14ee3ae92b6735b8666e4de901000080000000007409e7") [ 1121.269245][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:53 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:53 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x0, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x0, 0x3ff}) [ 1121.422814][T11667] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:53 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1121.497356][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 1121.623869][T11679] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:54 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x3, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400}) 10:42:54 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x0, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:54 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:54 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:54 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl(r0, 0xffffffffffff0000, &(0x7f0000000040)="11bac435630a0980710f1946b5313948889fe56e05ae3c5e14ee3ae92b6735b8666e4de901000080000000007409e7068e00c54c6a0409a0b490ca22310b38") [ 1122.311491][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 1122.317764][T11695] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400}) 10:42:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000340)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB='$\x00\x00\x00*\x00\'\r\x00'/20, @ANYRES32=r2, @ANYBLOB="0000806dfd00000000000000"], 0x24}}, 0x0) 10:42:54 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x0, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:54 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:54 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1122.475225][T11709] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400}) [ 1122.569751][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 1122.666548][T11718] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:55 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x0, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:55 executing program 0: set_mempolicy(0x4003, &(0x7f0000000140)=0x101, 0x2) socket(0x11, 0x0, 0x0) r0 = creat(&(0x7f0000001c00)='./bus\x00', 0x0) socket$inet6(0xa, 0x5, 0x0) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) r2 = socket(0x2, 0x803, 0xff) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) socket$xdp(0x2c, 0x3, 0x0) r3 = dup(r2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x800fe) sendfile(r3, r4, 0x0, 0x8000fffffffe) 10:42:55 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x4, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:55 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:55 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl(r0, 0xffffffffffff0000, &(0x7f00000002c0)="11bac435630a0980710f1946b5313948889fe56e85ae3c5e14ee3ae92b6735") 10:42:55 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000002c0)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x6, 0x3, 0x0, "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006926ed0c00"}, 0xd8) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) socketpair$unix(0x1, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x4b72, 0x0) write(0xffffffffffffffff, 0x0, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) bind$inet(r0, &(0x7f0000000500)={0x2, 0x4e21, @dev}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40106614, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) openat$pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) shutdown(r0, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000500)={0x2, 0x4e21, @dev}, 0x10) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) [ 1123.462473][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:55 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x0, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1123.568057][ T27] audit: type=1804 audit(1581590575.491:48): pid=11740 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir535118310/syzkaller.wbsYJ0/1861/bus" dev="sda1" ino=16569 res=1 10:42:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:55 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_emit_ethernet(0x6a, &(0x7f0000000480)={@local, @random="b03c00", @void, {@ipv4={0x800, @gre={{0x6, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp={0x7, 0x4}]}}}}}}, 0x0) [ 1123.681866][ T27] audit: type=1804 audit(1581590575.521:49): pid=11746 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir535118310/syzkaller.wbsYJ0/1861/bus" dev="sda1" ino=16569 res=1 [ 1123.686230][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:55 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:55 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1123.906143][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 1124.019699][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:56 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x5, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:56 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:56 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:42:56 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:56 executing program 1: syz_emit_ethernet(0x42e, &(0x7f0000000480)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd60a4f00803f83afffe8000000000000000000000000000aaff02000000000000000000000000000186009078000000000000000000000000030ba78ce540cd4f791153d5dea6493b87aa0568f00b1c71a8242373244ad2439adc07df0a69748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c11b37adac15084dbaf736b41e5a8037208001684f0da52ef24571313968050378ee824f4dffba7feed320557f7671975afc9c545c5ea6137c8ce680ba2d2e8794cc0ee661ab31313a50f67f637326b0000000026a2c281295ae9405b24d13ec48b7b6aa26e8a94498418f3472f7281922377d30a3b5ed2c6a2990e5ea6b275c1d5bddf59f3d1843df268e8c825c6b2cff208dfb5cd8283b5af54d76de228bf697d3d6506afec30ef7e07413c7afc1eb139e0fb1a5a643b4099519e31f3fd4457f0e6d586ad05e1005a062bf7b5e0f2dbbdc849b90d4e80a0e3f7af088060d01a1cfcfad88ef4512c6ef5c0ead4b9cc87484b106a060a9899d50f595204418f51e914c88c29078a5457de6a262cadf02b071d88e61703f037caded0b315701274012fa532ddd694afe74e1a2df196e0afcffda08fb3d82ab8160253a47d3efc3d7cead55c28610ae20f69aaced0a1a6ce815344cf8d0bc8a0dfcdd1e8cd7242601777ec653c2d4b704397dcb1351982afd017eaa630c840d71589499fd68239ae0c0aa2fc9b949d1a716d40a24f078e92e8c268ff726290944b5f3a3beab159f2d2a51405fba224411ecc49544dea47917a98bf79c3bfeed70429abf70a52ecbda21c9bf0f6a70cd2c2c887391e4095ad22b433c60abf829447b47bd231ca2a98d9da7519a4bd28e803fa000fafc0dc453ed56cdf4356d7abcfec4eed0b94a4f78ce44a7177c6684026ba4f26a17e52e326c8bb7be5e2ea5780d7169d8f4ff62cb2b223f1d6221f62e0ee0244d86042560edd36853c464b23be536c65b87cd5ea60932ed9b369ed2017f645afcb5cd07f6896a08473bd5dea2bfb52ac501a39c338ede985aa4a7755db876cbe4d944f3cce0079d2ad9ba8d17f01a614052aadbd4af0fd282f594dc4530ee49b6c9ae6d5d80a073e678594be2e2f0869baa2a58dd2d0f6a995fb706c4d1b618d57da1c2d8f55611f746105a947b4f6bb74dbdbffb1b3c1f2316f6a28a07f0145b1bf8345b6aa4e9d5a81949706000000000000001c1f8e2f86356439bc5b87fe4cad68b6afa08687e6e751803965165eac0c34bdddae1bbe52f55d08cc4a0865f8df372635e8a26ac4ac9716a124ac4e83349f17b612e2b1893b5eaccecc7d812bb4f4fc6b313f57c2035a90f782a4a97b5f5309b6c5798d72b9187f3d411e84041e3671fe35e39fa1887846721c38d501b471990b919d2ad9ca9bc71157a843d75838c1aa4ff0dabd74284709f1f87f324ec4f56e484ded9fe90b590dc929ebacd70e6bb5e9c3ff719786c4d4284e4cfdc828e0465ca168d04de188cf643795eee629a58a6880f086d0c245ce4f896e93d3543b983b402d84aaab7ee9aab21f9194461e4cbcdbf4ac4d46a7cb2840e724a4054014ee836dd24861ab452bf164f4ce4aa6"], 0x0) 10:42:56 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1124.568823][T11785] validate_nla: 5 callbacks suppressed [ 1124.568830][T11785] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:56 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000), 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:56 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1124.611820][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 1124.641403][T11795] dccp_invalid_packet: pskb_may_pull failed [ 1124.647715][T11795] dccp_invalid_packet: pskb_may_pull failed 10:42:56 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r3, 0x80082102, &(0x7f0000000040)) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x110) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1124.715198][T11803] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1124.737832][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:56 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000), 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:56 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:42:56 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1124.893329][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 1124.974842][T11821] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:57 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x6, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:57 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000), 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:57 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:57 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:42:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_emit_ethernet(0x4a, &(0x7f00000003c0)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000400", 0x14, 0x6, 0x0, @empty, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 10:42:57 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000009000100"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1125.740645][T11838] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:57 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1125.797807][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 10:42:57 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="8905", 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:57 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r2, 0x110, 0x4, &(0x7f0000000300)=0x2, 0x4) sendfile(r1, r0, 0x0, 0x1c01) [ 1125.875791][T11849] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:57 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:42:57 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1126.127285][T11863] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="8905", 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:58 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x7, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:42:58 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:42:58 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:58 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r2, 0x110, 0x4, &(0x7f0000000300)=0x2, 0x4) sendfile(r1, r0, 0x0, 0x1c01) 10:42:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="8905", 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:58 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000009000100"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1126.920072][T11883] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528", 0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:58 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:42:59 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1127.101990][T11894] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:42:59 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528", 0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:42:59 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r2, 0x110, 0x4, &(0x7f0000000300)=0x2, 0x4) sendfile(r1, r0, 0x0, 0x1c01) 10:42:59 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1127.321235][T11908] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:00 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x8, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:00 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:00 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528", 0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:00 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:00 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r2, 0x110, 0x4, &(0x7f0000000300)=0x2, 0x4) sendfile(r1, r0, 0x0, 0x1c01) [ 1128.092806][T11917] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:01 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000009000100"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:01 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:01 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:01 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:01 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) sendfile(r1, r0, 0x0, 0x1c01) 10:43:01 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x11, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) [ 1129.924320][T11934] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:01 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:01 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:02 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1130.107687][T11950] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:02 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) sendfile(r1, r0, 0x0, 0x1c01) 10:43:02 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:02 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1130.341944][T11966] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:02 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:02 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:02 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:02 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:02 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1130.634296][T11981] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:03 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x48, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:03 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:03 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:03 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1131.162234][T11992] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:03 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:03 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:03 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000), 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:03 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) sendfile(r1, r0, 0x0, 0x1c01) [ 1131.391015][T12007] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:03 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1131.648584][T12025] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:04 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x5c, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:04 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000), 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:04 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:04 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) sendfile(r1, r0, 0x0, 0x1c01) 10:43:04 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:04 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1132.314405][T12035] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:04 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) sendfile(r1, r0, 0x0, 0x1c01) 10:43:04 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:04 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000), 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:04 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)) 10:43:04 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1132.521304][T12054] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:04 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1132.701986][T12066] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:05 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0xe4, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:05 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:05 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:05 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000009000100686673630000000008000200"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:05 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)) 10:43:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:05 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:05 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:05 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)) 10:43:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:05 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:06 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x300, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:06 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:06 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:06 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:06 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000009000100686673630000000008000200"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:06 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:06 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:06 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:06 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:07 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x500, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:07 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:07 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:07 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:07 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000009000100686673630000000008000200"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:07 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1135.372323][T12165] validate_nla: 6 callbacks suppressed [ 1135.372330][T12165] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:07 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 10:43:07 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:07 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x1c01) 10:43:07 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1135.632777][T12183] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:07 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:07 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 1135.777643][T12190] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:08 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x600, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x1c01) 10:43:08 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:08 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, 0x0, 0x0) 10:43:08 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:08 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:08 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, 0x0, 0x0) [ 1136.428143][T12209] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:08 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x1c01) 10:43:08 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:08 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, 0x0, 0x0) [ 1136.663384][T12224] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:08 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x1c01) 10:43:09 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x700, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:09 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:09 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4), 0x1c) 10:43:09 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x1c01) 10:43:09 executing program 0: ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r0}) 10:43:09 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:09 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1137.493112][T12252] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:09 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x1c01) 10:43:09 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4), 0x1c) 10:43:09 executing program 0: ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r0}) [ 1137.601171][T12262] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:09 executing program 1: r0 = syz_open_procfs(0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:09 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1137.807211][T12276] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:10 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0xe80, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:10 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60000004, &(0x7f0000b63fe4), 0x1c) 10:43:10 executing program 0: ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r0}) 10:43:10 executing program 1: r0 = syz_open_procfs(0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:10 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:10 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:10 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1138.592021][T12293] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:10 executing program 1: r0 = syz_open_procfs(0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:10 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r3, 0x1, 0x0, 0x0, {{}, {}, {0xc, 0x13, @l2={'eth', 0x3a, '\x00'}}}}, 0x28}}, 0x0) 10:43:10 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:10 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:10 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, 0x0, 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1138.848752][T12309] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:11 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x1100, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:11 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:11 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, 0x0, 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:11 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:11 executing program 5: clone(0x80000000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = dup2(r0, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x100000000000000, 0x7ffffffff000, 0x0, 0x0, 0x0, 0x0}) 10:43:11 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000009000100686673630000000008000200000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:11 executing program 5: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x902, 0x0) writev(r0, &(0x7f0000000480)=[{&(0x7f0000000040)="3e350e9266bdb85b62108e0a", 0xc}, {&(0x7f00000000c0)="7bda30580690e6e6c101353021618c5f69aaf307679bf34c9a9d51a0bd749d7aee48971243e644d866c7d1bb3870d396e2febada20e023a5d7def51d7fedd7a3867be0f7d10d", 0x46}], 0x2) [ 1139.731539][T12330] binder: 12326:12330 ioctl c0306201 20000400 returned -14 10:43:11 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:11 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, 0x0, 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:11 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:11 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:11 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:12 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x4000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:12 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:12 executing program 5: socket$packet(0x11, 0x4000000000000a, 0x300) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0xa, 0x4e36, 0x0, @mcast2}, 0x1c) 10:43:12 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:12 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:12 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000009000100686673630000000008000200000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:12 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1140.820886][T12368] validate_nla: 3 callbacks suppressed [ 1140.820895][T12368] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:12 executing program 5: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x902, 0x0) writev(r0, &(0x7f0000000480)=[{&(0x7f0000000040)="3e350e9266bdb85b62108e0a2b", 0xd}, {&(0x7f00000000c0)="7bda30580690e6e6c101353021618c5f69aaf307679bf34c9a9d51a0bd749d7aee48971243e644d866c7d1bb3870d396e2febada20e023a5d7def51d7fedd7a3867be0f7d10d", 0x46}], 0x2) 10:43:12 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:12 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:12 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1141.067961][T12392] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:13 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) 10:43:13 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x4800, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:13 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:13 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:13 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:13 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x1) fcntl$setstatus(r3, 0x4, 0x102800) write(r3, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r3, r2, 0x0) 10:43:13 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000009000100686673630000000008000200000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1141.920386][T12414] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:13 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:13 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:13 executing program 5: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCSETXW(r0, 0x5435, 0x0) 10:43:13 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1142.072810][T12429] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:14 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:14 executing program 5: connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x5, 0x9, 0xc97, 0x3, 0x0, 0xffffffffffffffff, 0x5, [], 0x0, r1, 0x0, 0x4}, 0x3c) [ 1142.249168][T12440] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:14 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x5c00, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:14 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:14 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:14 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:14 executing program 5: keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000040), &(0x7f0000000180)={'enc=', 'pkcs1', ' hash=', {'crc32c-generic\x00'}}, 0x0, 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f000000aff8)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000cd2ff8)='./file0\x00') symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') umount2(&(0x7f0000000080)='./file0/file0\x00', 0x2) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) open(&(0x7f0000001440)='./file0/file0\x00', 0x0, 0x0) 10:43:14 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x2}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:14 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:14 executing program 5: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x8020001) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RREMOVE(r4, &(0x7f0000000280), 0x1033b) r5 = open(&(0x7f0000000340)='./file0\x00', 0x141042, 0x0) write$P9_RWALK(r5, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x8) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000200)={0x0, r4}) fdatasync(r3) [ 1142.912237][T12456] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:14 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:15 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:15 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1143.109407][T12477] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:15 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1143.317853][T12490] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:15 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x800e, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:15 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:15 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:15 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x2}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:15 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1144.059122][T12504] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:16 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:16 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1144.277082][T12518] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:17 executing program 5: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x8020001) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RREMOVE(r4, &(0x7f0000000280), 0x1033b) r5 = open(&(0x7f0000000340)='./file0\x00', 0x141042, 0x0) write$P9_RWALK(r5, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x8) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000200)={0x0, r4}) fdatasync(r3) 10:43:17 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:17 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x2}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:17 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:17 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:17 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0xe400, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:17 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:17 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:17 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:17 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:17 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:17 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:18 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x545d, 0x0) 10:43:18 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:18 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x2}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:18 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:18 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:18 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x1000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) [ 1147.029749][T12570] validate_nla: 3 callbacks suppressed [ 1147.029757][T12570] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:19 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:19 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:19 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:19 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:19 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1147.245317][T12588] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:19 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1147.388065][T12594] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:19 executing program 5: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/nf_conntrack\x00') sendfile(r0, r1, 0x0, 0x320f) 10:43:19 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:19 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:19 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:19 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x2}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1147.829266][T12619] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:20 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x2000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:20 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:20 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:20 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f00000001c0)) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r4, 0x541a, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, 0x0) dup(r5) socket$packet(0x11, 0x0, 0x300) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, 0x0, &(0x7f0000000200)) creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x40015) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x103}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') 10:43:20 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:20 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1148.103700][T12635] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:20 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:20 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1148.203863][T12646] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:20 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:20 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1148.367108][T12659] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:20 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1148.560096][T12647] device lo entered promiscuous mode [ 1148.566200][T12647] device tunl0 entered promiscuous mode [ 1148.572775][T12647] device gre0 entered promiscuous mode [ 1148.579360][T12647] device gretap0 entered promiscuous mode [ 1148.585804][T12647] device erspan0 entered promiscuous mode [ 1148.592137][T12647] device ip_vti0 entered promiscuous mode [ 1148.598605][T12647] device ip6_vti0 entered promiscuous mode [ 1148.605421][T12647] device sit0 entered promiscuous mode [ 1148.611662][T12647] device ip6tnl0 entered promiscuous mode [ 1148.618489][T12647] device ip6gre0 entered promiscuous mode [ 1148.625172][T12647] device syz_tun entered promiscuous mode [ 1148.631238][T12647] device ip6gretap0 entered promiscuous mode [ 1148.637855][T12647] device bridge0 entered promiscuous mode [ 1148.644038][T12647] device vcan0 entered promiscuous mode [ 1148.649683][T12647] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1148.657460][T12647] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1148.665965][T12647] device bond0 entered promiscuous mode [ 1148.671608][T12647] device bond_slave_0 entered promiscuous mode [ 1148.677996][T12647] device bond_slave_1 entered promiscuous mode [ 1148.685496][T12647] device team0 entered promiscuous mode [ 1148.691117][T12647] device team_slave_0 entered promiscuous mode [ 1148.697823][T12647] device team_slave_1 entered promiscuous mode [ 1148.710285][T12647] device dummy0 entered promiscuous mode [ 1148.716905][T12647] device nlmon0 entered promiscuous mode 10:43:20 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1148.759154][T12647] device caif0 entered promiscuous mode [ 1148.765329][T12647] net_ratelimit: 6 callbacks suppressed [ 1148.765336][T12647] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1148.810665][T12670] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:21 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x3000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:21 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x2}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:21 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:21 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:21 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x5418, 0x805100) 10:43:21 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1149.319281][T12687] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:21 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') getdents64(r0, &(0x7f0000000040)=""/50, 0x32) getdents(r0, &(0x7f00000020c0)=""/45, 0x2d) getdents(r0, &(0x7f00000020c0)=""/41, 0x29) 10:43:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:21 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:21 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1149.511404][T12697] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:22 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x4000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:22 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:22 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:22 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xabb, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4801, 0x0) 10:43:22 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:22 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:22 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:22 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:23 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x5000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:23 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:23 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:23 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1151.834359][ T255] tipc: TX() has been purged, node left! [ 1153.624369][T12800] IPVS: ftp: loaded support on port[0] = 21 [ 1153.685726][T12800] chnl_net:caif_netlink_parms(): no params data found [ 1153.786556][T12800] bridge0: port 1(bridge_slave_0) entered blocking state [ 1153.794754][T12800] bridge0: port 1(bridge_slave_0) entered disabled state [ 1153.803140][T12800] device bridge_slave_0 entered promiscuous mode [ 1153.811764][T12800] bridge0: port 2(bridge_slave_1) entered blocking state [ 1153.819468][T12800] bridge0: port 2(bridge_slave_1) entered disabled state [ 1153.828576][T12800] device bridge_slave_1 entered promiscuous mode [ 1153.848609][T12800] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1153.860055][T12800] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1153.889901][T12800] team0: Port device team_slave_0 added [ 1153.899111][T12800] team0: Port device team_slave_1 added [ 1153.915590][T12800] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1153.922554][T12800] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1153.949211][T12800] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1153.961377][T12800] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1153.968666][T12800] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1153.995840][T12800] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1154.056367][T12800] device hsr_slave_0 entered promiscuous mode [ 1154.094625][T12800] device hsr_slave_1 entered promiscuous mode [ 1154.134388][T12800] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1154.142072][T12800] Cannot create hsr debugfs directory [ 1154.302803][T12800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1154.317884][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1154.332419][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1154.343955][T12800] 8021q: adding VLAN 0 to HW filter on device team0 [ 1154.358538][T32509] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1154.367862][T32509] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1154.377363][T32509] bridge0: port 1(bridge_slave_0) entered blocking state [ 1154.384729][T32509] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1154.455515][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1154.474455][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1154.483242][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1154.492215][ T2822] bridge0: port 2(bridge_slave_1) entered blocking state [ 1154.499519][ T2822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1154.512730][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1154.525683][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1154.543655][T12800] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1154.554778][T12800] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1154.566552][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1154.579360][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1154.588831][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1154.598250][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1154.610246][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1154.619672][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1154.628279][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1154.637725][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1154.713036][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1154.721289][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1154.742835][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1154.750880][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1154.765716][T12800] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1154.830933][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1154.860955][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1154.869821][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1154.878477][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1154.893649][T12800] device veth0_vlan entered promiscuous mode [ 1154.907983][T12800] device veth1_vlan entered promiscuous mode [ 1154.998383][T12800] device veth0_macvtap entered promiscuous mode [ 1155.007330][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1155.017188][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1155.026456][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1155.035525][T32482] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1155.047017][T12800] device veth1_macvtap entered promiscuous mode [ 1155.066781][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1155.077777][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.088839][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1155.100062][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.109984][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1155.120598][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.130672][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1155.141817][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.152010][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1155.162775][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.180613][T12800] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1155.192608][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1155.204553][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.215451][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1155.226391][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.236299][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1155.246872][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.257018][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1155.267509][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.277885][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1155.288680][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.299054][T12800] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1155.310278][T12800] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1155.322166][T12800] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1155.333076][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1155.342786][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1155.352016][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1155.360995][ T2822] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1155.618648][ T255] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1155.631543][ T255] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1155.679007][ T255] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1155.695763][ T255] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1155.705917][ T255] device bridge_slave_1 left promiscuous mode [ 1155.712515][ T255] bridge0: port 2(bridge_slave_1) entered disabled state [ 1155.755660][ T255] device bridge_slave_0 left promiscuous mode [ 1155.762314][ T255] bridge0: port 1(bridge_slave_0) entered disabled state [ 1155.792771][T12814] EXT4-fs (loop5): bad geometry: block count 1080 exceeds size of device (1 blocks) [ 1155.853793][ T255] device veth1_macvtap left promiscuous mode [ 1155.871637][ T255] device veth0_macvtap left promiscuous mode [ 1155.879612][ T255] device veth1_vlan left promiscuous mode [ 1155.893359][ T255] device veth0_vlan left promiscuous mode [ 1155.923285][T12819] EXT4-fs (loop5): bad geometry: block count 1080 exceeds size of device (1 blocks) 10:43:27 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @local}, 0x1c) 10:43:27 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:27 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:27 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:27 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:27 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x6000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) [ 1156.094437][T12831] validate_nla: 6 callbacks suppressed [ 1156.094453][T12831] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1156.128069][T12836] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 10:43:28 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:28 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r2, &(0x7f00000003c0)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r2, &(0x7f0000001080)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000200)="8d2586a7172a6452ce679e50263d1652d0a0634d937c5ac5573f9c6e3316f900c881b818e26ca9bafd2ea2ecaf21a347b91001fbd26f20ad9a3a5807d01f477dfc91bf7f96532ace323c7f8342381b4e", 0x50}, {&(0x7f00000004c0)="129f75395edf432201ff03e0a2ed13e7c8144783fa41a76acb6add53011f26a5c785708cdac3e52fc9bb12596812b8ff180cb9a7be802ce40c3cb81e133bdbc6af9a1d9fb896e289763c877fee83e30d4233e34c255e87027e85f1614f213c66d8ba", 0x62}, {&(0x7f0000000000)="dcb3f9c2285937adea09fe4d21d73ca9b2bfc2d682edee", 0x17}, {&(0x7f0000001340)="11eeff2ce45a418d", 0x8}], 0x4}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000640)="efcdd3f815d6a1d6c6cba732306c6fcd7fe36fa964ec7bba773ea038dc32a2383fe98b1aa623859328ea02fe97800a14ee68d6bf8063f0cb35507a29b0b6522488d1fe1e648402ee926868692e69f204a6625c3ccb87d85c21eba4170e9e", 0x5e}, {&(0x7f0000000700)="e8526ecfb90b0361cba83053c16bcf1e23098005e149d826cecc626bc86e625414bfcaf41c612120bebb51738f550d31af797143e3167accdf035a7d39888d124a4afb8ab737d034b3a7a48db15b1ceba4c9d8ac766b7ab2a1411c2f96923ad7826bf163258c1a06000000a9a769979715cd5cc96dd8aaaccd408cfb652cca229be8add699c03cb5ba7db33480c700d8fa9f52674366839d60a92f674eba6c7b9bd8d9c9a329b3554b67fd801bf49a1f494537948971912e37f5d7024bb6af8e15c52427204b62c4001318d299ea4d37b5b96c2de4d4be6f680f331afd5975788ed1bf3bd653d94b024501fe511cf7e265b5759955d4a9146fa2e007f16aff14202949dd44d8980a3c64e02641707cad26c8", 0x112}], 0x2}}], 0x2, 0x48084) 10:43:28 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:28 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1156.298274][T12847] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:28 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1156.441349][T12856] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:28 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:28 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1156.653665][T12864] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1160.196111][ T255] device hsr_slave_0 left promiscuous mode [ 1160.234197][ T255] device hsr_slave_1 left promiscuous mode [ 1160.289036][ T255] device team_slave_1 left promiscuous mode [ 1160.298473][ T255] team0 (unregistering): Port device team_slave_1 removed [ 1160.308899][ T255] device team_slave_0 left promiscuous mode [ 1160.316707][ T255] team0 (unregistering): Port device team_slave_0 removed [ 1160.328772][ T255] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1160.364590][ T255] device bond_slave_1 left promiscuous mode [ 1160.375539][ T255] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1160.414683][ T255] device bond_slave_0 left promiscuous mode [ 1160.498974][ T255] bond0 (unregistering): Released all slaves 10:43:32 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:32 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:32 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:32 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1160.719292][T12883] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:33 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x7000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000064c0)=@newlink={0x30, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @hsr={{0x8, 0x1, 'hsr\x00'}, {0x4}}}]}, 0x30}}, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) 10:43:33 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:33 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:33 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1161.240442][T12905] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:33 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:33 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x1c01) 10:43:33 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1161.384869][T12912] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1161.560950][T12906] (unnamed net_device) (uninitialized): HSR: Slave1 device not specified 10:43:33 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:33 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:33 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x1c01) 10:43:33 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 1161.706042][T12906] (unnamed net_device) (uninitialized): HSR: Slave1 device not specified [ 1161.772782][T12928] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:34 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x8000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:34 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x1c01) 10:43:34 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_read_part_table(0x0, 0x1, &(0x7f0000000380)=[{&(0x7f00000003c0)="030005fbffff0000001400000000000000480f0000001300000000000500000000004200000000000000000000000000000000000000150000000000000055aa", 0x40, 0x1c0}]) 10:43:34 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:34 executing program 1: syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x1c01) 10:43:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1162.355461][T12953] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1162.430111][T12949] ldm_validate_privheads(): Disk read failed. [ 1162.445353][T12949] loop5: p2 < > [ 1162.447014][T12964] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1162.462937][T12949] loop5: partition table partially beyond EOD, truncated [ 1162.516242][T12949] loop5: p2 start 19 is beyond EOD, truncated [ 1162.541305][T12968] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:34 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:34 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 10:43:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:34 executing program 1: syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x1c01) [ 1162.860924][T12980] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:35 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x11000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:35 executing program 5: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RWALK(r0, &(0x7f0000000040)=ANY=[@ANYRESHEX], 0x12) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="e8"], 0x1) mmap$perf(&(0x7f0000007000/0x3000)=nil, 0x3000, 0x0, 0x412, r0, 0x0) 10:43:35 executing program 1: syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x1c01) 10:43:35 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:35 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) [ 1163.403265][T13001] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:35 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x0) 10:43:35 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:35 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x0) [ 1163.587540][T13012] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:35 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:35 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:35 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 10:43:35 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x0) [ 1163.880873][T13027] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:36 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x40000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:36 executing program 5: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RWALK(r0, &(0x7f0000000040)=ANY=[@ANYRESHEX], 0x12) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="e8"], 0x1) mmap$perf(&(0x7f0000007000/0x3000)=nil, 0x3000, 0x0, 0x412, r0, 0x0) 10:43:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x5414, 0x805100) 10:43:36 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 10:43:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:36 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0xe0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0xc004743e, &(0x7f0000000680)='&@[\x00') unshare(0x24020400) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000480)) 10:43:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:36 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:36 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)) 10:43:36 executing program 5: chdir(0x0) symlink(&(0x7f0000000200)='./file0\x00', &(0x7f00000000c0)='./file0\x00') umount2(&(0x7f0000000080)='./file0/file0\x00', 0x0) 10:43:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:37 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x48000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:37 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:37 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_SET_KEY(0xffffffffffffffff, 0x0, 0x0) creat(0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x10, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) socket(0x200000000000011, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r0, 0x407, 0x0) 10:43:37 executing program 1: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x10000000000025, &(0x7f0000000040)={0x1}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) 10:43:37 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)) 10:43:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x1) 10:43:37 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:37 executing program 5: syz_open_dev$usbfs(&(0x7f0000001280)='/dev/bus/usb/00#/00#\x00', 0x200, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$usbfs(0x0, 0x0, 0x0) dup3(r0, r1, 0x0) 10:43:39 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:39 executing program 5: mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0x1) acct(&(0x7f0000000000)='./file0\x00') 10:43:39 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:39 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x100000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)) 10:43:39 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x5c000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:39 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x31}) [ 1168.008029][T13142] validate_nla: 6 callbacks suppressed [ 1168.008037][T13142] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1168.065930][T13150] EXT4-fs warning (device sda1): verify_group_input:105: Cannot add at group 49 (only 16 groups) 10:43:40 executing program 5: 10:43:40 executing program 1: 10:43:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:40 executing program 0: [ 1168.134816][T13156] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1168.156370][T13148] Process accounting resumed 10:43:40 executing program 1: 10:43:40 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x0, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:40 executing program 5: [ 1168.289118][T13167] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:40 executing program 0: 10:43:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1168.525395][T13180] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:40 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x800e0000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:40 executing program 5: 10:43:40 executing program 1: 10:43:40 executing program 0: 10:43:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:41 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x0, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:41 executing program 0: [ 1169.092116][T13197] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:41 executing program 1: 10:43:41 executing program 5: 10:43:41 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:41 executing program 0: 10:43:41 executing program 1: [ 1169.317699][T13213] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:41 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0xe4000000, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:41 executing program 5: 10:43:41 executing program 0: 10:43:41 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:41 executing program 1: 10:43:41 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x0, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:41 executing program 0: 10:43:41 executing program 1: socket$xdp(0x2c, 0x3, 0x0) r0 = open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f0000000700)=""/233, 0xff2f) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@ipv4={[], [], @empty}}, 0x20) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000140)={'batadv_slave_1\x00', {0x2, 0x4e21, @remote}}) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000100)=0x3, 0x4) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) getpid() open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="7c000000240007dd00"/20, @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000900010067726564000000004c0002000800050000000000080005000000000038000300050000000000000028ceb860244d6a9b5336c1abe5b94b2f00000000000000000000000000000002000000000000da6e0856d62c"], 0x7c}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0xc, &(0x7f0000000100)}], 0x492492492492642, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000340)) add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000500)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) statx(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x200, &(0x7f0000000740)) [ 1170.031695][T13233] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:42 executing program 5: 10:43:42 executing program 0: 10:43:42 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:42 executing program 5: [ 1170.285306][T13252] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:42 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0xfeffffff, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:42 executing program 0: 10:43:42 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:42 executing program 5: 10:43:42 executing program 1: socket$xdp(0x2c, 0x3, 0x0) r0 = open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f0000000700)=""/233, 0xff2f) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@ipv4={[], [], @empty}}, 0x20) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000140)={'batadv_slave_1\x00', {0x2, 0x4e21, @remote}}) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000100)=0x3, 0x4) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) getpid() open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="7c000000240007dd00"/20, @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000900010067726564000000004c0002000800050000000000080005000000000038000300050000000000000028ceb860244d6a9b5336c1abe5b94b2f00000000000000000000000000000002000000000000da6e0856d62c"], 0x7c}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0xc, &(0x7f0000000100)}], 0x492492492492642, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000340)) add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000500)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) statx(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x200, &(0x7f0000000740)) [ 1170.962028][T13262] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:44 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:44 executing program 0: 10:43:44 executing program 5: 10:43:44 executing program 1: socket$xdp(0x2c, 0x3, 0x0) r0 = open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f0000000700)=""/233, 0xff2f) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@ipv4={[], [], @empty}}, 0x20) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000140)={'batadv_slave_1\x00', {0x2, 0x4e21, @remote}}) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000100)=0x3, 0x4) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) getpid() open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="7c000000240007dd00"/20, @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000900010067726564000000004c0002000800050000000000080005000000000038000300050000000000000028ceb860244d6a9b5336c1abe5b94b2f00000000000000000000000000000002000000000000da6e0856d62c"], 0x7c}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0xc, &(0x7f0000000100)}], 0x492492492492642, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000340)) add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000500)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) statx(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x200, &(0x7f0000000740)) 10:43:44 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:44 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0xffffff7f, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) [ 1173.015864][T13285] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:45 executing program 0: 10:43:45 executing program 5: 10:43:45 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:45 executing program 5: 10:43:45 executing program 0: [ 1173.219446][T13298] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:45 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:45 executing program 0: 10:43:45 executing program 1: 10:43:45 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:45 executing program 5: 10:43:45 executing program 0: [ 1173.561249][T13316] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:45 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0xfffffffe, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:45 executing program 5: 10:43:45 executing program 0: 10:43:45 executing program 1: 10:43:45 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:45 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:46 executing program 5: 10:43:46 executing program 1: 10:43:46 executing program 0: [ 1174.031843][T13336] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:46 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:46 executing program 1: 10:43:46 executing program 5: [ 1174.257059][T13347] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:46 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:46 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:46 executing program 0: 10:43:46 executing program 1: 10:43:46 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:46 executing program 5: 10:43:46 executing program 5: 10:43:47 executing program 1: [ 1175.014322][T13363] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:47 executing program 0: 10:43:47 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:47 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:47 executing program 1: [ 1175.264895][T13378] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:47 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x2, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:47 executing program 0: ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40046602, &(0x7f00000000c0)=0x8000) statx(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x1000, 0x400, &(0x7f00000004c0)) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x860800, &(0x7f00000002c0)=ANY=[@ANYBLOB="667300b02ba6d534b3cb1fdc225fac36529d636f6e746578743d"]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x80c5, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="00fb410005d82e53755bb4340216f9d6d4fa0e004077a1709957104ad4264a6a490f100d12b480ccc84f4220f9e5de5c2dd74c97837904f3f488fc461474d426cc5e236327228581466aa2bbe4221fd5dbbeaea5526e5829e9e0f2208681548a45bdcaa2ad85ccc6563525d82a63e3e724eef47d04d8ff1f703c4bf838611788351348cccc49b7d5abb4fc319c85cfe3ffc7b3c93f148173fcbae9641724bce15b3fac313d795df09f7e6871d0c1bf44da7a45f76231cca166dac1a4ca0b848057aa790d7bbd0dd87baf17463b7046a15866138bf0190fda11dfa6bea600f71165c7b26a90bdcc1f62d042ff9ed51dcf5e56efdcf076c65b4dc6d22606219b1f1ab65417997c8a96e592a3575054765090f01ff10ca1746eca72c0b307d0f9a7320f92aa80fe9809cd0000000000"], 0x41, 0x1) removexattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=@known='trusted.overlay.upper\x00') setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000001c0)=0x210e, 0x4) r1 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000140)=0x1, 0x4) mkdirat(r1, 0x0, 0x4) 10:43:47 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:43:47 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:47 executing program 1: socket$xdp(0x2c, 0x3, 0x0) r0 = open(0x0, 0x0, 0x0) getdents(r0, 0x0, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(0xffffffffffffffff, 0x891b, &(0x7f0000000140)={'batadv_slave_1\x00', {0x2, 0x4e21, @remote}}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1e, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(0x0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="7c000000240007dd00"/20, @ANYRES32=r2, @ANYBLOB="00000000ffffffff000000000900010067726564000000004c0002000800050000000000080005000000000038000300050000000000000028ceb860244d6a9b5336c1abe5b94b2f00000000000000000000000000000002000000000000da6e0856d62c"], 0x7c}}, 0x0) r3 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0xc, &(0x7f0000000100)}], 0x492492492492642, 0x0) statx(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x200, &(0x7f0000000740)) 10:43:47 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1175.965758][T13401] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:47 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:43:48 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:48 executing program 0: socket$inet6(0xa, 0x0, 0x80000000000004) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpid() open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="7c000000240007dd00"/20, @ANYRES32=r1, @ANYBLOB="00000000ffffffff000000000900010067726564000000004c0002000800050000000000080005000000000038000300050000000000000028ceb860244d6a9b5336c1abe5b94b2f00000000000000000000000000000002000000000000da6e0856d62c"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r2, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0xc, &(0x7f0000000100)}], 0x492492492492642, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000340)) add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000500)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) statx(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x200, 0x0) 10:43:48 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1176.178160][T13415] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:48 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1176.317930][T13425] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:48 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:48 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x3, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:48 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:48 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:43:48 executing program 0: socket$inet6(0xa, 0x0, 0x80000000000004) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpid() open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="7c000000240007dd00"/20, @ANYRES32=r1, @ANYBLOB="00000000ffffffff000000000900010067726564000000004c0002000800050000000000080005000000000038000300050000000000000028ceb860244d6a9b5336c1abe5b94b2f00000000000000000000000000000002000000000000da6e0856d62c"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r2, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0xc, &(0x7f0000000100)}], 0x492492492492642, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000340)) add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000500)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) statx(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x200, 0x0) 10:43:48 executing program 1: socket$xdp(0x2c, 0x3, 0x0) r0 = open(0x0, 0x0, 0x0) getdents(r0, 0x0, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(0xffffffffffffffff, 0x891b, &(0x7f0000000140)={'batadv_slave_1\x00', {0x2, 0x4e21, @remote}}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1e, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(0x0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="7c000000240007dd00"/20, @ANYRES32=r2, @ANYBLOB="00000000ffffffff000000000900010067726564000000004c0002000800050000000000080005000000000038000300050000000000000028ceb860244d6a9b5336c1abe5b94b2f00000000000000000000000000000002000000000000da6e0856d62c"], 0x7c}}, 0x0) r3 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0xc, &(0x7f0000000100)}], 0x492492492492642, 0x0) statx(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x200, &(0x7f0000000740)) 10:43:49 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0b") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:49 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:49 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:43:49 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:49 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:49 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:49 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:50 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x4, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:50 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:50 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:50 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0b") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:50 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:43:50 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1178.253215][T13506] validate_nla: 6 callbacks suppressed [ 1178.253224][T13506] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:50 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:43:50 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:50 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:50 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1178.527386][T13521] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:50 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:50 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1178.644831][T13528] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:51 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x5, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:51 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:51 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0b") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:51 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:51 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:43:51 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:51 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1179.367823][T13548] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:51 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:43:51 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:51 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:51 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1179.577662][T13565] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:51 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1179.700916][T13571] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:52 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x6, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:52 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:52 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:52 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe847") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:52 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x1c01) 10:43:52 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1180.450239][T13587] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:52 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:43:52 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:52 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) sendfile(r1, r0, 0x0, 0x1c01) 10:43:52 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:52 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendfile(r1, r0, 0x0, 0x1c01) [ 1180.660781][T13599] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1180.786715][T13607] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:52 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1180.967722][T13612] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:53 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x7, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:53 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) sendfile(r1, r0, 0x0, 0x1c01) 10:43:53 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:53 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x841, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)=0x10001) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) sendfile(r1, r0, 0x0, 0x1c01) 10:43:53 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe847") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:53 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000180), 0x572, 0x0) 10:43:53 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000180), 0x572, 0x0) 10:43:53 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) 10:43:53 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:53 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:54 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x8, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:54 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:54 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000180), 0x572, 0x0) 10:43:54 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe847") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:54 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:54 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:43:54 executing program 1: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/19, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:54 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:55 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x11, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:55 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:43:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:55 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:55 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe84780") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1183.690723][T13712] validate_nla: 8 callbacks suppressed [ 1183.690730][T13712] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:55 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:43:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:55 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1183.927716][T13733] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:56 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1184.027688][T13737] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:56 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:56 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1184.143863][T13741] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:56 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x48, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:56 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:56 executing program 5: socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r0, &(0x7f0000000180), 0x572, 0x0) 10:43:56 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:56 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:56 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe84780") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1184.848663][T13760] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:56 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:56 executing program 5: socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r0, &(0x7f0000000180), 0x572, 0x0) [ 1184.992895][T13774] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:57 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1185.110229][T13772] debugfs: File 'dropped' in directory 'loop0' already present! [ 1185.129117][T13772] debugfs: File 'msg' in directory 'loop0' already present! [ 1185.166718][T13780] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1185.177079][T13772] debugfs: File 'trace0' in directory 'loop0' already present! 10:43:57 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:57 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) [ 1185.316387][T13787] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:57 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x5c, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:57 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:57 executing program 5: socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r0, &(0x7f0000000180), 0x572, 0x0) 10:43:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:43:57 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) 10:43:57 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe84780") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:57 executing program 5: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r0, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:43:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1185.906914][T13807] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:57 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) 10:43:57 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:58 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1186.104565][T13825] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:43:58 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:58 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) 10:43:58 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:58 executing program 5: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r0, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:43:58 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0xe4, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:58 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:58 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:58 executing program 5: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r0, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:43:58 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) 10:43:58 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:59 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:59 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) 10:43:59 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:59 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:43:59 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:59 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:59 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x300, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:43:59 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:43:59 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:43:59 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:43:59 executing program 5: socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r0, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:43:59 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:00 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:00 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:00 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:00 executing program 5: socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r0, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:00 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:00 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:00 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x500, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:00 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:00 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db", @ANYRES32=0x0], 0x5, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:00 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:00 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:00 executing program 5: socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r0, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:00 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1189.003237][T13940] validate_nla: 7 callbacks suppressed [ 1189.003245][T13940] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:01 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:01 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:01 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1189.182026][T13956] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:01 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:01 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1189.359857][T13969] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:02 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x600, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:02 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:02 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:02 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:02 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:02 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:02 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1190.146269][T13988] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:02 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:02 executing program 1: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:02 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:02 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:02 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1190.400168][T14004] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:03 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x700, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:03 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:03 executing program 1: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:03 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:03 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1191.109171][T14028] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:03 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:03 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:03 executing program 1: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/igmp6\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1191.398451][T14047] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:03 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1191.557506][T14055] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:04 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0xe80, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:04 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:04 executing program 1: setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:04 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db"], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:04 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:04 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1192.328681][T14068] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:04 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:04 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:04 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) [ 1192.484390][T14081] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:04 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:04 executing program 1: setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:04 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:05 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x1100, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:05 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:05 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db"], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:05 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:05 executing program 1: setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:05 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:05 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:05 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:05 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:05 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:05 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:05 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:06 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x4000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:06 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:06 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:06 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:06 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYBLOB="00b237afa45aa94200a476cafb3cca8b40b5bb3b612f96d4f3b789ef71d61f78de1b093fdaf9caf1b3f845d91d5506cae2990eb0a39048fa307d8e8ad4efcb2fd33d3ad2096940e7a321d7ecf6db"], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:06 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1194.688840][T14154] validate_nla: 4 callbacks suppressed [ 1194.688847][T14154] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:06 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:06 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1194.850941][T14168] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:06 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1194.966996][T14172] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:07 executing program 1: syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1195.091272][T14175] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:07 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x4800, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:07 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:07 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:07 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:07 executing program 1: syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:07 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRESDEC=r10], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1195.760977][T14198] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:07 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1], 0x2}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:07 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:07 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:07 executing program 1: syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000240)=0x5, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1195.988920][T14214] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:07 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1196.140671][T14218] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:08 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x5c00, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:08 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:08 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:08 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1], 0x2}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:08 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32=0x0], 0x3, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1196.896681][T14235] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:08 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1], 0x2}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:08 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1197.112055][T14250] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:09 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:09 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:09 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) [ 1197.256951][T14254] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:09 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x800e, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:09 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) 10:44:09 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:09 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:09 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:09 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32=0x0], 0x3, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:10 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:10 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:10 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) 10:44:10 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32=0x0], 0x3, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:10 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:10 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:11 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:11 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:11 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:11 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:11 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0xe400, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:11 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64, @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:11 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:11 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c00000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1199.250164][T14330] debugfs: File 'dropped' in directory 'loop0' already present! [ 1199.280895][T14330] debugfs: File 'msg' in directory 'loop0' already present! 10:44:11 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:11 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1199.301669][T14330] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:11 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:11 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64, @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:11 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:11 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:11 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:11 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1199.777113][T14362] validate_nla: 8 callbacks suppressed [ 1199.777121][T14362] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:12 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x1000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:12 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:12 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:12 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c00000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:12 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:12 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64, @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1200.344813][T14381] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:12 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c00000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:12 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1200.449036][T14387] debugfs: File 'dropped' in directory 'loop0' already present! [ 1200.471579][T14387] debugfs: File 'msg' in directory 'loop0' already present! [ 1200.486051][T14392] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:12 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1200.510662][T14387] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:12 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:12 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) [ 1200.672841][T14401] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:12 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:13 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x2000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:13 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:13 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:13 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00"/75], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:13 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:13 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) [ 1201.476836][T14423] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:13 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00"/75], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:13 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:13 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1201.671773][T14435] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:13 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:13 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) 10:44:13 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1201.848372][T14445] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:14 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x3000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:14 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:14 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00"/75], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:14 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:14 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) 10:44:14 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:14 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00"/88], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1202.524246][T14465] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:14 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:14 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) 10:44:14 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1202.732732][T14479] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:14 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:14 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) [ 1202.917795][T14490] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:15 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x4000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:15 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:15 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) 10:44:15 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:15 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00"/88], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:15 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:15 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:15 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) 10:44:15 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00"/88], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:15 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:15 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:15 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) 10:44:16 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x5000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:16 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:16 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:16 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:16 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) 10:44:16 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:16 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:16 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:16 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:16 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1204.875636][T14566] validate_nla: 4 callbacks suppressed [ 1204.875643][T14566] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:16 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:16 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1205.051555][T14577] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:17 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x6000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:17 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:17 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:17 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:17 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:17 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1205.703047][T14598] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:17 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:17 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:17 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1205.939651][T14614] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:18 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x7000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:18 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:18 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:18 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:18 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:18 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:18 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1206.863522][T14637] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:18 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:18 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:18 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1206.959173][T14643] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:19 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:19 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1207.138483][T14656] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:19 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x8000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:19 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:19 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:19 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:19 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c100000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:19 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1207.932823][T14676] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:19 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:19 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c100000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:20 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:20 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1208.144506][T14691] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:20 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:20 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1208.245677][T14694] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:20 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x11000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:20 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:20 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:20 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:20 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c100000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:20 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:20 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:21 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:21 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:21 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:21 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x40000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:21 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x2}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:21 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:21 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:21 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1210.038883][T14751] validate_nla: 4 callbacks suppressed [ 1210.038891][T14751] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:22 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x2}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:22 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:22 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1210.333233][T14775] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:22 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:22 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1210.524591][T14784] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:23 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x48000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:23 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:23 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:23 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x2}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:23 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:23 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:23 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) [ 1211.173359][T14801] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:23 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:23 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1211.355013][T14815] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:23 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:23 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:23 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1211.570837][T14822] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1211.700824][T14828] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:24 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x5c000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:24 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:24 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1, @ANYRES32], @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:24 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:24 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:24 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1212.286943][T14848] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:24 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:24 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r1, &(0x7f0000000180), 0x572, 0x0) 10:44:24 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:24 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:24 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1212.415548][T14855] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:24 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1212.601388][T14865] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:25 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x800e0000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:25 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:25 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:25 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:25 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:25 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x2}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:25 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:25 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:25 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, 0x0) 10:44:25 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x2}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:25 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x0}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:25 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:26 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0xe4000000, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:26 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, 0x0) 10:44:26 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x2}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:26 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:26 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x2}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:26 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:26 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:26 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x3}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:26 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:26 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, 0x0) 10:44:26 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x5}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:26 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(0x0, &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:27 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0xfeffffff, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:27 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x0, 0x3ff}) 10:44:27 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x6}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:27 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:27 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:27 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:27 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:27 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x0, 0x3ff}) [ 1215.515346][T14967] validate_nla: 6 callbacks suppressed [ 1215.515352][T14967] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:27 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:27 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x8}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:27 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:27 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x0, 0x3ff}) [ 1215.797299][T14987] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:28 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0xffffff7f, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:28 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x9}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:28 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) 10:44:28 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400}) 10:44:28 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c000000240007050000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:28 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR, @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:28 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c000000240007050000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:28 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1216.699468][T15011] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:28 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0xa}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:28 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400}) 10:44:28 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) [ 1216.911723][T15025] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:28 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0xb}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1217.101786][T15033] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:29 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0xfffffffe, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:29 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400}) 10:44:29 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) 10:44:29 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x10}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:29 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c000000240007050000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:29 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR, @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:29 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x11}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1217.818706][T15044] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:29 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) 10:44:29 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400}) [ 1217.970992][T15056] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:29 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x12}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:30 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) [ 1218.115973][T15068] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:30 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:30 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:30 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x14}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:30 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:30 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:30 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:30 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR, @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:30 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1218.950968][T15088] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:31 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x18}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1219.159535][T15103] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1219.176542][T15099] debugfs: File 'dropped' in directory 'loop0' already present! [ 1219.189277][T15099] debugfs: File 'msg' in directory 'loop0' already present! 10:44:31 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1={0xff, 0x1, [], 0x25}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1219.215405][T15099] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:31 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:31 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:31 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x4}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1219.542287][T15118] debugfs: File 'dropped' in directory 'loop0' already present! [ 1219.558481][T15118] debugfs: File 'msg' in directory 'loop0' already present! [ 1219.567530][T15118] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:31 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x2, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:31 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x5}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:31 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:31 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:31 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:31 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:31 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x8}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:31 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1220.128400][T15141] debugfs: File 'dropped' in directory 'loop0' already present! [ 1220.144232][T15141] debugfs: File 'msg' in directory 'loop0' already present! 10:44:32 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x9}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:32 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1220.176916][T15141] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:32 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1220.258524][T15155] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 10:44:32 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x0}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1220.521397][T15162] debugfs: File 'dropped' in directory 'loop0' already present! [ 1220.561049][T15162] debugfs: File 'msg' in directory 'loop0' already present! [ 1220.646482][T15162] debugfs: File 'trace0' in directory 'loop0' already present! [ 1220.964098][ T255] unregister_netdevice: waiting for veth1 to become free. Usage count = 1 10:44:32 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x3, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:32 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x2}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:32 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:32 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:32 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:32 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:33 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x4}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:33 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:33 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32=r1], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1221.282661][T15188] validate_nla: 7 callbacks suppressed [ 1221.282668][T15188] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:33 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x5}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1221.415067][T15182] debugfs: File 'dropped' in directory 'loop0' already present! [ 1221.431667][T15182] debugfs: File 'msg' in directory 'loop0' already present! [ 1221.441811][T15182] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:33 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1221.481580][T15198] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:33 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1221.627862][T15202] debugfs: File 'dropped' in directory 'loop0' already present! [ 1221.660796][T15202] debugfs: File 'msg' in directory 'loop0' already present! [ 1221.704856][T15202] debugfs: File 'trace0' in directory 'loop0' already present! [ 1221.723530][T15207] debugfs: File 'dropped' in directory 'loop0' already present! [ 1221.739273][T15207] debugfs: File 'msg' in directory 'loop0' already present! [ 1221.795268][T15207] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:34 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x4, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff00", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:34 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:34 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:34 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff00", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1222.246484][T15221] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x7}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:34 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1222.310664][T15223] debugfs: File 'dropped' in directory 'loop0' already present! [ 1222.331163][T15223] debugfs: File 'msg' in directory 'loop0' already present! 10:44:34 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1222.463001][T15223] debugfs: File 'trace0' in directory 'loop0' already present! [ 1222.471460][T15234] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:34 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:34 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x8}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1222.641127][T15245] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:35 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x5, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) getresgid(&(0x7f0000000000), 0x0, &(0x7f0000000100)) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:35 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:35 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x9}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:35 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff00", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x3}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:35 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1223.261831][T15262] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:35 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x0, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1223.308250][T15263] debugfs: File 'dropped' in directory 'loop0' already present! 10:44:35 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1223.359923][T15263] debugfs: File 'msg' in directory 'loop0' already present! 10:44:35 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0xa}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1223.483766][T15263] debugfs: File 'trace0' in directory 'loop0' already present! [ 1223.509127][T15279] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:35 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0xb}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:35 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1223.700270][T15289] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:36 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x6, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0xc}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:36 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x0, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:36 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:36 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:36 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) [ 1224.268288][T15306] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:36 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0xd}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:36 executing program 1: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1224.411499][T15324] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0xe}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:36 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:36 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x10}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:37 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x7, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:37 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:37 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:37 executing program 1: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:37 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x11}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:37 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x0, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:37 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x12}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:37 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:37 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:37 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x1800}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1225.408631][T15364] debugfs: File 'dropped' in directory 'loop0' already present! [ 1225.423427][T15364] debugfs: File 'msg' in directory 'loop0' already present! [ 1225.470560][T15364] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:37 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x0}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:37 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:38 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x8, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:38 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRESHEX, @ANYRES32, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:38 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:38 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:38 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:38 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:38 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:38 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1226.356462][T15411] debugfs: File 'dropped' in directory 'loop0' already present! [ 1226.376644][T15411] debugfs: File 'msg' in directory 'loop0' already present! 10:44:38 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:38 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:38 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1226.407406][T15419] validate_nla: 7 callbacks suppressed [ 1226.407413][T15419] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1226.425869][T15411] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:38 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1226.562496][T15430] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1226.648731][T15434] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:39 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:39 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:39 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:39 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:39 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x11, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:39 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) [ 1227.329510][T15448] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:39 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x5}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1227.419390][T15455] debugfs: File 'dropped' in directory 'loop0' already present! [ 1227.440719][T15455] debugfs: File 'msg' in directory 'loop0' already present! 10:44:39 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1227.473839][T15463] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1227.477306][T15455] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:39 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x6}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:39 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x7}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1227.630707][T15471] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1227.661932][T15473] debugfs: File 'dropped' in directory 'loop0' already present! 10:44:39 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1227.699236][T15473] debugfs: File 'msg' in directory 'loop0' already present! [ 1227.745761][T15473] debugfs: File 'trace0' in directory 'loop0' already present! [ 1227.762595][T15478] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:39 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:39 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:39 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:40 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x8}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:40 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:40 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x48, 0x0, 0x0]}]}}}}}}, 0x66) 10:44:40 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1228.393626][T15499] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 10:44:40 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x9}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:40 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x0, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:40 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:40 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0xa}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) [ 1228.581431][T15515] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1228.601159][T15516] debugfs: File 'dropped' in directory 'loop0' already present! [ 1228.610810][T15516] debugfs: File 'msg' in directory 'loop0' already present! 10:44:40 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) [ 1228.635625][T15516] debugfs: File 'trace0' in directory 'loop0' already present! [ 1228.717293][T15523] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1228.751020][T15525] debugfs: File 'dropped' in directory 'loop0' already present! [ 1228.779329][T15525] debugfs: File 'msg' in directory 'loop0' already present! [ 1228.798500][T15525] debugfs: File 'trace0' in directory 'loop0' already present! 10:44:42 executing program 4: timer_create(0x0, &(0x7f0000000340)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod(&(0x7f00000000c0)='./bus\x00', 0x100c, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, r2+30000000}}, 0x0) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="0000b2000000"], 0x5}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x3}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl(r10, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="c7873fe1c1ab909155a5c7a8cd17f22d8c3ea70190e9c16e2c686b9a4903f42c6ccaf3bc13c1b51c6b74cb612dc621dcf3f195af450440a5f436d197e17ed5c26dc229c54228995105", @ANYPTR, @ANYRES64], @ANYBLOB="b2e4ebf8b63995", @ANYRESOCT, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYPTR, @ANYRES32=r1, @ANYRES32], @ANYRES32, @ANYRES16, @ANYRESHEX], @ANYRES32=0x0], 0x4, 0x0) tkill(r3, 0x1004000000013) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="fa"], 0x1) sysfs$2(0x2, 0x5, &(0x7f0000000040)=""/55) 10:44:42 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x60, 0x2, 0x1, 0x401, 0x0, 0x0, {}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr="7f5495399eba860f8ec6c0c8c61f84f4"}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0xb}]}, @CTA_ZONE={0x6}]}, 0x60}}, 0x0) 10:44:42 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:42 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0xff00) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3ff}) 10:44:42 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c00000024000705000000000000e6ffffff0000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff0000000008000d000200000008000100736671004800020000000000000000682ca91c0000000000000000000000ae143d490b4f00000000000000000000000000000000000000000000000000000000000000c10000000000000000"], 0x7c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x0, &(0x7f0000000000)="080db5055e0bcfe8478071") sendmmsg$alg(r2, &(0x7f0000000180), 0x572, 0x0) 10:44:42 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @remote}}) write$tun(r0, &(0x7f00000000c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @remote}, @redirect={0x5, 0x0, 0x0, @rand_addr, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @empty, {[@rr={0x7, 0x13, 0x0, [@loopback, @empty, @local, @broadcast]}, @timestamp={0x44, 0x18, 0x0, 0x0, 0x0, [0x0, 0x0, 0x5c, 0x0, 0x0]}]}}}}}}, 0x66)