, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) 20:16:16 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000c000000000008000400", @ANYRES32], 0x38}}, 0x0) [ 836.751738][ T426] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. 20:16:16 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x3}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:16 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000f000000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, &(0x7f00000000c0)=0x1, 0x4) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newtfilter={0x2c, 0x66, 0xd27, 0x1000000, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:16 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x5}, 0x0) 20:16:16 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000010000000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:16 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x4}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:16 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x5}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:16 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000014000000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:17 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x6}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="240400006400270d000000000000000000080000", @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000060000000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:17 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x6}, 0x0) 20:16:17 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x7}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000030000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:17 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x8}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000050000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:17 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x9}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x814}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:17 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x0) 20:16:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000060000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:17 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0xa}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:17 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0xb}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000090000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:18 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0xc}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:18 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f0000000440)={&(0x7f0000000280), 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x34, 0xe, 0x6, 0x201, 0x0, 0x0, {0xc, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40810}, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r6], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newtfilter={0x54, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xf}, {0xffff, 0x13}}, [@filter_kind_options=@f_flower={{0xb, 0x1, 'flower\x00'}, {0x24, 0x2, [@TCA_FLOWER_KEY_CT_ZONE_MASK={0x6, 0x5e, 0x8}, @TCA_FLOWER_KEY_MPLS_BOS={0x5, 0x44, 0x7}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x1d}, @TCA_FLOWER_KEY_ARP_SIP_MASK={0x8, 0x3a, 0xffffff00}]}}]}, 0x54}}, 0x0) 20:16:18 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x9}, 0x0) 20:16:18 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0xd}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:18 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000a0000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:18 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0xe}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:18 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xa}, 0x0) 20:16:18 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000320a0000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:18 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100), 0x7}], 0x492492492492805, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x2c, &(0x7f00000000c0)=[@in6={0xa, 0x4e22, 0xd0b2, @private2={0xfc, 0x2, [], 0x1}, 0x8}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000300)=0x10) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000340)={r5, 0x1}, &(0x7f0000000380)=0x8) r6 = socket(0x10, 0x803, 0x0) ioctl$VHOST_RESET_OWNER(0xffffffffffffffff, 0xaf02, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000009c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000da8b0023b3c4ad506828131a09000000e7966ca57b99f76d4755d20003ce7c702b7732666d7aa4ff735b27704629817e78de16f3e12c640a9273213f0603a385447f4e157971d3b0c103fa76774ca34a8fd844616ba3b0d3eebac642e8d6b06ebbe07cfca4471f833fcdcd044d47df9013188a244c3e5a5f23220f47651645be182c4c822e1d12b76825fe6b86a6024d0bcb9ae7c2ecf38385d2899a58e91f00e99ca0972517510cc767544c275dfa7e602d02c7184821b8e9ba87da2d", @ANYRES32=r7, @ANYBLOB="00000000ffff04ff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r7], 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x10}, {0xffe0}, {0x0, 0xffff}}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x2c004000) ioctl$TIOCGPKT(0xffffffffffffffff, 0x80045438, &(0x7f0000000440)) getegid() setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000005c0)=@filter={'filter\x00', 0xe, 0x4, 0x390, 0xffffffff, 0xf8, 0x1f0, 0x1f0, 0xffffffff, 0xffffffff, 0x2c0, 0x2c0, 0x2c0, 0xffffffff, 0x4, &(0x7f00000003c0), {[{{@ipv6={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xff, 0xff000000, 0xffffffff], 'veth0_vlan\x00', 'ipvlan0\x00', {}, {0xff}, 0xff, 0xff, 0x2, 0x42}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}, {0x7a, 0xc2}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@hl={{0x28, 'hl\x00'}, {0x2, 0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x4}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) 20:16:18 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0xf}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:18 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000b0000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:18 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x10}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:18 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xc}, 0x0) 20:16:18 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000c0000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:18 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x11}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:19 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000f0000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) ioctl$VIDIOC_G_OUTPUT(0xffffffffffffffff, 0x8004562e, &(0x7f00000000c0)) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:19 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xf}, 0x0) 20:16:19 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x12}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:19 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000140000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:19 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x48}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:19 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x4c}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x53, &(0x7f00000000c0)={0x7, 0x7, 0xffffffffffffffff}, &(0x7f0000000280)=0x28) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:19 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000a320000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:19 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) 20:16:19 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x60}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:19 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000088470000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:19 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x68}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r1, 0x8040942d, &(0x7f00000000c0)) 20:16:19 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x60}, 0x0) 20:16:19 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000088480000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:20 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x6c}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000065580000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:20 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x74}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:20 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x300}, 0x0) 20:16:20 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x7a}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000600000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x25, 0x4, 0x0) r5 = socket$netlink(0x10, 0x3, 0x8000000004) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r6, @ANYBLOB="be0c0000ffffffff00000000090001000500736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r6], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0x2}}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) r7 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000380)={'vxcan1\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340)='nl80211\x00') sendmsg$NL80211_CMD_NEW_MPATH(r9, &(0x7f0000000500)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x20, r10, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x20}, 0x1, 0x0, 0x0, 0x4040}, 0x4000014) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r7, 0x84, 0x15, &(0x7f0000000280)={0x5}, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000440)={'vcan0\x00', r8}) 20:16:20 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 840.956164][ T724] __nla_validate_parse: 58 callbacks suppressed [ 840.956181][ T724] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 841.012343][ T725] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 20:16:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000058650000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:20 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x2}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 841.187866][ T723] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 841.213064][ T745] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:20 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x500}, 0x0) [ 841.252412][ T725] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 20:16:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000810000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:20 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x3}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 841.432724][ T755] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:21 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x4}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 841.553974][ T757] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:21 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="2a30afb32a8700000000b87d1dbe67161de5442d2c4ab09841af3f434387bbca98690100000000000000729281f1d23cbacfdba7913c4e9cc011f389674a924e2a419a12aefcaf06292287e9adeee86e6c78835a9da19b", @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:21 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000047880000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:21 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x600}, 0x0) 20:16:21 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x5}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 841.763704][ T776] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 20:16:21 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x6}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 841.943946][ T777] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 841.979181][ T779] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:21 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000048880000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:21 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x7}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:21 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000600000007050000e88107a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:21 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x8}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:21 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000400300000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:21 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x900}, 0x0) 20:16:22 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x9}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:22 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000034000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:22 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xa00}, 0x0) 20:16:22 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000001000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:22 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xa}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) prctl$PR_GET_FPEXC(0xb, &(0x7f00000000c0)) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:22 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000002000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:22 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xb}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:22 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xc}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:22 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000003000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:22 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xc00}, 0x0) 20:16:22 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xd}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) timerfd_gettime(r5, &(0x7f00000000c0)) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) r7 = socket$caif_stream(0x25, 0x1, 0x3) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r7, 0x6612) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r6], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:22 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000004000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:23 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xe}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:23 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xc4e}, 0x0) 20:16:23 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000005000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:23 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xf}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:23 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000006000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:23 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x10}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x6, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:23 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xec0}, 0x0) 20:16:23 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000008000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:23 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x11}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:23 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x12}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:23 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000009000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:23 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x48}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:23 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xf00}, 0x0) 20:16:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x7, 0x40) write$P9_RVERSION(r2, &(0x7f0000000280)={0x13, 0x65, 0xffff, 0x8000, 0x6, '9P2000'}, 0x13) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r2, 0x800455d1, &(0x7f0000000300)) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r6], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000a000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:24 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x4c}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000b000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:24 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 20:16:24 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x60}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000c000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) accept4$x25(r4, &(0x7f00000000c0), &(0x7f0000000280)=0x12, 0x800) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:24 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x68}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:24 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4788}, 0x0) 20:16:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000f000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:24 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x6c}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:24 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x74}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000010000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800ff00000005070000000000000000f800000000aa0eaf86017f483a5277cde63db25d2bb28a8ca8f0ea5021b94737d660630c04cfe0430ea7d4df47aa1f331ffef55415ed0ffab6c4181f1a3b23fea15639fbf891cf6f599489570e9fa20fbc3c421a8576a79c1a7169a8f1506fa571ed4ac1472ae68f7613bd67f03b4f3136a4045ac342b1e31084447e0fd53a8e99c8378359344c4887d3b4eb79990335bc3d180d708785", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480)='/dev/zero\x00', 0x20100, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f00000004c0)=0x800) ioprio_set$uid(0x0, 0xee01, 0x4000) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)={0x1c, 0x0, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x84) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000014000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:25 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4888}, 0x0) 20:16:25 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x7a}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}, 0x1, 0x0, 0x0, 0x840}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r4], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:25 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x300}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:25 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000a32000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:25 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4e0c}, 0x0) 20:16:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="48000000100005070000000000000000000000008d81b928aecc15dfbf01c025d3a3009567a761d379ed92d911a2f2eaf2698f0c60f64a766ba45f27aed9fa6093f1342d384e9ab36fa87fa127e9fa391e15b6d90100"/97, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) r6 = eventfd(0x1) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="380000003c000705edffff3b07a2a30005e30000", @ANYBLOB="d35e6dee7d0aa28f76b341044753c41d3c397bbb7c52dcc28e2f1f110bdb379830db658de81e7fee90ff1256d9707b102ba9c85252a1cf64fb8eab84f66ec3510d6e890b44ac6fbb0d65542684f6957527e47a4019e97b4b5b342a32b08720e1b95580b60ce62b57bfadddcdcb84dfd8a6be0a61ebef53643e7f6bba37b73b826324212c1085162d5d9b044207109b753cfead14503236cfa66385002b69f2340ac4633eb49358d9c84a567593db413a581e4084a6d1cd0d1a5e8945491a47485178", @ANYRES32=r6], 0x38}}, 0x4) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:25 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000060000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:25 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x500}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:25 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000005865000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:25 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x600}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 846.011231][ T1064] __nla_validate_parse: 54 callbacks suppressed [ 846.011239][ T1064] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'. [ 846.045149][ T1072] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:25 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x700}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 846.166169][ T1078] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:25 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000081000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) setsockopt$inet_sctp_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f00000000c0), 0x4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000500000900010068667363e4ff00080002000000000000000029dcaac236db043b264aa6125968170efcffffffffffffff5977cf1e1e52c2321dbb4c53fc9bd64b2d0b236fa60fdd91bd817e273c39697f0c98fe88810f63a8bcad5a0b91ccfa83efac15fc44c2335ccc8e9ee7ce16c3546572bcb0950bf27a499154fe71dd112eee0f710df2a39407fa24124fcc70"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:25 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x5865}, 0x0) 20:16:25 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x900}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 846.358599][ T1096] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 20:16:26 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xa00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 846.536776][ T1098] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:26 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xb00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 846.694899][ T1099] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 846.714075][ T1101] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 846.737359][ T1098] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:26 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000004788000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:26 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xc00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 846.770511][ T1106] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 846.795233][ T1096] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. 20:16:26 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x6000}, 0x0) 20:16:26 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000004888000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:26 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xd00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:26 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000ffffa888000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:26 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xe00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:26 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x6558}, 0x0) 20:16:26 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000ffffff9e000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:27 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0xf00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:27 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000e13c5cd7000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:27 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x1100}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:27 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000d75c3ce1000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:27 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x1200}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:27 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8100}, 0x0) 20:16:27 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000ffffffef000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:27 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x1216}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:27 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8847}, 0x0) 20:16:27 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000fffffff0000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:27 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x1612}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:27 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000088a8ffff000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:27 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x0) 20:16:27 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x3f00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:28 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x4000}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:28 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000007fffffff000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:28 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xc00e}, 0x0) 20:16:28 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x4800}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:28 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000009effffff000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:28 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x4c00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:28 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000efffffff000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:28 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000}, 0x0) 20:16:28 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x6000}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:28 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000f0ffffff000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:28 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x6800}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:28 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x34000}, 0x0) 20:16:28 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x6c00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:28 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000020000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:29 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x400300}, 0x0) 20:16:29 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x7400}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000030000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:29 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x7a00}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000040000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:29 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x4}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:29 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x1000000}, 0x0) [ 849.798786][ T1318] netlink: 'syz-executor.2': attribute type 7 has an invalid length. [ 849.821383][ T1320] netlink: 'syz-executor.2': attribute type 7 has an invalid length. 20:16:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000050000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:29 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x48}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:29 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) [ 849.995923][ T1330] netlink: 'syz-executor.2': attribute type 7 has an invalid length. 20:16:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000060000000008000400", @ANYRES32], 0x38}}, 0x0) [ 850.055535][ T1333] netlink: 'syz-executor.2': attribute type 7 has an invalid length. 20:16:29 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x2}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000080000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:29 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x3000000}, 0x0) [ 850.242516][ T1345] netlink: 'syz-executor.2': attribute type 2 has an invalid length. [ 850.297080][ T1349] netlink: 'syz-executor.2': attribute type 2 has an invalid length. 20:16:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000090000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:30 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0xa}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 850.491675][ T1363] netlink: 'syz-executor.2': attribute type 10 has an invalid length. [ 850.532881][ T1367] netlink: 'syz-executor.2': attribute type 10 has an invalid length. 20:16:30 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 20:16:30 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000a0000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:30 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x10}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:30 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x5000000}, 0x0) 20:16:30 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000b0000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:30 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x23}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:30 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:30 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000c0000000008000400", @ANYRES32], 0x38}}, 0x0) [ 851.051385][ T1388] __nla_validate_parse: 50 callbacks suppressed [ 851.051396][ T1388] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 851.079563][ T1386] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:30 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x6000000}, 0x0) 20:16:30 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 851.186024][ T1403] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:30 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2, @local}, 0x10) getpeername$inet(r0, &(0x7f0000001180)={0x2, 0x0, @remote}, &(0x7f00000011c0)=0x10) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r2 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self\x00', 0x1200, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP(r2, 0xd0009412, &(0x7f0000000100)={0x0, 0x5}) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000001200)) setsockopt$rose(0xffffffffffffffff, 0x104, 0x1, &(0x7f0000000080)=0x9, 0x4) ioctl$VIDIOC_QUERYCTRL(0xffffffffffffffff, 0xc0445624, &(0x7f0000001100)={0x7, 0x4, "10989c12935ace3ad7eda9b9540d328674d1db667e3582b2f4f6367dff25a45c", 0xfffffffc, 0x8, 0x80000000, 0x7, 0x232}) 20:16:30 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000f0000000008000400", @ANYRES32], 0x38}}, 0x0) [ 851.237777][ T1406] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:30 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 851.403432][ T1416] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 851.433174][ T1410] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:31 executing program 1: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) r1 = signalfd(r0, &(0x7f0000000040)={[0xd253]}, 0x8) ioctl$mixer_OSS_GETVERSION(r1, 0x80044d76, &(0x7f0000000080)) ioctl$SNDCTL_DSP_STEREO(r0, 0xc0045003, &(0x7f00000000c0)) sendmsg$BATADV_CMD_TP_METER_CANCEL(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x400}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20040000}, 0x4004089) 20:16:31 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000100000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:31 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x4}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) sendmsg$TIPC_CMD_SHOW_PORTS(r10, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) 20:16:31 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x0) [ 851.639562][ T1436] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:31 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:31 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000140000000008000400", @ANYRES32], 0x38}}, 0x0) [ 851.779272][ T1444] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 851.794879][ T1443] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) sendmsg$TIPC_CMD_SHOW_PORTS(r10, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) 20:16:31 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x6}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 851.960748][ T1450] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 851.996436][ T1447] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:31 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000600000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:31 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x7}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 852.143226][ T1460] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:31 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x9000000}, 0x0) 20:16:31 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000300000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) sendmsg$TIPC_CMD_SHOW_PORTS(r10, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) 20:16:31 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x8}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:32 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000500000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:32 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x9}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 852.477138][ T1481] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:32 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xa000000}, 0x0) 20:16:32 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000600000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) sendmsg$TIPC_CMD_SHOW_PORTS(r10, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) 20:16:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r2 = socket$netlink(0x10, 0x3, 0x8000000004) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000000280)={"07a92897b878c2a563f1fb0c174c2b95", 0x0, 0x0, {0x2, 0x9}, {0x5, 0x5}, 0x8, [0x10001, 0xaae, 0x32d7049b, 0x1, 0x9, 0x4, 0x5, 0x80000000, 0x4, 0x5, 0x16, 0xff, 0x3, 0x18000000, 0x1b8, 0x9]}) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r0, 0x5000943f, &(0x7f0000000380)={{r0}, r3, 0x14, @unused=[0x2, 0xffffffffffffa63a, 0x431, 0x10000], @subvolid=0xa928}) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x141003, 0x0) vmsplice(r4, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r4, 0x800c5012, &(0x7f0000000180)) writev(r2, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x501401, 0x0) ioctl$sock_qrtr_TIOCINQ(r5, 0x541b, &(0x7f0000001380)) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x60, r1, 0x917, 0x70bd2d, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x60}}, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000100)={'caif0\x00', 0x7f}) [ 852.676820][ T1503] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:32 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0xa}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:32 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000900000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000000)) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) 20:16:32 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0xb}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 852.961936][ T1525] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:32 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000a00000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:32 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xc000000}, 0x0) 20:16:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r2 = syz_usb_connect$cdc_ncm(0x4, 0xa4, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x92, 0x2, 0x1, 0x4, 0x88, 0x5, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "4d1ff4"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x5544, 0xdd, 0x7ba7}, {0x6, 0x24, 0x1a, 0x1ff, 0x8}, [@mdlm={0x15, 0x24, 0x12, 0x401}, @acm={0x4, 0x24, 0x2, 0x2}, @call_mgmt={0x5, 0x24, 0x1, 0x5, 0x7}, @mdlm={0x15, 0x24, 0x12, 0x2}]}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0x20, 0x4, 0x5}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0x80, 0x3, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x20, 0x80, 0x1}}}}}}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x250, 0x6, 0x4, 0x8, 0x10, 0x3}, 0x40, &(0x7f00000001c0)={0x5, 0xf, 0x40, 0x4, [@ssp_cap={0x1c, 0x10, 0xa, 0x1, 0x4, 0x74ba, 0xf00, 0x8, [0xc000, 0xc0, 0xc0, 0xff0000]}, @generic={0x12, 0x10, 0x2, "18c622e1826629a8bd2c580cfb722f"}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xc, 0x2, 0x3}]}, 0x8, [{0x46, &(0x7f0000000280)=@string={0x46, 0x3, "95e9861b4d813eccdea4da8e4a800b2b3c3dd913db40aa18563b2b34fc58729e73a02c6d15e58a9e10489194d51568e61a9233851c05da9bb3ab8b79d1b3c044b35408c8"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x801}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x42f}}, {0x1a, &(0x7f0000000380)=@string={0x1a, 0x3, "7f2943c7c44639455ed2eeffc09a77655ea1e8ef32147cec"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0xf647737974a3d0d3}}, {0x30, &(0x7f0000000400)=@string={0x30, 0x3, "72498b95b937f72570e9ea0a63cb9ff2fd2f2ae8a6ce741903635e44e7433e097baf93ef3c7b48a38596ddbbf52d"}}, {0x9c, &(0x7f0000000440)=@string={0x9c, 0x3, "71cadfcec83916e7c8c7b1f34f0a753893d371fdb8053ce55b430943fd174c5c76683e0be4293a4d0b4b18b6e4c13b9cd90a69d0f96b02e8ccf14182ecc0deed726e85edf13eab2666ca45819f564195cd0ead83f837b7b0d899349059ca8aae1633cb776a1f5328e774fc28400e8982eda435a92c6beb8bff813a5382b423de884b28de5a0f81c13afd150069077acb3c261c395aaf5c6fbd70"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x419}}]}) prctl$PR_GET_TIMERSLACK(0x1e) syz_usb_control_io$cdc_ncm(r2, &(0x7f0000000640)={0x14, &(0x7f00000005c0)={0x40, 0x22, 0x23, {0x23, 0x6, "cb5e55389c6d7a93fd05fec7b3da1e16250c87e1564a0b4410ab6459285d95e6f6"}}, &(0x7f0000000600)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000940)={0x44, &(0x7f0000000680)={0x20, 0x0, 0xf6, "a1d0957b181beb41e05433f23c6c86cb81a6d16cb6cad793b2b8b14afd09eeac7ed367521b51a87be251b330f9998e781e31be835dc4c98171603d719f79df0255479d9c59e23a618c95cdfe860ddea2016e172c510696c14c9afbfdef781e6836ecfe541079124c07e016188204fbefe8c59dd809897e4d6e7666911491c67e57de08dc667b706558659319844260d1fcd3bda726b156cbd5d2bc7558c8fb24ef9ab3c7172b939594482bda474ff5e36bc1cb19590da8db8cfa4405edc158ae350bf58308a2d13a336cbcfcc86a9632cca1546251e4803ab62bef358f4038c83f0956b7d6899176768155d4a71e5503df0f1a6e98aa"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0x80}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x38}, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0x8, 0x0, 0x0, 0x7, 0x3, 0x9, 0x9, 0x7ff, 0x3, 0x932, 0x8000, 0xff}}, &(0x7f0000000840)={0x20, 0x85, 0x4, 0x800}, &(0x7f0000000880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000008c0)={0x20, 0x87, 0x2, 0xc}, &(0x7f0000000900)={0x20, 0x89, 0x2}}) r3 = syz_io_uring_complete(0x0) ioctl$SNDCTL_TMR_SELECT(r3, 0x40045408) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) 20:16:32 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0xc}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:32 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000320a00000008000400", @ANYRES32], 0x38}}, 0x0) [ 853.302986][ T1544] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:33 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xf000000}, 0x0) 20:16:33 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000b00000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:33 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0xd}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:33 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0xe}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 853.595809][ T1573] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:33 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000c00000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:33 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) 20:16:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:33 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000f00000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:33 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0xf}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x2}, 0x1c) listen(r2, 0x7) read$snddsp(0xffffffffffffffff, &(0x7f0000000180)=""/76, 0x4c) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="5ce0c3ee73b3a46ca1ece71218253571bfb4794500000011aaa806008a64397568f650ae8876231258ddb49bb2adc0d57d1d52c748c7bf8064d2d2a72c74b7be9a31e2e882f52a630938cd2cc8a51806fbe56046e6a1b18e748c2368638691e28b0c08749b3ccbdd17ee0856d12c44b60e4ed0650ed9ae1789ad0e08a1a1d1ca39ac0192217d22ccaba54fbe2f3c30783e9dccfcd81106a78787ce5dae77d4e5b66fd84cc26aeb9be0827082bc37970e79a4d24973db7e10df0080622c94798b28f6b0949e1b8d92283255c4fab17b6c383232b5915fb978216961a0db244b1b5e664f9a08f6843afc23c2c4a83b2d8ce30a44c8d505acb3889d297986c486b1dcbf8e748b73a94a5b5800000000000000", @ANYRESHEX=r2, @ANYBLOB="17090000000000000000010000000500070000000000080009000000000014001f0002000000000000000000ffff0100000008000a0000000000060002000100000014002000"/86], 0x5c}}, 0x0) [ 853.930663][ T1589] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:33 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000001400000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:33 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x259a48cb}, 0x0) 20:16:33 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x10}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c000000fade2fa2ecd43f0908a9a79f1901508e1994105a1e079c0f0c420fd8ede03d24d43cdaa8356db208e228277c62f4ec30d92faedd21ba", @ANYRES16=r1, @ANYBLOB="17090000000000000000010000000500070000000000080009000000000014001f0002000000000000000000ffff0100000008000a00000000000600020001000000140020020000000000000000000000000000000006d0ba7f54752efb89f6c6c4fa7b075f1b7089b8f72490fd2453fdaba52f8a5d17a8c7dea181"], 0x5c}}, 0x0) 20:16:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r6) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:33 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000a3200000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:33 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x11}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) write$cgroup_netprio_ifpriomap(r2, &(0x7f0000000040)={'ip6tnl0', 0x32, 0x30}, 0xa) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0xea60}, 0x10) [ 854.289550][ T1619] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r6) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:34 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000000}, 0x0) 20:16:34 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x12}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:34 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000884700000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:34 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x48}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:34 executing program 5: iopl(0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x1ba}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}, 0x1, 0x0, 0x0, 0x400c084}, 0x0) [ 854.658379][ T1641] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:34 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000884800000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:34 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4e0c0000}, 0x0) 20:16:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r6) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:34 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x4c}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000ab8000/0x4000)=nil, 0x4000, 0x2, 0x28011, r2, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000040)=0x7fff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1b7419b85b8fb099637f07f33297b2ac023a13e440ef3c43a3cfeb4415bc875d1d7370ee8709ed9ba7963a1e17c8", @ANYRES16=r1, @ANYBLOB="17090000000000000000010000000500070000000000080009000000000014001f0002000000000000000000ffff0100000008000a0000000000060002000100000014002000"/86], 0x5c}}, 0x0) [ 854.935740][ T1669] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:34 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000655800000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:34 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x60}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:34 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x60000000}, 0x0) 20:16:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:34 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000006000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:34 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x68}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 855.322189][ T1689] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:35 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000586500000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:35 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x6c}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:35 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x65580000}, 0x0) 20:16:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:35 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000008100000008000400", @ANYRES32], 0x38}}, 0x0) [ 855.695488][ T1729] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)=ANY=[@ANYBLOB="47e6bace", @ANYRES16=r1, @ANYBLOB="17090000000000000000010000000500070000000000080009000000000014001f0002000000000000000000ffff0100000008000a0000000000060002000100000014002000"/86], 0x5c}}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(0xffffffffffffffff, 0x40505330, &(0x7f0000000000)={{0x81, 0x6}, {0x1}, 0x5, 0x1, 0x14}) 20:16:35 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x74}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:35 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000478800000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:35 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x81000000}, 0x0) 20:16:35 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x7a}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 856.125765][ T1753] __nla_validate_parse: 37 callbacks suppressed [ 856.125773][ T1753] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 856.187028][ T1752] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 856.207725][ T1751] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:35 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000488800000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) fstat(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r3) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x80000, 0x0) ioctl$KVM_S390_VCPU_FAULT(r4, 0x4008ae52, &(0x7f0000000080)=0x3) setfsuid(r3) r5 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000640)='/dev/cachefiles\x00', 0x616901, 0x0) r6 = socket$kcm(0x10, 0x2, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r6, &(0x7f0000000200)={0x0, 0xe, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="fd00"/19, @ANYRES16=r7, @ANYBLOB="95090000000000fe0000010000020000000009410000004c0018000000f062726f616463617300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066282ed8e24ea5a2e68ca4234d707ab2cd87525e3516e2b514d41252a59c409f6ad06e36c2ba3f6fd120db64fafaed7f8862a7c67bfc972fa04be3ca734a929fcd"], 0x68}}, 0x0) sendmsg$TIPC_CMD_GET_NETID(r5, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x1c, r7, 0x800, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x20040050) ioctl$sock_FIOSETOWN(r4, 0x8901, &(0x7f0000000280)) r8 = syz_mount_image$ocfs2(&(0x7f00000002c0)='ocfs2\x00', &(0x7f0000000300)='./file0\x00', 0x9, 0x6, &(0x7f0000001880)=[{&(0x7f0000000340)="f9fe923f58aa32e315903c18c205583c027ae4", 0x13, 0x7}, {&(0x7f0000000780)="bbd88a5ff5041dac56f5f0a1bcddc1f5b7948e7f2e2cfbb6c3bf693112ac29381edf9df47ed4c4bfc7745ec7153af5c259d2b8d4648e55bb05c7780388aa01c4d073b0e27530840be1111a5dfbcef385973b091bc11a54faafb5a7b3356bb04829f2abe6b9e6ab7753b767ac76054d62713453e8d0708d170c27cf6645c770936cd9d45a8858bd6d99bdbf17a998ba62d1e01a36b4b03f7319a1dab02fee0ac0d7c29c761d3dffe44f53fdbd7a56a0bb6d08efa09a6f55f13dd1a8c6758bdbcf93c12b7e58035388cd28863a74dfba8ab3805f9b1dbc15a229af665316c5bff862e73f976a7ffc8c81a9f088b99b0c7b90d5edd942627b0b28b477a12fa9f27be16e704c13fe6330799cfa141b59e4c4994934c8a02c4e52f16fbbf007b7980d17b226e134a89a37f2bfa15a65f5c0342e9a078d36cd74aa8a7824eb07943c5f615df339cece84d4cde47ca022c2baa92b670af4d99d6536e72dfde2c1f3a18135fe31925129ec1c32d8806f8f172ccd306dbf30738755a87e24be601469d4c43e32a439fa54ef919e4c5274977a7e5fa773995a6db06a6dae1cfe701ba80c4ed84b9afcc8f61f9b4240a7ebb09ea8a7282d82863ddbc439a158aa4d178f8232d4f87982f94b117b70214f0bf36f231975d895c2eb3e69da90b025560597d2805f5f2a22a22299227579888991dbf6e459336c8953b8a9fd37e72a24a09ace2a4f362855008a82a50c0a986e8f83075e6cae14b0ee98d4b07c6e377ff29de7a3e94791208245f49296eea08cd02f4d7570b38ce9bfecacb8691cef19f4d86367202318f9a12fcc06e9e22256cf1c24797823624c76d04869a548344c4ca51e7581b6c6fff8f649bc2cd7cebac083e95916c37d5fbf4ce0b0dc9c0a921bb9504aadcd613e0537471d1dddebd39a0a2b2e96f60608c7500ff5591650db1f993e4fd258550f8bf1bb4b7fc979fa3f0e2ea389e1665c171cf1ce50e9f3dc5661e6d29ad3143c6ce85218f00905205364f2f46627e149f386631da2408895d2630290f24a321e1aa9ac02974fc8ceeec0faa4607a96ded3e196b3c45029b7789c9ccea6f6aa89c6539df95135a4a57b40553b333ed6c3c4557cc076b4d00df96b529a20972d6cb44220a2d903a9ac5fad289b2349e3aedd97e81e42fd41b6518f28af5daf4af668bc782e625aa5a9b40054f33c0dfd5a5b1c3af4bb61845200c19805e7e870754bd901c105a05c4fa63169b8bfb57e662b47483b2be7c8d5725891000b3ca5b2075984d2707df66f88dbee7ee5b45b970b79e1d19641c9f268d6698c8b8a30d4d74c24dddad5b6729dd9426ab6dd4d2eacf028a2797cac3bede19064a1bb74b885043924a7d05883f4832e173f5a0487c4c291d13cae691a8a272830260b60db9de218026af4b5200f51c2aa048ca49fce85165a1f96c0e377fb0ed2effb775ed5f27cd9f36b3bda552044c5fc297ce8648b8c3f51fb82bb35fe722a34acc1d00fd6d0ede2c6c0c37c1d85c772b55918ab1d1db152fe59af44312d88fb4e6c85d177ba5d97ca86d392487482e2c9389eae12bab0158c7f4544832ba3296562fde4dec146fe53cf13d5071f04b4fb995e0e1f8a7d303d1f4eec8ed4530050d601ab20dadf2acc749905bfce01b39726659eb412eeef6097eb47eb420ea2fdadfcc7d880cbb4b897980f8c4fe1b0eed6a6a520b5ca250e220318bc4fc4207cdc4525f6ac547a47376cbfd63aa6281f1a340466b515c1b163743d45cedce5a09809bf0be0aeae27820424b655be272d14272badd87118bbd0d4ba4ea09503599c2f918ad195249990fff1a69e98b456578f7ac7c0cdc2e748923b3cf3df991065e9d1b7a37d48561cd51f28f2d95115f6b45672f3732d6a5b93277fae7812a5d374c15720b5011acd486f3ed68d02912c3f66682a7eaec081fe702f171b788d53fef14b0b0be5b932fb859abe5ee100292753619e38fbcf61c97f27a13f9ce2684ea12fc26380daea7efb1529f89ce3ffb399943e1cdc6b82c5282e6e2bb0fd8e8f2217e27448940a4beb9bdf7f1b9f57091801cc3b2c380b985aa79237ca2064227fa6e1bb6b825ec83481740e7a9fe3088d6e32d83c431da9c550d745e3cdd1228e88382693b820eb4f2bc4b3904138a483a1dd76f0781aeadb8d43e1495702eb73508ab247ce2e6eadfdb9567250884820ba2d4a12d0d57de1810a4053280edd94b4eb679e1b6b3d156a5432399d982aab6288df2cb271a7fd475918e4b2f193976f755e67e28b6be4e92ab304b644a2f9d8b2404bc2fd45437d11c6897aef0231e3411eeae99bd71fb4f41344f475b7897e8a5d06687567f9f8c4f20ba3d038fd234e80ffbb93dde704ef14f5f6fa136cbee11462d9892eb0299d24460869d12a53f2d6e7633f150e9db051f4e89b3ca2dcc7f701c8d94ece163f08e57e9c3ce7da48ca8ffc4ce09f7aac4732637f7341092312f88ad14b5708d4745f50a08f29674e5ca4b0dc236993518add0a3270d6a07728862aa368d7923966b13e3dff7c036c912f881129772a6ff3d020fda70b291ab0c16ad2462afcc1dad34e95ae3fcd0ea791493d94541b28325f6d5d134349c9ac18018fa982e4463ad3d2a758368c113607afb6955d53068045f8da1d416fe18d1938b645b9847e2d0ca1e6d62cca6dd6d9dbc2efebe116c51de00a6acaf1b10406337bd61412948d24aadd466e2dfbd3b4233d9490ebd11608015727abf1977beb5a4fba5d967d02b9c96abc6b8d73e22f2f21f86c86b6a0b57347cf3954d2a0966962b04425b828de47e78d88aee8adb133c35fe98d7520090ea6ef9d8512439af0c6cc0841ba48299bb220a2046da4ece309cd60800171585e033a2367832bc827760551d8be02886b9a5487b814bfbc90758e04b611550609475501483f99ca3a206bd00962391434427d4eede485321f3306c79f0b3b79b656231c72a54bebaff302e42b610cff3190eb9c7c6f5c6439eddfd44697d77b0b772af9130202af21999123a13550d848e44e6ecc22285c47a6644272dbf07d94e907905a157fa7ae59a371f5216aee2bbd9e1eb5594f20717191406945ce2bbdd489a9f70c288525ca3bdce904b6c9fa95ee96204fff5e76c533a3884982b8fe6c64941dcdbea42d7565767d4d3f1aa47679b37b73bc89324181653938fd1d54ff710b130cee15269bbc57ae8081c3d946a313ec0611ff2dceaed0f755b03e24ae1ede8319cf7e7511baf6fda54879c12f2e8d153e6b8e083c84a20129b3ea24a83c314fb0158796df44a543bff6d3a3462e2f4913ce96161abfe67c51959d93a883867200dd10036b8a0f9c146a8c1a467f8a6ace4afcc7d25c9536b63f1732a1668b13a4f68708a1c5710ead4915b80bf32e66a5328ac04a11bc92940570d6eff077897ce3932e8dd061044cae3f134329d49f02a6c9e443adbe9a2781d84b3f01e7e7627251b01af47587a318a0d3150a15bb2d13d73bbb278ee3694aafa318d65d77ad683715bc7fb822b556239fd4992f02f4a699661d60468d436a20250e406a648079f005085594f9c75da8fb9b6e9e06e6c01253bb2ba829c488821b00f295aa68f16c4ee82b454df90f79a9e11aab516648ffa06e7e41ad9e5abcc19169835fb5d4d4f0b881a95b2a08fbd2b131eb19fc62494af6c8d11a64c8057993e3b4428caebe5ce22201a0c57a304fb34a87f316ecc01ad1cb0b100d6cc88f5469e70e96977172cc243454383eabb186281fa0d36186fc96a57b8263b3525d0e0c3c6dff6f6caa2b1a1b1ecca83ab2533ddd5c0faf03c634556f6c40c66595365f9b7aebed56bce728d920a727b26837dc7d5744c7ab3f8fef3a0d5e1e2418fe0f1e18bddc3471ccdec9c433429293f186a37fa00ab0dd7afff2941233eb0da765f344829b55f2098f5568f73196dec32cf6c4b4a0ea619749bed9c7f31a7d844465ab2e6ce6dc8e9714acdf8e8318099712e4aac66832818bb48ed0b20de60e7537780f0a767405e4fc8eedb9ff323a44e5f61c3f0715721dbae258485cfb43bc45f7081189e4074e76519c27a24b1da7d0ba548cdc8c0bb31a5751049edf6e91cea1c39562d2d4c7c9b059872df8bde27f2579249faef76e265e08236353eeb878d0b65af766413be83b793756988c3e55503c9586876a12976cb36a3ce236daafde391fb36e5144f183d6cce1ac15c0ca6ac4e7b429197d5e8f5fbe5953cec3f0214dcbd04d0400fee85774d72f0b2c75c34a479d7f8288705dc9a3188283690f1f6333383eaedb033e4351462e367b05f5eb4b8098a0c8297de9cf7dd5dfaa145936065005550cd062f268c630889aff93bf06a7a1041d7b7ef78e319cef670ec04de1dc24b13aad69e5f352e27f3d782b1fa97193d44b7240f80dde0e72a5a9656f0c450f6a0616813f0143f86ae2c32cb81a64440faf773bda1f43a23eb25138abc0dac4b850011466cbae7ff919e335e9c235d0511574670b1548bf62404135fa4e14572fa0c9506604f51485d9d17432ffa5ee2f13564c047eb1e97c4080e2fffaf269aa6cb35de6e3b9ef2dbecdc6cafa3a843a5c55fef09f5c3515fdcf6001365a804d4dd197ce0a6fe07ced63c382d4c866f38083629ba9d1e53b489a7433b7f2c99a9da73d0603556bc061c51ecf66fa6d931e474405a8e77d8ed2f6f0e3410867c079e8d0a49c37b4b25c025821e245e0f5901a2f811780c43fa6b3bd70f477747fcde1aec08922232292e7afcafebf5623a3cec09cd000f9487382fac7759c7b222ab469728eeca13b69695e055a6ddc5929e0de745a7ec73cd08ef2989ef6f3dc245c56c95e374c3a5097fcff13f25c4f6cdfd1c774b1bcf53092f23f60363ab54ea462200a47820448365e7401638675e9832298c30039d1cad0d985bbe4ac3ca565f374a6cace904dfbd46edb87fd1cc5c3046185c22881fc5f915b2dcc0e4c040dae851e98191795224885a1e451ee73abdaba315e5e98f4bd1a1e7a3a0aa2dcbbfd99f2425d249199d70ab93e5cdb31095aa742e68b45703ffe3e82d54bb185a11e11e655fc3d583cbad8976a21e41f09478efef00677a27d4f24f13049e0f37871a358468cf0b46afe040d73f9fdf02baa52d80ca58d32b24ae3023c6d3227e21112e3fe36754d696d46470d3c434ca79e38ef64cb4c4fc2a064565fc2e9298bd3463b8b06623c644df8403ffb1057a253e4fbfa26b34810e5dddc38a496fdd6c4c41a5731fa6e5cb19cb1f30b86278e9d70fe19ba28aeada66aba11ce8d8c6bc323dbbb6a1b94f688f3ea00f45bb3e14012b7490881e285a695489f404e1ed92acf0f05bc416431485390fd1e24c06b18c3ceddfb5a59ca1d9699f913f1b8c412dfaf46e3376969f01ac368691df928bf7c4bdcbf9ea47398d2fc23e8c88e8ff03e6132134913360af878070fa7078392be6d1c6af90db93ef13217b86fb6b6d851fede6cf4db65ff23ec5823c96455141b753e82d48b299eb5f7d60d96a42d32aea844cc07525181b1dd70d08b7a6ce8baf9608c096b3e4caf4eafceb62b1d4c3a70a416274ea8e382a937545304580ceac6ffcaad15fad5416fb4bfc8f10662dd061f1db99bf8dbe39c335b4865be7394c4149fa47c682327382c16353a90002b5ca05423910cb300d8976af86e6ae01da2a3f83aa9868f27eadddd18b709ab9e4904835919de85ba88a5efad2df0a19f81ccfbedd45671a88acbb36cc9238c230b51e14391b73e1ffa206efd75db5dd6dfe917ae0842eeacfe70a50f83ec9d6647", 0x1000, 0x7a127f15}, {&(0x7f00000004c0)="8c93f0760189b30fa8a49237c5875313b5b509b0568734001c553ee0d583062b1b91700aaf5c7761b2f6847a5df6faff8561ef075ed262136e623457f354b23fa0fed57594338a3c47518f04872822552d987dce0ff69ee5462616e31a7093eebf72ab4a2b761cb8a59dcdd5b2f31848cb76fc653152f07f1813fee2b569b2b0f39c593be9acac4f6be6dbde200965832b77d05693fb89ed0deaaf6a35746f63ddd9c9f09027eca3e631700a60", 0xad, 0x80}, {&(0x7f0000000580)="06359ff77fcf67e5ed35bb0beea79970b8cc6afebc61f22c3bec83f2b5bbf6b2c6694986f3229c9551dbfb66938b3cc5798ff03822f930c8aefa6938fe39924904aba59136d9adf3cc58f0c3fe55af509b4f92400e2a129a495e87b662007cbdcb1740f1f82335e4ab147fcd78d78d52e28eca39ecd8d9e975bfef2d7020509394e1caa21047e2c714f42845dd3ae31e7107870734317adc1c40ce913d36a7a87d9e73524a080b96", 0xa8}, {&(0x7f0000001780)="7af0ab9e851748fbd2df4aa497c4aa29976af71ea4c0b92dd6bd7c9de09171a4b3277ba9b6c9f6b9c30056de264b017fb5b4fea1ed97b84ef095dfef1332cab71f05f52b5a99fe19032b9b8029143a94a64e3b4ccab41a41b5ee85ec902c771b73561b2f7439ef8426addf3b1de8f5c6b62a53c445e258944e75a1abf7867ad0965743d26cad2b4eb3cb8c6cfc91ef2c90e90a9ca438fa909bc01d654a56a0dc8a84ae3234b820b68a0b84629c62485a32a9b42e18fa96cf0147764e2956e4cc77aa9f6eb19a82eee95075370cf084286f9573460959e7f948e7ea9a4d044f0a67419c24b94f0fb887d697", 0xeb, 0xe32}, {&(0x7f0000000380)="7a8e2bbb8aa9d4bf073ebf5ab72642058a0f8f5faa85dee26fad711f7b0d01dd65edcc02fdfadb15a27407a0f91deda21e1eb028d542de8ce7f04406c795dedd0ebd4a6c02a055b39bdf340af1fc5030f11fe07045c2776de141c155054b1c423db46eadf2ea0d2c", 0x68, 0x2}], 0x10c0006, &(0x7f0000001940)={[{'$%-'}, {'TIPC\x00'}, {'/dev/cachefiles\x00'}, {'/dev/cachefiles\x00'}], [{@fowner_gt={'fowner>', r3}}, {@smackfsfloor={'smackfsfloor', 0x3d, '/dev/dlm_plock\x00'}}, {@audit='audit'}, {@euid_gt={'euid>', r3}}]}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r9, &(0x7f0000000000)={0xa, 0x2}, 0x1c) listen(r9, 0x7) ioctl$BTRFS_IOC_ADD_DEV(r8, 0x5000940a, &(0x7f0000001a00)={{r9}, "667565c15ed3ecc8d982311a266a2eaf525ada2ba0b97a269a6a89b02e257e17896e91fbbcc28dc3035692c005c8267c6844c37dc4e1806b4723c1fa01f92bbe0f674e316859d338a08bce4cff77a165f6cd04479053456d6b743218e5a51cc2b45f11796f69d5aa1e11880cd90db4589c78eae2a7142d6c855ce2591c8b6efd75264e3eef8ba57be4a9634a269391f95598f8da519aee7441770e38a0883d5fefc7454aed1891f0dcbd105d529dfe1cbbfffcf6208be59df56e8ac9505c66af4f8df517f65e4565c16e62bc799bad221a58fbbf032d3658852f9dab9c70a331b59127d0640405073fac0346a89483266bd78906dbbe15c88ff85a9ccdfb06efd809b56779c4543b705c4d2f9b4cb4211a04bb534d7c74662d463d91315c12e8d293e5597e7c33ba59af35f317453f9a07d4fe79ea0ab8325de7aeb37a6a61fba26f8f2dc0edf47de489c09efeb3d3c6ec6b799351e84b63cdb2e66c2cf67858b194ce57ee6c8e87ee30489223dcc058aea6c96f8463593e3515357ab9a99189a3448c42b80fe9921394a19f79ec366ef1564aed3b23eb8ee7452037d95bf510683ae51b940b80b37f1bca03bfc9bcd143407afd558d2d7eee869b9753ac971f417f40ffa3432021f05f2873821599a33f2f6112e1bedf7cc6978c0d6c04e8854ba405318909288d4a426d26b2ed0d982ae3d37d49ef96a3762207192a7ca3283ba2c1dc966d25e0267248f6722e47e43b9691ed6b298afd6eb5759d555b5d058d84556424ae5a6e60d3d6d6039f151875c740af72439927f5f3be925724d48f59f3f471fddca38c160aa6bb5ffaa195b6268f03c041cab117d5ec8b5a3aa7393c522dd7673db124e6fecc0cd65aa6cbb38bc06f10699229f278e176b8a1f449c73fa2853112275d95c8d63b43e025f9ce66c15024387a30b6d48ea299a4aa45d64088b2470e5c8b1ab6911fae7bc0ebdd6c82766fd979ec27b133b0a8dc8c713155baea672b374c90769275a4070433982b62e714d1b0a57dd3b944fef1130fca8d6e509e8739c4262ae2b2a0fdfe3e1e447e57cc777e6905587b0daeef4dfd5f702dc196dadf7260877f5ab628995f283798e2677b0a1b4eb13b9852d8dd967130ae874bb08f4c6cd072ee38037d785d894359925b06df9dfd7e7247a7d1cba99c98a4b3774ad9d3f93a6727db4a3f66e2f9cf2f12a5338570a774b766ea7a9e6c8d08c8157d3a0d640587d80f5cc13ef8a67b53dca4de6b2490fe68e943785e99e43eeb4323ebd8276bf8bcf73cfb1ec5b98c90ea458544437b50a6a4dcc8695d94823d19b55eba77738d566c6b97b14fd4d99a9271293d0022be1527d37280acc470e2fd60671c6f43578c69343a18fbc43f4ec1696d61c6f14c1e3691a878246e1af7fe63c3391f73323035600565147ba973891621094661bb0e950d6678036012634d2bfd84cf5b3ad76bc1903dda6e834ec459cef9fc1ed2074e48dade68373c26879dfb7b7624beaeec7c1cc5d2438f462b2d56e3f9dddef32188c91c63bacc63bae851220a233060543ffbae7d1ae2944a1bc1fbdb1365e4ca0486e128be8f3c55f2cca5ce6719a2fe4a25112f59f9325313ebef83015ae33514ea46945cca29ad4a04b242fa939e7d01b9409f485681856b19df97b9c31c908796ef1237b66934775b8febffda4b473993eef86154c307cacd34a603cdc8fea6a8eade263b174bb757270a0cf918bcf286fd401bd4d9742652e0fee6fcf881b3fc7aba81f651751efe353701342d442f5f0e3a749352712f1a98c8c20cd7db7b3645eec6c2b7cf1430d79a651037ce81ebd3fa79cfecdd3952aeb87f041663dcf2e6f8c5d5ae8610ea448c71c3da0c82e00640504c0dd62d1bce35ba23afc2fb46aa3322e2177fef5380c6ab7edbf25fa60e9abb8644e123eea99d17d21fad519f6cdc3eb0bc74bd7b487a36ca8e7d292cbe7a0a260a4771407de066baf27f94bc56bfb7a4aac19f7fbc62723a5d60ae72738aedee25308de80231b5413a6f49aa56d944fccecc5e3f1219ffe09f67d0ed79e8e267c90f68fccc375fb64135c2d8ff7c0129694142d731392edbdd24c0e5a090597a17bb2a237cb70875e25c34501fe27e0718fd60ff794bf6a2f3357dd1c1334712e096fa6242b088a8d90a0c99bca2bcb2ac08d0e9910b56197943722d8619c7615529f95231fa587b370a400198976b5bcc4d4556c2f20f0c6d4b9ef4eeab37139618f372b035d98ff96bb4fa04755a474a7199673b4267eb5910c7615a25dc966b2da1f899e282b913e958d8aa6ead1ed36fdea8bd04d8ee3ee03e8f7ada608c741642b677674c3d18d6580894f5b730ada842edb7a29f15a76e9c5a8e9a4ffdcfd71883799940655be62acad62d5750a80e81b0f2266115967a6bf72870bbd847e98d591a267ee4aaa3edb21538781fbcbbdb0dca335001b48b5bd3085975337c7d2d325b33941111f20e0679fd5a832862bfdd65764aa7f3e31675f06839ff8c83163f97330f13337acb6ce3f9eab14658f18a4d418bd3f0139dfb911df780ba77d5049094d91e1820ec5c0cad55dfac0d81205d3ef371372a913e41b36c45cff39f2554a9ee088e204718af6fa18889b51628aab26906d329cac2347908adb9798c312ffd4e3fc6d5460d4f20e79466805e7992fff3b98895d52cd3233d9afb0cc28d613d08ee521ad324873faf0f1284018743e92a26499ab65f48e542c507dbc3112271c64fd8a2b5468eb17c667dbf2b994925171c58bb8d386591b39b31ccfc2b4e0af881c2e71ad7d46621784d0465d6d451f00c62d4d0ab2c205e83662efc59ee31ee42814847b292bffe20f51cfce994cd6ef272bf65819166eb80b4b64ac10e1ab885163c8e6c4e346508ccebc229589713ae7a04684455c560b4c0ae54bec1acf7cc09b2eb9d77924761c1fc4f073dbe70b642d8058ced65276d9ad730fdd866b3d5ce6c7bb121bfba844330f319704b4be23e0bf1094cf781821f841758d9325b4211e0c28764f12cb5b689631d3d8617c8833902cd2717813cbd5fd38f73eb7b2ac4c9966dc43e7e0ae740638580704a753af00fc2cfbe53462705f7b2bc1c782392fd94bbd5a32c8c37a042fe538a5d1f5f9f040f6c6b48e8941eb7c57bcbdf2b06b09337a713af870b1074ba2f26f93762017794b134f3968f90bbdc3d208e08e3bbdc64a0e4500c2ba81bb3fc8d4695b01ea3d64de2bdcef70d9f7682d433c9d89d8a3baee8b7938f36663de7702f4eff8133b6dd0a0dacf15a45dd4fd77bbe5267b67e7ccde41d6f9cbc1ef112aeab586585f3f6edc6c4deee2faa3bd2d082a950de7e8947e950cf5ab49574230da6b9e4e16b1a5abf4707596f8a4d805f7f5d0978d50237a8c8da110e659965064b56aedb54a55b71e72c8c8ef4b216a42fe86f960e7a7cf62e493e8030ce675db3555507d82030844efd8765b82e6f79d8968109bf317147dcfb3d2ea16526234c4d5dbfc934de51e606c3d272fca2ca23f4a6ad543053ffae68f2974ac56f8467c0dbdd665ae4adab94ce9ed6f837154c523625fed46143051b9017fec66747d8a2991b244ae2a957e7eeb93e25c2dc1f3865653188c9483b8d23a6e99b9af18b8565d6efcc6284e9608c61b448e0f2f2361958081dff825ab15630192e3fe4de932212e39eda504b4b6cf6ab50e0542ff49f1717b3f40dbbe0dbd7c377a9c442420ed270e575c89e061a1bc3b02ca823e3475130a07f638c33c983c822612fd983c54ecd9b62eb69772fcfd012913110fd414b53e6edbc33e37b94ccb323cce607eefc8374a2e991067a3b5997813d2b1fd0072898dbb4c77ef1a1d6037a51b7e4888b56b6b3f46760139608d3c069342c0fe424ba619307706ae10ff8136a4d5cf773d46bb290bd0e3b810b35409949305749a2a4d9ee95ebf7531e4643ad4f3d61f8f4bd28a86b0b1242d31b3f8bdad53754f0c8766fe0f829ed0dc882e13bbf3c75d19cd0b1dd5a44e822b47ac6f83c189c7d037cea90fad54791da421754f3adae0a3d109511ea6c336e3abd48c7996f87b3c7efe77cf46720f2399775054e977564f971c205c980515a98aa739de0cc4a80599d0958d46d580333e07ba8a417fe2f3aad2c54e678a6d39f9d1f81413944ca9a807f5b05344ec1e2c13d897582344240adb19b211325cf9e83a57637e66c86cb5df2b9ebbb0fb07da428f610013b21835723bc21ee7cee5763f9afc05c5d8d8e5f7cce786f79306dda0bbfe308638a802c48c093fe5e93259d4353bcf305ed5162e1d9fb8f6c4f7292f4ef9e382f6ad22928ec1c51b0828ebf1c44d146212a660504a4a93ab3a8fa3e8bd937950089ce195d76a4cb9ce9af93a6d6e26c91a6249b7f1acff28eae9139e286d4197ef761b1277e5e98ab40c8f08e6a8a19ac836b8115b0a2026afad68295ea60b494d1967147ce6baea546b415b6ad6ab3c9fd2e42ac4f287069ecf58935f803b6bc17e3dd8669e43621a0e425d2b1c2fd1f1b2ebd08ddab1792d513847cb3a3541de2a5ebcbcbc8fbdf9ea137f131298d9ae8364d699176f9d69d7963c6e785095652fb93fbf9d3077ec0dc25c80b3e6132dba1e6e45785a5b69e4f863d7d750f29f9f079c8f4fe48408bc19fea09002f5b4a773d5f2c3c27ca11b6f2834a41b9767a903af4e75337e803d1b0be13bfa661c74687f1a7ddbd28b4fcdf7700cc5c9dd8dd5a6c65b73f4287686373b8e81bbabbea6221cde085db94fc1ae003cd5540fd58b4598d5551fdc3ee2b8313de1dbb23d050461376b2b7f283763fcbcb830e69ab14ec21c3e5d58539625c6b21b5a55d48065240f858bb6ec8965175eae08465cee01f069411921e67bb817111a033bf93cd6e803e2cc7fce2fc7ac65f71075c2bc3cff34adf86cd925b4b15222b07e4d28c68bf33e8ee1835173c3fc99ff29459f9533212c7546e47ed00a6b3d08aafef04ecd0662b0ab2a057ce6d233d916d89ce3bcad02c78563c6f077eb6b9dac47a70d5ce284c0a234cfe29608b35719cf828d8813f61f769955c69bb31ae3f41d783f4dfa363e765a7faa6ce15fbc8e51f694412955aac7f17f68f375d2aea2b375a29e5d5316faf61742356c14ca63ae83322b4cc3f1901313f6d9df6d343925f3a8e541dc1a17056e21a224b0d888e4df93d6365263445b29fba1012edad746fb0b8955b768dd0c4c53b9301213f7376a57cf60b94416a016f6d33e17b86a9014dfaeff822bf24584942558b8f979571bb4ccc19ea6c90ec706605df0bf473dd417471f5b5d95c4f2745accab7fc9e56195bd36dd92ea22eebc5a7f2939c20d605497ba27cb44af87ce6035c70e76e8d756ed00688ccefd87309916a4258bf2a91ace7e262018cdab822abd2d49c7fb0453b9dca08eaab5a3e3052ed251da8ea61ba4e7b15fe71cc5b43eec587003ad5d37cc7e62123c48b6f06e53047d669cc03c1c9b74cf8fc05547304468623daa5004e272e15bc314f4b7d23851d971d77475f5edc9751cff4b58aaf566d4dd3cc5422e28c06c4732014f6d9c8add5ce163ea01b218dda302529a0866dafc58acedb1570d59efdf533377e24afbbdd2ad697735d7ce7293e84e2723b892278df5d5adb5040f6e6ae4fdb5d207347b368e6b7cec27ed0dcef062c3c3288ed75a087ca623757cb3b12bfac9367626f1444a5a859542b2947f7398060af8776f86b00f60cdd8d359b1c057aeef7a390307b3cfbf6adfdcd85afeb53396802719f8482fa84f6c6682f93"}) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="6df6991c00825eea1409bb84a19248d0125fea60fc4ae5875397944f8cfe967b561b56f664563989828a4cdb2fc83a534b4a2f0e2faf2dcc375f73abb8757bb9995a5d37f3ec1afe1c2397f1055d7e408fa06ba265cdb0", @ANYRES16=r1, @ANYBLOB="17090000000000000000010000000500070000000000080009000000000014001f0002000000000000000000ffff0100000014002000fe8000000000000000000000000000aa060002000100000014002000"/98], 0x68}}, 0x0) 20:16:35 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) r6 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:35 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x88470000}, 0x0) [ 856.318492][ T1773] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 856.352092][ T1778] netlink: 'syz-executor.2': attribute type 9 has an invalid length. 20:16:36 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000004003000008000400", @ANYRES32], 0x38}}, 0x0) [ 856.385713][ T1782] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 856.399592][ T1785] netlink: 'syz-executor.2': attribute type 9 has an invalid length. 20:16:36 executing program 5: sendmsg$NL80211_CMD_GET_MPP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x58, 0x0, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x4}}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xbb3a, 0x4}}, @NL80211_ATTR_MAC={0xa, 0x6, @random="9ec0d300e62c"}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}]}, 0x58}, 0x1, 0x0, 0x0, 0x24000800}, 0x20008814) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 856.429584][ T1783] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:36 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0xc}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f0000000300)={0x0, 0x8000, 0x4, &(0x7f00000002c0)=0x6}) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x2, 0x24000) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) sendmsg$can_bcm(r3, &(0x7f0000000280)={&(0x7f0000000040), 0x10, &(0x7f00000001c0)={&(0x7f0000000140)={0x7, 0x410, 0x7, {r4, r5/1000+10000}, {r6, r7/1000+10000}, {0x3}, 0x1, @canfd={{0x3}, 0x21, 0x1, 0x0, 0x0, "b93649ca197cc344d05e67a6bec565ae93aa6cc0e0ac3725eb476c7b80dff1e3efb1f3f8bc7ded8eb8a5fe5aa0fbe38618997f5ee4934760cb992e779ea3f000"}}, 0x80}, 0x1, 0x0, 0x0, 0x8000}, 0x8a0) [ 856.595750][ T1796] netlink: 'syz-executor.2': attribute type 9 has an invalid length. [ 856.631887][ T1790] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 856.642929][ T1796] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'. [ 856.659461][ T1788] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:36 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000340000008000400", @ANYRES32], 0x38}}, 0x0) [ 856.697032][ T1803] netlink: 'syz-executor.2': attribute type 9 has an invalid length. 20:16:36 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x88480000}, 0x0) 20:16:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) r6 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) close_range(r3, 0xffffffffffffffff, 0x0) [ 856.739964][ T1803] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'. [ 856.790464][ T1807] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) pkey_alloc(0x0, 0x1) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x100, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x20041004) setsockopt$inet_sctp_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, &(0x7f0000000080)=0x2, 0x4) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000040)={0x0, 0x8, 0x9, &(0x7f0000000000)=0x5}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0)='nl80211\x00') sendmsg$NL80211_CMD_SET_BEACON(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x1bc, r4, 0x1b, 0x0, 0x0, {}, [@NL80211_ATTR_BEACON_HEAD={0x1a6, 0xe, "2a8ec21e8808eed7be38b34620bbd411b17bfb7077e61eddd0dbd5b4fe4d95fa718c1d0788ada79696293df943436ccb0e8e402008428e31f0ac04e0e2a86155b98e9d79484530e0bdad71604da57a45576b08e5c50f69eecdc5e89562966fa5880b647cde6902098fcd053d0afbbdd0b9bdd27bcea9a5092298513c2ffaeba0e58c1472bbc3652f44d37dedd20cdf6e1dce60cb3325f8d864b14a3c0b12c20faab0eaf4bd9e5e18820b765e80410c01d8f3478fef062bb88af274c13d45be87f12d8ae51cda1ad131bb014bac3f5b34f5854826cbed59b4240d7405f2629b63fa952b0769e0cfec7e01d8b3eb2628342d00dd4457ada0fb3662f45bee42483674a4706af9a0caa2a50d601d5290ac29318839a961f2f539ba3363689d0d0a3255cabacfd8c83801c7c7af2c4f933161aed79638cea3da720cd9fc4344e77284f945693ea0b8abba1651ce25536487c0ee2529e0a16c61c613843e811ff70a1f7c3dba10615cfb6356ecccf4275f268115555924f51f64937496f7a0c6c1969257f4ab34f0aac59f1a935f0c206126f38ba5675166f9db3e287e81ca0e7add39170a"}]}, 0x1bc}}, 0x0) sendmsg$NL80211_CMD_SET_BEACON(r0, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000300)={0x27c, r4, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL80211_ATTR_PROBE_RESP={0x245, 0x91, "b36beafd5363d70a4e8c9e41d3f80717b80a8f04d57ac7a18b1b9f1e2e0a5860ebd024a459b3a17c05a9aa696aef82d472c2a053c1047e94b91a4b38f276cebf9b74b83f5a99c08d306f256928a2d17df2666f3dfe1b0e7ec93e0b50086f3dedec2d7d4f6b415dbb8d4ed1648e354f00424048ee4abc26aa818bdbb9ba5bdaf82470d2ea744a4f5fe47e76a73e33701c69c856eb3f0f1453f8aabced1fa22a3ed1046bc4f1391a8857b0055c7c7225b6fcf816ffbb25a1b49f641da1b5bd017515fb9aae7abc5ffc319561f99cb5c97a9b38af49fe71f17e481d0297227ec22009285c26767e08a01557eff0f3f1bc80ef59d66d269bcf7997e2eed160d20706c42b7e9465900ecce9fd68752be2c72b124197cbda02b240788ce8f9253315ce3f682297b40d07f9d01adc457cfa9c608242120fe26ac9b9ab2d1de8c6bda37d421e10d3ce94b63853efb65da0d33a84335b216b93ca5729493d7d0c33d6f8b7f6b989c8c7ed532a111a533896fac8453cd55e4b619e647911648af356db4551470b75e31a5479c2c794520b6efbb7fd5508a05c08ab69592dd9950a714401ad4a564b8bad138ed87f0f8c81298311e2df95dbe8dfc0609617a6d68b4ea1475048c530df457e08f77473f5512b159b0cb6989bae6c88f6329df9be6f84fce4154b6ec3ca5a67e6850e8590350b59468024736cfac5e322ad355eb44a932dd99c59a9766357d09887ce8ac1b2bb9e09795b6b50ca8200cbb0149f14d1527e5fe803e6dc73ffc179fff4325e24817e9b3369b0315936722885d7041a32ca7619981e"}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x4}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_AKM_SUITES={0x14, 0x4c, [0xfac01, 0x908d1d7b2bacc456, 0xfac10, 0xfac0e]}]}, 0x27c}, 0x1, 0x0, 0x0, 0x45}, 0x44800) 20:16:36 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x24}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 856.979963][ T1810] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 856.994081][ T1823] netlink: 'syz-executor.2': attribute type 9 has an invalid length. [ 857.002611][ T1813] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:36 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x88a8ffff}, 0x0) 20:16:36 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000010008000400", @ANYRES32], 0x38}}, 0x0) 20:16:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) r6 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) close_range(r3, 0xffffffffffffffff, 0x0) [ 857.086471][ T1827] netlink: 'syz-executor.2': attribute type 9 has an invalid length. 20:16:36 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x23}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f0000000000)={0x0, 0x8}, 0x8) 20:16:36 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000020008000400", @ANYRES32], 0x38}}, 0x0) [ 857.254212][ T1834] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:36 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000030008000400", @ANYRES32], 0x38}}, 0x0) 20:16:36 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:36 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x9effffff}, 0x0) 20:16:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000000100000c000000ce0000000f000000010000000000000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b00000080000000080000005247", 0x62, 0x400}, {&(0x7f0000010200)="010000000000050011", 0x9, 0x560}, {&(0x7f0000010400)="030000001300000023", 0x9, 0x800}], 0x0, &(0x7f0000013800)) r2 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r2, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100), 0x7}], 0x492492492492805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x2, &(0x7f0000000080)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100), 0x7}], 0x492492492492805, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000009c0)={'ip6tnl0\x00', &(0x7f0000000940)={'syztnl0\x00', 0x0, 0x2f, 0x7, 0xff, 0x291, 0x2d, @dev={0xfe, 0x80, [], 0x2b}, @loopback, 0x0, 0x80, 0x400}}) recvmsg(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000ac0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000900)=""/34, 0x22}], 0x1, &(0x7f0000000b80)=""/237, 0xed}, 0x2000) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000a80)={'syztnl0\x00', &(0x7f0000000a00)={'ip6tnl0\x00', r6, 0x29, 0x81, 0x8a, 0x8, 0x10, @private1={0xfc, 0x1, [], 0x1}, @local, 0x8, 0x4010, 0x3, 0xb91}}) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) sendmsg$TIPC_CMD_GET_NODES(r7, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x1c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000040}, 0x4) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000280)={r4}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000000)={r4, @in6={{0xa, 0x4e23, 0x5, @dev={0xfe, 0x80, [], 0x40}, 0x40}}, 0x3, 0x981f}, &(0x7f0000000100)=0x90) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000140)={r8, @in6={{0xa, 0x4e21, 0x0, @private0={0xfc, 0x0, [], 0x1}, 0x5}}, 0x0, 0x8000}, &(0x7f0000000280)=0x90) ioctl$BTRFS_IOC_GET_DEV_STATS(r3, 0xc4089434, &(0x7f00000003c0)={0x0, 0x7377a38e, 0x1, [0x200, 0x7, 0x8, 0x0, 0xff], [0x6, 0x1, 0x3, 0x3ff, 0x69b, 0x3, 0x93, 0x10001, 0x1, 0x9, 0x1, 0x7, 0x6, 0x7fffffff, 0x5, 0xfffffffffffff800, 0x40, 0x8, 0x4, 0x3ea, 0x9, 0x1f, 0x4, 0x5, 0x1ff, 0x5, 0x1f, 0x7, 0x10001, 0xfffffffffffffff7, 0x6, 0x8, 0x400, 0x7abd, 0x6, 0x40, 0x1000, 0xffffffff, 0x800, 0x4, 0x401, 0x80000001, 0x7ff, 0x4, 0x4, 0x4, 0x7, 0x0, 0xfff, 0x3, 0xfffffffffffffffb, 0xffff, 0xe5b, 0x9, 0x401, 0x7, 0x2, 0x401, 0x0, 0x10001, 0x2, 0x1, 0x417, 0x40, 0x5a, 0x2, 0x26, 0x1ff, 0x7, 0x43, 0x7fffffff, 0xccf, 0x0, 0x10001, 0xb92, 0x54, 0x9e19, 0x2, 0x0, 0x2, 0x5a1, 0x4, 0x0, 0x6, 0x53, 0x1, 0x8f66, 0x8, 0x1535, 0x4, 0x1, 0x5, 0x8, 0x80000001, 0xffffffff, 0xffffffffffffffb3, 0x401, 0x9, 0x9, 0x20, 0x7, 0x0, 0x4, 0x7, 0xccfc, 0x9, 0x9, 0x8000, 0x8, 0x401a, 0xfffffffffffffc00, 0x2, 0x200, 0x4, 0x1, 0x4, 0x4, 0x81, 0x9, 0xb28]}) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="3e0500000000000000b3c58a16e84d34b3c7877c2f10eb3c119ad4732a4e131d21c7bd958e2b2fc4226ed8b424153a5e4c9190b08fbe2c443b1f665b9193b9d93ffe40f26406d21e8a86d56ac18008fc7ae7810000000b14de51ddfcd0fc914d11bf75c81cd38dbbc204d5cf39730c29e886ccbeae80ba94396c97026307b3bc68471c40983fee0bc3d1c6e833d1ad15e7031c0aefb6d8e389bf787a234e3efe1a2db46309b9fb16b63ee62c61be5e87ec0070198d67354860dc7319ad1bcd003d033987b01a47a87d068efbad39ec54d99cda60427f10d0a906140edc403ebac487658640796b1df164f6", @ANYRES16=r1, @ANYBLOB="17090000000000000000010000000500070000000000080009000000000014001f0002000000000000000000ffff0100000008000a000000002da4f99822392455f3da279afa3057000600020001000000140020000000000000000000000000000000000071b2e6a274954808fc544117783d9add91f1703e3c888789927876dbe2b8c21355391e636d7905e6b1d30dcf2e93b7ef6721131643701d772efcfa5ffee56437539a6411ba55f43c2919e9a0dfade39d3dab2f9d070000518297e87fbcbfa2f21acb77a6c16f60aa3f3656a8612e6923298cb5c43365b0d118027453068e"], 0x5c}}, 0x0) 20:16:37 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000040008000400", @ANYRES32], 0x38}}, 0x0) [ 857.432037][ T1855] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:37 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:37 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000050008000400", @ANYRES32], 0x38}}, 0x0) 20:16:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:37 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 857.682058][ T1882] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:37 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000060008000400", @ANYRES32], 0x38}}, 0x0) 20:16:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:37 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xc00e0000}, 0x0) 20:16:37 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 857.862184][ T1891] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:37 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000080008000400", @ANYRES32], 0x38}}, 0x0) 20:16:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='memory.swap.current\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000300)={0x3ff, 0x4, 0x1, 0x1, 0x0}, &(0x7f0000000340)=0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x66, &(0x7f0000000380)={r7, 0x7ff}, &(0x7f0000000580)=0x8) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="1a0000000000000500000000000000575ae204005675469dfdc62c02acdff0a0af59f8c2aafd0cbe9e42de3d92463b1e1b5e9bfc0d2a96fb0519c3384a6eeec7cec4a55058a35d6fb892b85b665a15afceed3431f2db3050531297dd50b025bdd50803d148f272557c4e26cc9a955eb5f1c1cde7d9cf9fb70ba934c3de8c008016138b133652a197fb0715eef7c4456d263c8fe9db417f00feffffa1e4c80dbcdeaaa68a4860dbdb80aabc574d1a03794e65c2d278cfa22e22dbe0909eed772de7e8b50979b0650a4c14aa5ec975fef610228297f93768293ca790491fe486e7c6f6cd0581cf74537339d477551151eb39d74a51b62af5ba25136c11fa9f2103dc1000"/268], 0x48}}, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000140)={0xcdf2, 0x0, 0x2}) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f0000000280)={0x9, r8}) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000080)={0x0, r8}) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=@newtfilter={0x54, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_RATE={0x6, 0x5, {0x9, 0xff}}, @TCA_CHAIN={0x8, 0xb, 0xfffffffc}, @TCA_CHAIN={0x8, 0xb, 0xfff}, @TCA_RATE={0x6, 0x5, {0x78, 0xfd}}, @TCA_RATE={0x6, 0x5, {0x0, 0x3f}}, @TCA_CHAIN={0x8, 0xb, 0x4}]}, 0x54}}, 0x4004) [ 858.468514][ T1861] EXT4-fs warning (device loop5): read_mmp_block:111: Error -117 while reading MMP block 17 20:16:38 executing program 5: setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000140)={{{@in=@loopback, @in6=@mcast2, 0x4e20, 0x0, 0x4e20, 0x400, 0x0, 0x70, 0x80}, {0x0, 0x0, 0xff, 0x6, 0x2003, 0x0, 0x3, 0x8}, {0xffff, 0x8, 0x9, 0x8001}, 0x8e8, 0x6e6bba, 0x0, 0x1}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4d6}, 0x0, @in6=@ipv4={[], [], @loopback}, 0x3501, 0x4, 0x3, 0x8, 0x0, 0x800, 0x6}}, 0xe8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0xa2, 0x0, 0x0, 0x7f, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0xc, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x7}, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f00000003c0)='./file1\x00', 0xffffffff, 0x1, &(0x7f0000000080)=[{&(0x7f00000000c0)="0400050900000000666174000404090a020002740ef801", 0x17}], 0x10, &(0x7f00000004c0)=ANY=[]) chdir(&(0x7f0000000000)='./file1\x00') r0 = creat(0x0, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x0) setxattr$security_evm(&(0x7f0000000040)='./file1\x00', &(0x7f0000000400)='security.evm\x00', &(0x7f0000000440)=@sha1={0x1, "27b62346426eac4624e3ba26b136df4b3456a305"}, 0x15, 0x1) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x1013c1, 0x0) r2 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) socket$rxrpc(0x21, 0x2, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) write$9p(r1, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df", 0x2bc) sendfile(r1, r2, 0x0, 0x1c500) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x412041, 0x0) recvmsg$kcm(r3, &(0x7f0000000880)={&(0x7f0000000300)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private1}}}, 0x80, 0x0, 0x0, &(0x7f00000007c0)=""/134, 0x86}, 0x40002000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="17090000000000000000010000000500070000000000080009000000000014001f0002ffff0100000008000a000000000006000200040000000000000000000000000000000000040000000000dbcea878c16656ba95b9bf843dc01580802be7694f470af8685b46471779074f141d4543e618b8225d72de9280021db4fb0634ab85deaba7b39894a2141396e59ec9c909601a4efe93dbefb9072531b89cbd7b22020a9fe0118254bd71eb6039fc9a4a3c1c776adbd898153af6445e07efe6173819429959de3624866a095fe865753e3729863e1e9f6a6136363606bc7b93df73ef5140d62618b4ef2f642d5c655bdbf2100ba5d5c223057bec96cea6e9d6e304c4355ceabb7c65646e72b3f48e36f8d6b826cacf596601e4c47274253250fccdeb3c9912833eac4694dc8f014d63b96ff8"], 0x5c}}, 0x0) 20:16:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r5 = open(&(0x7f00000000c0)='./file0\x00', 0x48282, 0x8) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000000280)={0x5, 0x200, 0xff, 0x7f}, 0x10) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r6], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) 20:16:38 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x5}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:38 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xcb489a25}, 0x0) 20:16:38 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000090008000400", @ANYRES32], 0x38}}, 0x0) 20:16:38 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000a0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:38 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 858.716064][ T1929] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 858.768444][ T28] audit: type=1804 audit(1600719398.369:27): pid=1944 uid=0 auid=0 ses=4 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir220449423/syzkaller.Z3f7L3/2630/file1/file0" dev="sda1" ino=16210 res=1 errno=0 20:16:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:38 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x7}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:38 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000b0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000000c0)) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x0) [ 859.163319][ T1958] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:39 executing program 5: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:39 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xefffffff}, 0x0) 20:16:39 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:39 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000c0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r6) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:39 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x9}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 859.549426][ T1992] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 859.569843][ T1995] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:39 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000f0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:39 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) 20:16:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r6) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:39 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xa}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) prctl$PR_GET_NO_NEW_PRIVS(0x27) 20:16:39 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000100008000400", @ANYRES32], 0x38}}, 0x0) 20:16:39 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xb}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:39 executing program 5: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 859.929418][ T2013] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 859.946882][ T2014] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r6) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:39 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000140008000400", @ANYRES32], 0x38}}, 0x0) 20:16:39 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xc}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:39 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xffffa888}, 0x0) 20:16:39 executing program 5: ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) mq_timedsend(r2, &(0x7f0000000100)="af2cf07ebd0122a115473760c35bfd6aafddfa7011a84acef59fa8af6bd72a15562e64df94346b17bb4bf9d9aba217ee973910928f789d07f4d2bbe979dc1eb3af58adcb66c3af89ba427f99d59cb5f92e5a7a26176f34f0d15db9dacbed20d49b95af4124bbaf7109b7dbbfdcd4c00abc8aa14d187ca61dbaf9beb27f3b9762108c4cb60467f319746f852db3", 0x8d, 0x81, &(0x7f0000000080)={r3, r4+10000000}) [ 860.124260][ T2045] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 860.159983][ T2047] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:39 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xd}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:39 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000a320008000400", @ANYRES32], 0x38}}, 0x0) 20:16:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r5) 20:16:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) [ 860.393980][ T2067] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 860.421591][ T2071] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:40 executing program 5: bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={&(0x7f0000000440)="72675a36a5ad89bcc90d2223325d88086c3b0bcc28cb2dc84122c49cfb73875e856de6c3cb89bf3e548036f94b173cb5b81f4b6dc2950a036a8d923096b0f76fdd3757eacea521ea915b4bd9154980f5c11a934189b31923ae3eefae84b50b9d186e992091673194ac66c301946bdf1a4d6ad386fa8d29917fc7dc0bf13f80c698667bf63b431fff78e5e0d9e6bbf06b7cbf61cce2e5866809b20b0c9440c6641ed6098a899596119964c97e2b575e77131962bec9101471ec6b7ab0cb14c076bf9c3d38fdaa1ccc5008a39a9bd52c8d359e7757c599e63ca671d936a5f27be501026605e0248406e466d6", &(0x7f00000001c0)=""/24, &(0x7f0000000540)="8c85fc1a501fc922b0638a663843c1bf11ddf4902016344df60e6132ff39fb0061e936c74f91ff72513d243be58dd187b194021c651e065f25c32b2d8d343c7ead526b15c72fdb864a605113bbcb252ed981c2938e5183679e60e16f79b4161b9ba9af4f42e2901e2b72a8229bd404965c284d86ca8e8d1be758ad132195f19e6b0335c865aae237036f7b46bd6fe53ef94010890d6cf08fa8ef0f671bbd1df6f30102095f7677fcc7da06801325401505d4720c089c4c3a9852b17bced2cd816718f056bc8347cbe851c2a19812a294ba56008e5555c91723440662a8a568f7cb9ff3d901c361d23c7dae255aeb", &(0x7f0000000640)="80d2074257a8b8886d833a9fc3910290fa696079fbcda20d9b118eb052d3b9c6492ab820af3473437b8c912305f4a164501a7363274c88aea1de66a1da7f5b39fcec8653e3e002f08437abe087b3615ce65e0e95f4f77753d955650afa7e16cfd676b0d75cbec9af57fe08db", 0x2, 0x1, 0x4}, 0x38) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000040), 0x8, 0x800) bind$packet(r1, &(0x7f0000000080)={0x11, 0x2, 0x0, 0x1, 0x1, 0x6, @remote}, 0x14) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r3 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100), 0x7}], 0x492492492492805, 0x0) connect$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0xee1, @any, 0x40}, 0xe) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) r5 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0xffff, 0x0) ioctl$SNDRV_PCM_IOCTL_INFO(r5, 0x81204101, &(0x7f0000000280)) ioctl$FIONREAD(r4, 0x541b, &(0x7f0000000100)) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r2, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x40088c0) 20:16:40 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) 20:16:40 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xe}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) 20:16:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:40 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000600008000400", @ANYRES32], 0x38}}, 0x0) 20:16:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x14, r1, 0x917}, 0x14}}, 0x0) 20:16:40 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xf}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 860.749146][ T2094] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 860.775855][ T2093] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:40 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000058650008000400", @ANYRES32], 0x38}}, 0x0) 20:16:40 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xffffff9e}, 0x0) 20:16:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0xfffffffffffffc17, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x2}, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000000)={0x3, 0xfffffffffffffff7, 0x6, 0xb24a}) 20:16:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:16:40 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x10}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) 20:16:40 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000810008000400", @ANYRES32], 0x38}}, 0x0) 20:16:40 executing program 5: ioctl$MON_IOCQ_URB_LEN(0xffffffffffffffff, 0x9201) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffe36, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x0, 0x6, 0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv2(r2, &(0x7f0000000440)=[{&(0x7f0000000100)=""/183, 0xb7}, {&(0x7f0000000240)=""/144, 0x90}, {&(0x7f0000000300)=""/136, 0x88}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000040)=""/42, 0x2a}, {&(0x7f0000000080)}], 0x6, 0x4, 0x4, 0xe) ioctl$SNDCTL_SEQ_RESET(r2, 0x5100) [ 861.073856][ T2117] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 861.095412][ T2118] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:40 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x11}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:16:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) 20:16:40 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xffffffef}, 0x0) [ 861.144920][ T2131] __nla_validate_parse: 42 callbacks suppressed [ 861.144929][ T2131] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 861.165600][ T2132] netlink: 64 bytes leftover after parsing attributes in process `syz-executor.5'. 20:16:40 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000047880008000400", @ANYRES32], 0x38}}, 0x0) [ 861.274426][ T2138] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 861.312857][ T2143] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:40 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x12}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:16:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 861.446822][ T2144] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 861.463911][ T2147] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:41 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x48}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 861.490727][ T2155] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 861.502865][ T2143] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:41 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000048880008000400", @ANYRES32], 0x38}}, 0x0) 20:16:41 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) 20:16:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) close_range(r3, 0xffffffffffffffff, 0x0) 20:16:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) [ 861.634073][ T2171] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:41 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4c}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000000)=@gcm_256={{0x304}, "60aac6152e040dd4", "390e3ff7399804a54f4a383ae76587e4ca78dde0b487b15d26860b767954b297", "9e5b6aa9", "2e323d4a03ef9b03"}, 0x38) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x40) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)=ANY=[@ANYBLOB="1d00001c", @ANYRES16=r1, @ANYBLOB="17090000000000000000010000000500070000000000080009000000000014001f0002000000000000000000ffff0100000008000a0000000000060002000100000014002000"/86], 0x5c}}, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00') sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x2, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x80000001}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040810}, 0x40005) [ 861.710406][ T2174] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:41 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000ffffa8880008000400", @ANYRES32], 0x38}}, 0x0) 20:16:41 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x60}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r2 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/bluetooth/6lowpan_control\x00', 0x2, 0x0) write$binfmt_script(r2, &(0x7f0000000100)={'#! ', './file0', [{0x20, '}!##*'}, {0x20, 'l2tp\x00'}, {0x20, '.w'}, {0x20, '-.\\-]'}, {0x20, 'l2tp\x00'}, {0x20, 'l2tp\x00'}], 0xa, "b9f4ca4e4867bb72555039c238b868ad796c7c92caa8de277b7b0caf351ef13e76352b38b64f596ba1bd2c30ffb905bd746e6cc820187b7492adefc1749344b2d0af52aa106508389ae48ac1f96ead0e934a59a26b8a32f98b77229a83e28e6159e0a90f58ace01590c1bcec1e6b994810896884f38c0670a3d85e4ac1a4c041acb7d9b3a2e1d4491f913d2c450f893c0df694630e48baedc50368158b962018ca01fcb3"}, 0xd0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r3, 0x3309) bind$rose(0xffffffffffffffff, &(0x7f0000000080)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @default]}, 0x40) [ 861.877586][ T2179] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 861.901911][ T2181] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 861.916289][ T2174] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) 20:16:41 executing program 1: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100), &(0x7f0000000140)=0x14) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r5}) close_range(r1, 0xffffffffffffffff, 0x0) 20:16:41 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x68}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00') r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_LEAVE_MESH(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r5}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x8000, 0x3}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x24000080) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="5caf0ab9f635859e769900001000000000000000", @ANYRES16=r1, @ANYBLOB="17090000000000000000010000000500070000000000080009000000000014001f0002000000000000000000ffff0100000008000a0000000000060002000100000014002000"/86], 0x5c}}, 0x0) [ 862.091812][ T2194] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 862.117332][ T2209] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:41 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000ffffff9e0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:41 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x2) 20:16:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:16:41 executing program 1: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r5}) close_range(r1, 0xffffffffffffffff, 0x0) 20:16:41 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x6c}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 862.275494][ T2219] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 862.323469][ T2222] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:42 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000e13c5cd70008000400", @ANYRES32], 0x38}}, 0x0) 20:16:42 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x1) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) sendmsg$NL80211_CMD_GET_MPP(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x2, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4010}, 0x810) 20:16:42 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x74}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:42 executing program 1: socket$nl_route(0x10, 0x3, 0x0) socket(0x100000000011, 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) [ 862.480779][ T2226] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:42 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000d75c3ce10008000400", @ANYRES32], 0x38}}, 0x0) 20:16:42 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = semget(0x3, 0x4, 0x1) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) semtimedop(r1, &(0x7f0000000040)=[{0x2, 0x8000, 0x800}, {0x3, 0x0, 0x1000}, {0x2, 0x415d}, {0x2, 0x3f, 0x800}, {0x2, 0x3ff, 0x800}, {0x2, 0x7, 0x1000}, {0x3, 0x8000, 0x1000}, {0x4, 0x101, 0x800}], 0x8, &(0x7f0000000100)={r2, r3+10000000}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000000)={0x0, 'ipvlan0\x00', {}, 0x16d}) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) 20:16:42 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x3) 20:16:42 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x7a}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:42 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000ffffffef0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:42 executing program 1: socket$nl_route(0x10, 0x3, 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) [ 862.691017][ T2255] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 862.722429][ T2256] 8021q: VLANs not supported on ipvlan0 20:16:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:42 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x300}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 862.862282][ T2258] 8021q: VLANs not supported on ipvlan0 20:16:42 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000fffffff00008000400", @ANYRES32], 0x38}}, 0x0) 20:16:42 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:42 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r3, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x90, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x90}, 0x1, 0x0, 0x0, 0x20040085}, 0x20000015) fsetxattr$security_smack_transmute(r2, &(0x7f0000000300)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000340)='TRUE', 0x4, 0x0) 20:16:42 executing program 1: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:42 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000088a8ffff0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:42 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x4) [ 863.057563][ T2273] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:42 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x500}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:42 executing program 1: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:42 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6d}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x10) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000000)="b7fbb9cdacf406385820382e5decfd4177935d2da1b7eacef1c836143790dde0") 20:16:42 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000007fffffff0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:42 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x600}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:42 executing program 1: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:43 executing program 5: ioctl$USBDEVFS_DROP_PRIVILEGES(0xffffffffffffffff, 0x4004551e, &(0x7f0000000000)=0x800) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4}, 0x2) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="17090000000000000000010000000500170000000000080009000000000014001f0002000000000000000000ffff0100000008000a0000000000060002000100000014002000"/86], 0x5c}}, 0x0) 20:16:43 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x5) 20:16:43 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000009effffff0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:43 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:43 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000efffffff0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x700}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 863.568697][ T2326] netlink: 'syz-executor.5': attribute type 23 has an invalid length. [ 863.610376][ T2333] netlink: 'syz-executor.5': attribute type 23 has an invalid length. 20:16:43 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:43 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000f0ffffff0008000400", @ANYRES32], 0x38}}, 0x0) 20:16:43 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x6) 20:16:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r3, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x90, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x90}, 0x1, 0x0, 0x0, 0x20040085}, 0x20000015) fsetxattr$security_smack_transmute(r2, &(0x7f0000000300)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000340)='TRUE', 0x4, 0x0) 20:16:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x900}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:43 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000200000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:43 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xa00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r3, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x90, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x90}, 0x1, 0x0, 0x0, 0x20040085}, 0x20000015) fsetxattr$security_smack_transmute(r2, &(0x7f0000000300)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000340)='TRUE', 0x4, 0x0) 20:16:43 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000300000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:43 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:43 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x8) 20:16:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xb00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r3, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x90, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x90}, 0x1, 0x0, 0x0, 0x20040085}, 0x20000015) fsetxattr$security_smack_transmute(r2, &(0x7f0000000300)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000340)='TRUE', 0x4, 0x0) 20:16:43 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000400000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:43 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r3, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x90, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x90}, 0x1, 0x0, 0x0, 0x20040085}, 0x20000015) 20:16:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xc00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:43 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000500000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:43 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:44 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x9) 20:16:44 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xd00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r3, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:44 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000600000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:44 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:44 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xe00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, 0x0, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:44 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xa) 20:16:44 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000800000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:44 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:44 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xf00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, 0x0, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:44 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:44 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000900000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:44 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xc) 20:16:44 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1100}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, 0x0, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:44 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:44 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000a00000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:44 executing program 3: r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r2, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:44 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1200}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:44 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:44 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000b00000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:44 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xf) 20:16:45 executing program 3: r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:45 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:45 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1216}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r2, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:45 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000c00000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:45 executing program 3: r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:45 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1612}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)={0x9, [0x3f, 0x9, 0xab000, 0x8000, 0x8, 0xffff, 0x6, 0x3, 0x10001]}) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r2, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:45 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000f00000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:45 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x10) 20:16:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:45 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:45 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000001000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:45 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3f00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r3, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:45 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:45 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000001400000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:45 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:45 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:45 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r1, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) [ 866.203978][ T2563] __nla_validate_parse: 42 callbacks suppressed [ 866.203987][ T2563] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:45 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x60) 20:16:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:45 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000006000000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:45 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, 0x0) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:46 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r1, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:46 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4800}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 866.389114][ T2578] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:46 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, 0x0) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r1, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:46 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4c00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 866.589374][ T2579] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x0, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) [ 866.647884][ T2578] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:46 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000003000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:46 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x300) 20:16:46 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x6000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:46 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, 0x0) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r1, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) [ 866.802070][ T2608] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:46 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x6800}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:46 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x0, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r1, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) [ 867.020141][ T2618] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x0, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:46 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x6c00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 867.060815][ T2608] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r1, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:46 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x500) 20:16:46 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000005000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x0, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:46 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x0, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:46 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x7400}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:46 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r0, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) [ 867.269856][ T2645] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:47 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x0, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) [ 867.443717][ T2648] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:47 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r0, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:47 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x7a00}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) [ 867.488543][ T2645] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:47 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000006000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:47 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x600) 20:16:47 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r0, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:47 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x0, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:47 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x34000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:47 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000009000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, 0x0, 0x0) 20:16:47 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x0, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:47 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x900) 20:16:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:47 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x400300}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:47 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000a000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, 0x0, 0x0) 20:16:47 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x0, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:47 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000320a000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:47 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xa00) 20:16:47 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, 0x0, 0x0) 20:16:47 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:47 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 20:16:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 20:16:48 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:48 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000b000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:48 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xc00) 20:16:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 20:16:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:48 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:48 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000c000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 20:16:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:48 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xc4e) 20:16:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:48 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:48 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000f000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 20:16:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x5000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:48 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 20:16:48 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000014000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:48 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xec0) 20:16:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x6000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, 0x0, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:48 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:48 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000a32000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, 0x0, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:49 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, 0x0, 0x109, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:49 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x7000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:49 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000008847000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:49 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xf00) 20:16:49 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000008848000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:49 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:49 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x8000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r1, 0x0, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:49 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r1, 0x0, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:49 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x9000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:49 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000006558000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:49 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x4000) 20:16:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:49 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r1, 0x0, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}}, 0x0) 20:16:49 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000060000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:49 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, 0x0, &(0x7f0000000140)) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:49 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xa000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x14, r1, 0x109}, 0x14}}, 0x0) 20:16:49 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:49 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000005865000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, 0x0, &(0x7f0000000140)) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:50 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x4788) 20:16:50 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, 0x0) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:50 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000081000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:50 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xb000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, 0x0, &(0x7f0000000140)) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:50 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:16:50 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000004788000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:50 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xc000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:50 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 20:16:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:50 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 20:16:50 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) sendmsg$TIPC_CMD_SHOW_PORTS(r10, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) 20:16:50 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x4888) 20:16:50 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000004888000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:50 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xd000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:50 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 870.871979][ T2955] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:50 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000040030008000400", @ANYRES32], 0x38}}, 0x0) 20:16:50 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) sendmsg$TIPC_CMD_SHOW_PORTS(r10, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) 20:16:50 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xe000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:50 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="0823000000927f9802ff01000000"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) r2 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) r3 = add_key$user(&(0x7f00000005c0)='user\x00', &(0x7f0000000600)={'syz', 0x3}, &(0x7f0000000740)="1e", 0x1, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f00000004c0)={r3, r2, r2}, &(0x7f00000001c0)=""/234, 0xea, &(0x7f0000000500)={&(0x7f0000000540)={'sha256-ssse3\x00'}}) keyctl$invalidate(0x15, r3) stat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) fstat(r5, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r6) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) fstat(r7, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r8) syz_mount_image$romfs(&(0x7f0000000000)='romfs\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x6, &(0x7f0000000540)=[{&(0x7f0000000100)="1efea18bbe7e0a79c21b19b423e67a7d8f44b27330de0b9ccb286bf5da364001f1b78ceee12fff43556044d09749040c23cb104d4ac5f2fffbbb5fea4ae2c6c500c7b8533a492e7512f7162ef696aa38a49d0ba9222b0b8fb1fa648241e52cac37b51c52a0d008e20d701c7f54d81577860371a19d21ede00ec439d4b7595f0b518b69197889afca75a816a24c2df280c2d0203180d2eb752350c62c82878bfd2bb5f071e7058bb0280f67655a6c18e6d9757cda9286d6c701f2624129ae36d713dc87471eda33268e94cd5193c15aa73db673822dadaf0d610eb433165caa7309e4998363eb861bd0bbb137c971aac680fd24", 0xf3, 0x2}, {&(0x7f0000000280)="b1b912b0bd7cc1de33e4592b1a173294f2d1a5c3d69f9865b69dc0652798ce7b32d5b9a2d0d65c09703181ed971f40a5560009e456312c75841b23f8050dca88cebd0522ddaf006beca310f4913796b942f93e3c0b8367e2102f1220c51e41eca2", 0x61, 0x1}, {&(0x7f0000000300)="2a75a1a9ce1c4d5ec9d12f67572efd17c4061b670e350c6ac246dd2181b2eb2acdd6890d4f4165e28d869ca0e59325663bb069e669087a06133585270982c0356158987684ed146e452e84a8461df09b3d477b9167bad3a5302be813401caa7b00a84a606fc33f095ebf41c6c5a98616a38037f38ee214df83c34973328779f582b72455714541e118b52c657de2e1e480a11eb84b1e82", 0x97, 0x10000}, {&(0x7f00000003c0)="51da894044d5654f114c2df08f7e2271bab56cfab9157fa34960522f31881fccc73d1876df3bf87e41c22bdb523abb3acc30275c1752a1aa4f6f7c11bb974d24998303146c7605fcb2c491408fe38deebc6a13d24590d6582eea1063302981096dcfad1d9a87395ba0c55c49850dc6c80a5a53ad459a45b953a408706948e58a06a6351aaa6495503b5a8fe12da57dfb78179b7c0d4afcc4cdd8686366e65addba76f9985b7b00", 0xa7, 0x7}, {&(0x7f0000000480)="20cbde8383a40635e778f18714b1557dd20ceede178373742af0258403fd8ac7201b1d9dc937417d8878dd1519a1d11634ef301c0ae7be048a2b82cff13cf3f4579927028a10cb9496070e9a3cb763a897d15568a7aa68742deac98a76547bcb69e282e4605f0746c7c8903afb63c7a35baab8d98f9f2147aa4df5dd22acd76e3e934ef5eac783414aacb1571ed64e5c1e54be2f1cae77e80d53e218e026d73b947220f0cc34c2edd7b7b6c5754f", 0xae, 0x5}, {&(0x7f0000000880)="2de97724c82ad3ade602c88f38a72e35d5b568026b305a672d20e11737fa8c48ebcc863f9bb95d885ea295be6aa5299e3b2875ed640d407c6c902e106a9f880b2db4a4043fbe0c1574e7cdc86b0dcc96beb69d68a307041149b076454a40802c51c05393b14921ef6be052959712094526b97fdfed3602a685b075f1edf2a7ab1879a75f16fe7ab6fe34f77d6f9f990274ef380a9e6007f6fbbeb42ab9f1c0790efddf03dc36924282d55343d519d1f90e653c1a5d15b19db7712647698acc45cf23464f2588d201c00c4eb9ff2bf0cc1e8135272d103f5154345064c04b734a5c0dc5236261debd9bb92f409ff6dde768ccfa4c3d5e1eaed31a3de3e64ca9311109283ce904e3b505cedfc27c763f104f42681b6e297d03df6e22945776c0a41511aee7442e5b35ba67dc1be36722e85f3e6e308e0a356e43f6f0ba57eea93e0ab12d719f299f800c501e1dccd4b25b51be8afc3229cf6f459e68d6353bbaea3146eff80968634e9657773e4fa5942e72ec050de655529259b4c5dc9b3d4824f08a4fd01a47c5e4d42a2e716a048e23b963766c2cef67dd1ce48fd537e599315ef0f0c940a82c3656a9df7f093d74647f43e558f5634b4497ffa86032b331556d83902c3fe218af287e914264075404864dacbe2d3ba173d3d6403de91b35d78b220c60a9fc017b45498cea8bc3d58316f1a4cc31fd9d952143500196089e8850dcfae416c8d5732a9f831f65cbad093857d0f0cc23ff467da929897b5606de3197edb5104c4c2adb4dadb5e34c608727575b5b999c4c3284168630da1284d060484cc212a7eb5c467f8a62db48bbdd00f789e527659eee3d5d12dff0e26adf44c9e2532705d7b6720e2da17d647090a09a495b2863d0916e776eae39dced80fbf82ca1c644ddb134ef723082c5db844c6577b4de5ac43274023a9810f30fbbd75d67b52a3904dbc4eaacfbe2047c57e7fb5893d044b975e7ccee29c0896ac624d3d797a21753b624ea953f733bf9570fed637d6342889d5f9e707e340bb26c7e2dacc2bda7f1a0a8cb54b0dd831da9c6c32daac1b0f3fc3af97445db4b3de481f5f48003c33f206a7587251a6702aded8cf758f9c8668de450e7eca932107d2d7fa7f6789e25bf53cc6229b46b23255f66be1ac64f9da15e2bb26e015697bd95ec7abebc7759e7ebb4572627b7faec9d5a958a213156bf76836271af8479cce7283372e90b1ba4bd1c208f562ff2b922ade4517da509b62494a385173d0886a14e818d8984998af94a9351165bc54dbf6929baacfcb321a725a9ca1e2c03e6357ad617dd7edbd082921f076cc24e6179625a99dff9a84a7a2dc1e2369defad9ed7f361fb349250cd5e0a3ece55b8dcb22ae0beecf4a9ac6beac7307dbc60e9e25ebe7dc428265cc88e0fda83c32e6cd0f49ad9b124840e8437a08b9576b47c9ab78d6d53ede64aa619797d8250b0bc27664eeae44e08d72013d5b9d94cbd6f307db9363a12788e0b76924bf3fd3796cad93ed4311a12f99693094c44ea42ae486bc76717c8cbe2eaeb163d32d6daadae3ab9abbb5a0d7a2b3cb5ed2ec5404ac9983fab53f7a4805ff9a3c83c5d8db124b7190096e851994de7a69be55c0e23510f63f49dc9cfe404d24a86d178c530ddfcaa1a29d5b61da1807b6d649a2c25950c2c3c629758f9a132878512d90a03ddbe5ffe7d7c6d192e957210e9d7a1932a5cb5829fb6af1a58a8cf3e46a72d8f47e7321cc5ccc501c73c0d441abcd5b3d5decba702caa5de9bdd1a4af55940ad4e5a139dd8885a9a5f02261fcd927e06ca37a9c412b60048f83132839012cd9b77f24a5db10d63ce1694433907ec16d490fffdf00138052cc2b55249f5d2a3cc5d94fb1c78c3b0d82c7cf4c657a66ab5c4779cfb7b22babac4ea44e6cf62940972751688180bc505db5f30f1896fba5ba3a3bbbd6ffb7a78f0b262d05530722dd7c0f03973b98489d046e64cfb4cdaba31cbad929fbba7a465af105b0709826d8a102a29443a6a2e10b6414bdd69355b1d57bb669283bda1d2f8a6a3255e87ca802a964d6db857cf7d03a337098ba6f12c1131490998202a364e25c83fdb91c3400ead3227a96cd4affb2de67c4f2dcedec974bca05e56bf4c5b8e239fe009951cfe9977a4b5ec4c0345a83876f93f76272572f01bb459dd2d7f0993e11cf4f86824d188bebb007a76b91469217fc06c736b544691445d302d21d2128fbfc9c9ff71bdeae4abe4701689e6d00655bb862b1b12bf459e2078663b57778985133aaa5f514e20ff313ff26476d95c83df2ec1ffe36a75ff556b1e55ddb342392ce2c1f18d9f0c77d39a8bc66b3b1c12a0a3ab91f72b4bec4790ff6292da4a32e3a5946f9fdfacb1b43e386ffc55464ab7cad9517841f10f1d551926f37422b716e396d70377c19ffee8dd88e6d46865a95162c0d6ea441238b7c820ccdf94973dcaa94511c7315b316d11ddea0a254effe2d3a4034bfcf68d70a7fa82ff5f427f0acb88e49e92577cf83fc8c9f2becb059fa1493bfc0ffdaf8d7e8bcaba1281fd1c348724ef6d88cd8773a08ff26a83af1e551da6713f6ed6582345f85a104e0e0853a58719125745256d3a65edce65729ea7cb18bfb58a8a804e30d4dc2946020ae03eb8ea48a0397f7b8c5b250a088bdd72532464042148297025e806ec2a1f56200b5d9477d9cd6bff618fe4a0580ebde2bfe18fd711a49550de0f610dc0dffd37a6ad6feffcc4740cf329e980b4e8a81c306b1b02676c78287c55cbb8da542a3ff0da904cb715f9b54a187de4dd13ba86519473723c17ee9b40583b05db93801253f94aa3c99b09fdaf6dc82c6e526e9657d7b082d9ff971d2138f114a7bc89f2fdcd488666259e27e9466068959e9c6287ef76224ff84ff0e56bee51459586ca3897a8b467cc2c9122c2d446b972292e65d12d878db204d59868cfcefb46f02c0350ce1bac438654502c75a93d1dedd1c861287869169280fb5e04cdd8fa8f9d4143bd75a1d68ec5f7694ad568bc2a2f522ed49fa17d67fe84203c41fe01f30244dce21f059cbfe3848e0986ac9692c27551efd9d40afb8cd2731ea46a220d2e9faac63bbc82ba1f36ae15b6c9470a194966f20e0f742ab0636bb36f94ef92076d7f8c1b33a65edd9f56b24f97081529225a508fa222334e92fd5ab610c0d5ac14f1a0eb46d7a2b4077b754ea67e3f11097f4536eb599a6b8f89b7fb0f13e6de363684623718380619777e3ccc7195da6b3fbf58a3bc3ec41a5d69187f79347366feb0152038d6d7d6bad454fa97f846a122dcbaed1e954d5e01576b84841c6f402d0289b9fbc3e1bfa38d1dcdde1a94304e4cc5a81ceb81d64f8bb72948e975b567f47ff561555a4aed1cd0d3779bd9d93d52ba242f551990b27ccbd285f1b154429c5c6c29f1078e778abff11d5611a9b61c51f65dbf04dcdf9e5894b5ea384a8f64461ffa7736f2bf42831709cad9475f5f50c53cd1ebf312d75cb9d32748d234af92478ff0b70b8976bcfa7162e62bd283ad645d1783c5a542dd6fee292187b7d1295d0d2295dd769eb3c5cea2948ea4c9b28fdb2780c46889362da4b6e6bf796e41fa5f668d95790a6ce3b83017495139ebceaf41b45ce52f5990f6b186b4fb8b766d9c7189dc9841462b3a008608da70ed2d0ed4163012c0afe87ba94b3febc5a556f71b44ba262dc5bef21a7346f0afdc885018e519b1b735d956d1176278d4b3ea4643d4c737b82056c5ab70642b89447844523bc5383e61665942d47081f2ba8751c078dc64f8353efbb3578381c9290e70fe89705d458606e24a596177d1c8957cb210305189dc758186b29a7208ce5db17a7294f78d1a7ea7a60b1c04d400275302c8553ee73f18e3037a77a6d35010ae8e74d747ca75bdee74a7c30ef1884a23419c11cf2cef7402b09f737691a633589af409fb1b08d5d3fc413e54df85354afb5d2ed91f527d37bd004db1877eb62410caf948e89e5c76bf9e96d56d6c922c8de00b0e35c761a620d4e0048a2d99a0ea0387374f520700e61477a8c5b6c4cfc3db92a560662e278cb3ca8522b1fef062abcd72213dd9a5d151aacb53e6f4c157325d98ed83a66f313c5622d1776f290b5e31304f38998a39116e1541a97c4f1b28f5998d39f95fa0e3f64c3ce0d81c9f1e7933d07cb95a6af384850a8324d252be2dfe7a136520777aa7ae3c7ae580fd895fbc09b2245ff73c198ef2fd2fb30bc560b0c760921a807f496fbff92f7d6d937bd10ab9c40a9557bc1302407a01b61ceb6207bc9213001d5edf60e8e609281d7cb027c0a55e3bfb2ed7bcb0a0aa8e8cb44b7f32119fac44a19da5a4c20636ef6f0636d826a5809034fc44ce0ea6dc1b536f04e30fbe5deb701a83d1caaab053864eeca5b68bc7a78cb22ee83bbb36c77a25ea1420a99474b8405b5592eb5087441bdc8d0be50e4b2c39c61c11647ef824d7de05f50abc1aa3e3b721963676b3188df17e7a58f5e637e2983e14e1b2e7f772777a72991041ecdf026eb850654b3ab64975b4a2abe0cebcf192d7f4615a44a7f98f6fd4ceb1e4336293d43db86b70e433546a3638d9f37c6127c12854c5c018dd5f78d0cf5b68a2d26a4281eed1fd9f122eb9d4eef0013b29464bf0f54af8730748b5786118d9863d11b1798b267a31e90d9edc6d62952fa7f5649919586f058c9d422c11d56e36a51a611b1c23834165fdd9b8abc849769ecdf8c5cf8b2d57454fbb2a1ff736084d557d9c1bb3621de4c2d1846620fa62a3cdf50b46c122b23e60a8662a3a1d1d596140d5b03fc3952ec0e71debd3c997c690a08e497f61636e5ac5c9e55bfdb4b77d41212e77410c753a7bb5a953f01050494e231681c14e5453259a2cd6ebc21032defee4391e46c47f7b58ae88eab295c63e7b2cf8f19b1c789c41557665f06df0833aa02ecc66e5d3344025797c371a57552b7015045e68dac39c738ffbc4f4d150cc8786f60f5076eab1e23d70aa4c4fb95eaae46b8ad80b8d5ab7e43c3e1c0163ea0e6f7ec9f0c1a3206ce69ee40962e40337b824f5454e2e15561510d2aa8c766222791578b8b1fc3a682b646034d5cd6de07cd34ba1f7175938f4380870ce4b66594b5d37110a595082dc0b3848c75734b907166ada76d6d2a1c4005a4a89d71d28c2714a73e3bee3625812dacdf90ccf62658a42c8405f94618d716f3c8997d67db985973b95ff45591a574283c6231d3c82e746ef85f9d8a0196d73e21af3fe779ccfaef30adeec41b98919aa4bed15c65f5f095be5290fcd67c8450728b28f027013ce28285dab8c82af2c0d7f550132c506aa6bdbdef05bc95c3459b18dcbde88a3f5dde232b982ab72940208b203b47ff86e8ac310fbf2ce1c731804a01faae49ab4008cae383a86a12ed1f3f6c44453177858609672d2501a0078dd9f9c6fa89d5749af8567ef4a9172f96cb5cb27e392f2d83081cb95d1ce37ca7757bb3ede1be6795bcc054a3a30614fbbbf41b051be6580c683bb685c62484af940e25a3438ff777852433436f4a850af23f07698c8fee7b60fd0b9d08fb7f42f1529f2e6a6f040a2f80b5daa03103c354f6762aa10cbe6f6bf1f3d8f23a59700633fd19fa0cc08c10a5ff99b7c1040d7253abf994e0d0e9b7109265fd6e27beb219e5489f58dc9430214e396fe8fd5a8b6fc0e63d38128eef142068a3667a94fa0847973d17ce5e79087444bd9ac7da7d4a44ca0d6f848027c5f8f6e6e82c6e107973dd3c5bded051cbf83dc80b23a577fcc179c80b72c9ccd04ae", 0x1000, 0x3}], 0x0, &(0x7f0000000680)={[{'l2tp\x00'}, {'{'}, {'l2tp\x00'}, {'l2tp\x00'}], [{@fowner_eq={'fowner', 0x3d, r4}}, {@euid_eq={'euid', 0x3d, r6}}, {@fowner_gt={'fowner>', r8}}, {@obj_user={'obj_user', 0x3d, '\xce%&}$\xe2-'}}, {@fsname={'fsname'}}, {@fsuuid={'fsuuid', 0x3d, {[0x38, 0x30, 0x33, 0x64, 0x31, 0x34, 0x63, 0x63], 0x2d, [0x66, 0x39, 0x30, 0x32], 0x2d, [0x37, 0x0, 0x38, 0x39], 0x2d, [0x35, 0x35, 0x64, 0x32], 0x2d, [0x63, 0x62, 0x39, 0x32, 0x0, 0x66, 0x37, 0x32]}}}]}) r9 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000780)='/dev/ocfs2_control\x00', 0x410000, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r9, &(0x7f0000001940)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000800)={&(0x7f0000001880)={0xa8, 0x0, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x0, 0x1}}, @NL80211_ATTR_TX_RATES={0x7c, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x54, 0x0, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x9, 0x8000, 0x100, 0x2, 0xfc01, 0x80, 0x400]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xff, 0x8, 0x5, 0x2, 0x7, 0x8, 0x82af]}}, @NL80211_TXRATE_HT={0x12, 0x2, "899cf75641a46c2739e3fcf5b881"}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x5, 0x7f, 0x3, 0x2e91, 0xffff, 0x81, 0x1000]}}]}, @NL80211_BAND_2GHZ={0x24, 0x0, [@NL80211_TXRATE_LEGACY={0x1d, 0x1, "1f83fb99f9ff15d771f07478c8ef67e8dec7af8d65939ab80c"}]}]}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x494b}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4000044}, 0x4000800) 20:16:50 executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:50 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000003400008000400", @ANYRES32], 0x38}}, 0x0) 20:16:50 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x4e0c) [ 871.150055][ T2978] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 871.223270][ T2984] __nla_validate_parse: 37 callbacks suppressed [ 871.223278][ T2984] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:50 executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:50 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xf000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:50 executing program 1: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_STEREO(r0, 0xc0045003, &(0x7f00000000c0)) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x141003, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000040)=0x7ff) 20:16:50 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) sendmsg$TIPC_CMD_SHOW_PORTS(r10, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) 20:16:50 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000108000400", @ANYRES32], 0x38}}, 0x0) [ 871.343808][ T2989] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x10000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:51 executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000005c0)='veth0_to_hsr\x00') ioctl$VIDIOC_ENUMSTD(0xffffffffffffffff, 0xc0485619, &(0x7f0000000280)={0x0, 0x4, "05bede9094f54ec790e12866e3fdf414eb42b65ac658ce33", {0x0, 0x8000}, 0x100}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x2800, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x1c, &(0x7f0000000140)=[@in6={0xa, 0x4e20, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x7}]}, &(0x7f00000001c0)=0x10) r3 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100), 0x7}], 0x492492492492805, 0x0) setsockopt$inet6_tcp_buf(r3, 0x6, 0x1c, &(0x7f0000000340)="3b25c66fa38145d69abcaf3b667bb7966561c6bdd4a2b49e40ba7675cfeeaaf46db6cecd6f6faeb333dea4af3e3ae72fb06b90210b66eaf1d1cd5fafd8e10e2a80a6dc88ee4e9c29927e6dc59b4554", 0x4f) bind$netlink(r3, &(0x7f00000003c0)={0x10, 0x0, 0x25dfdbfc, 0x40000}, 0xc) ioctl$SIOCGETNODEID(r3, 0x89e1, &(0x7f0000000300)={0x4}) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000200)={0x5, 0x9, 0x0, 0x5, r2}, &(0x7f0000000240)=0x10) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x141003, 0x0) vmsplice(r4, 0x0, 0x0, 0x0) ioctl$SOUND_PCM_READ_BITS(r4, 0x80045005, &(0x7f0000000040)) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) splice(r1, &(0x7f0000000080)=0xa8, r1, &(0x7f0000000100)=0x9, 0x7fd, 0x1) [ 871.509088][ T3002] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 871.529019][ T3003] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 871.553884][ T2995] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) 20:16:51 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000208000400", @ANYRES32], 0x38}}, 0x0) 20:16:51 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x5865) 20:16:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x11000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:51 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a067f0200ff000000020000000058000b4824ca765f64009400ff0325010ebc000002000000008000f0fffeffe809005300fff5dd000000100001000d0c10000000000000000002", 0x58}], 0x1) 20:16:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x1612, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) [ 871.747172][ T3023] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 871.795747][ T3027] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 871.833899][ T3026] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:51 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000308000400", @ANYRES32], 0x38}}, 0x0) 20:16:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x12000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:51 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x2, @local}, 0x10) preadv2(r6, &(0x7f0000001600)=[{&(0x7f0000000240)=""/101, 0x65}, {&(0x7f00000002c0)=""/145, 0x91}, {&(0x7f0000000080)=""/54, 0x36}, {&(0x7f0000000380)=""/144, 0x90}, {&(0x7f0000000440)=""/151, 0x97}, {&(0x7f0000000500)=""/254, 0xfe}, {&(0x7f0000000600)=""/4096, 0x1000}], 0x7, 0x7, 0xc923, 0x2) 20:16:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) 20:16:51 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) [ 872.019666][ T3038] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 872.045246][ T3045] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 872.063275][ T3032] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, 0x0}, 0x0) 20:16:51 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000408000400", @ANYRES32], 0x38}}, 0x0) [ 872.097017][ T3051] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:51 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x6000) 20:16:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x16120000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:51 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x2, @local}, 0x10) preadv2(r6, &(0x7f0000001600)=[{&(0x7f0000000240)=""/101, 0x65}, {&(0x7f00000002c0)=""/145, 0x91}, {&(0x7f0000000080)=""/54, 0x36}, {&(0x7f0000000380)=""/144, 0x90}, {&(0x7f0000000440)=""/151, 0x97}, {&(0x7f0000000500)=""/254, 0xfe}, {&(0x7f0000000600)=""/4096, 0x1000}], 0x7, 0x7, 0xc923, 0x2) 20:16:51 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r8 = dup(r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)={r9}) close_range(r3, 0xffffffffffffffff, 0x0) [ 872.210929][ T3054] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, 0x0}, 0x0) 20:16:51 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000508000400", @ANYRES32], 0x38}}, 0x0) [ 872.277097][ T3061] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 872.316731][ T3063] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3f000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 872.350089][ T3065] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:52 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r8}) 20:16:52 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x2, @local}, 0x10) preadv2(r6, &(0x7f0000001600)=[{&(0x7f0000000240)=""/101, 0x65}, {&(0x7f00000002c0)=""/145, 0x91}, {&(0x7f0000000080)=""/54, 0x36}, {&(0x7f0000000380)=""/144, 0x90}, {&(0x7f0000000440)=""/151, 0x97}, {&(0x7f0000000500)=""/254, 0xfe}, {&(0x7f0000000600)=""/4096, 0x1000}], 0x7, 0x7, 0xc923, 0x2) 20:16:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, 0x0}, 0x0) 20:16:52 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x40000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 872.569710][ T3082] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:52 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000608000400", @ANYRES32], 0x38}}, 0x0) [ 872.674938][ T3087] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) 20:16:52 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r5) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)) 20:16:52 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x6558) 20:16:52 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x2, @local}, 0x10) preadv2(r6, &(0x7f0000001600)=[{&(0x7f0000000240)=""/101, 0x65}, {&(0x7f00000002c0)=""/145, 0x91}, {&(0x7f0000000080)=""/54, 0x36}, {&(0x7f0000000380)=""/144, 0x90}, {&(0x7f0000000440)=""/151, 0x97}, {&(0x7f0000000500)=""/254, 0xfe}, {&(0x7f0000000600)=""/4096, 0x1000}], 0x7, 0x7, 0xc923, 0x2) 20:16:52 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x48000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:52 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000808000400", @ANYRES32], 0x38}}, 0x0) [ 872.849212][ T3104] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) 20:16:52 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4c000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 872.891292][ T3107] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:52 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r5) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)) 20:16:52 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x2, @local}, 0x10) 20:16:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) 20:16:52 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x60000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 873.111537][ T3121] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:52 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000908000400", @ANYRES32], 0x38}}, 0x0) 20:16:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x0, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) [ 873.267593][ T3131] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:52 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x8100) 20:16:52 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r5) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)) 20:16:52 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000a08000400", @ANYRES32], 0x38}}, 0x0) 20:16:52 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) 20:16:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x0, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) 20:16:53 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x68000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 873.390783][ T3145] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r6}) 20:16:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x0, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) [ 873.567185][ T3157] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:53 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x6c000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:53 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000b08000400", @ANYRES32], 0x38}}, 0x0) [ 873.612718][ T3174] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:53 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x8847) 20:16:53 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) 20:16:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:16:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r6}) 20:16:53 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000c08000400", @ANYRES32], 0x38}}, 0x0) 20:16:53 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x74000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 873.910964][ T3190] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 873.923960][ T3199] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 873.938987][ T3200] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:53 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x8848) 20:16:53 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000f08000400", @ANYRES32], 0x38}}, 0x0) 20:16:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x1c, 0x18, 0x1}, 0x1c}}, 0x0) 20:16:53 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) socket$inet_tcp(0x2, 0x1, 0x0) 20:16:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r6}) 20:16:53 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x7a000000}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:53 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x9effffff}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 874.199271][ T3220] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 874.222559][ T3219] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:53 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000001008000400", @ANYRES32], 0x38}}, 0x0) 20:16:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) r5 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r6}) 20:16:53 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) 20:16:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x1c, 0x18, 0x1}, 0x1c}}, 0x0) 20:16:54 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000001408000400", @ANYRES32], 0x38}}, 0x0) 20:16:54 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xc00e) [ 874.397099][ T3249] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 874.415645][ T3251] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:54 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xefffffff}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x1c, 0x18, 0x1}, 0x1c}}, 0x0) 20:16:54 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x100000000011, 0x2, 0x0) bind(r3, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r4, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r1, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r4, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) 20:16:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) r5 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r6}) 20:16:54 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000a3208000400", @ANYRES32], 0x38}}, 0x0) [ 874.662982][ T3270] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:54 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xf0ffffff}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}]}, 0x24}}, 0x0) [ 874.706134][ T3271] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:54 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x20000) 20:16:54 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000006008000400", @ANYRES32], 0x38}}, 0x0) 20:16:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) r5 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r6}) 20:16:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}]}, 0x24}}, 0x0) 20:16:54 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x100000000011, 0x2, 0x0) bind(r3, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r4, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:54 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xfeffffff}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:54 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000586508000400", @ANYRES32], 0x38}}, 0x0) [ 875.001105][ T3300] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 875.026479][ T3304] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:54 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x34000) 20:16:54 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xffffff7f}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}]}, 0x24}}, 0x0) 20:16:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r7}) 20:16:54 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x100000000011, 0x2, 0x0) bind(r3, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:54 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000008108000400", @ANYRES32], 0x38}}, 0x0) [ 875.203243][ T3330] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:54 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xffffff9e}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:54 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x100000000011, 0x2, 0x0) bind(r3, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r7}) 20:16:54 executing program 3: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) 20:16:55 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xffffffef}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 875.468686][ T3350] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:55 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000478808000400", @ANYRES32], 0x38}}, 0x0) [ 875.511147][ T3351] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:55 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x400300) 20:16:55 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x100000000011, 0x2, 0x0) bind(r3, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r7}) 20:16:55 executing program 3: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) 20:16:55 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xfffffff0}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:55 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000488808000400", @ANYRES32], 0x38}}, 0x0) 20:16:55 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x100000000011, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r4, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) [ 875.844616][ T3373] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 875.857128][ T3374] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:55 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xfffffffe}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r7}) 20:16:55 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x100000000011, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r4, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:55 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000ffffa88808000400", @ANYRES32], 0x38}}, 0x0) 20:16:55 executing program 3: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) 20:16:55 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x1000000) 20:16:55 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000ffffff9e08000400", @ANYRES32], 0x38}}, 0x0) [ 876.043878][ T3412] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 876.067788][ T3414] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:55 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x4, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:55 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x100000000011, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r4, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r7}) 20:16:55 executing program 3: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x2, @local}, 0x10) preadv2(r6, &(0x7f0000001600)=[{&(0x7f0000000240)=""/101, 0x65}, {&(0x7f00000002c0)=""/145, 0x91}, {&(0x7f0000000080)=""/54, 0x36}, {&(0x7f0000000380)=""/144, 0x90}, {&(0x7f0000000440)=""/151, 0x97}, {&(0x7f0000000500)=""/254, 0xfe}, {&(0x7f0000000600)=""/4096, 0x1000}], 0x7, 0x7, 0xc923, 0x2) [ 876.237682][ T3421] __nla_validate_parse: 34 callbacks suppressed [ 876.237689][ T3421] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'. [ 876.302236][ T3427] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 876.323169][ T3422] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 876.332868][ T3434] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'. 20:16:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000e13c5cd708000400", @ANYRES32], 0x38}}, 0x0) 20:16:56 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x2000000) [ 876.363342][ T3432] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 876.396091][ T3436] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:56 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x38, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 876.494290][ T3447] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:56 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x5c, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 876.535601][ T3451] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:16:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000d75c3ce108000400", @ANYRES32], 0x38}}, 0x0) 20:16:56 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:56 executing program 3: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x2, @local}, 0x10) preadv2(r6, &(0x7f0000001600)=[{&(0x7f0000000240)=""/101, 0x65}, {&(0x7f00000002c0)=""/145, 0x91}, {&(0x7f0000000080)=""/54, 0x36}, {&(0x7f0000000380)=""/144, 0x90}, {&(0x7f0000000440)=""/151, 0x97}, {&(0x7f0000000500)=""/254, 0xfe}, {&(0x7f0000000600)=""/4096, 0x1000}], 0x7, 0x7, 0xc923, 0x2) 20:16:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r7}) [ 876.700205][ T3459] netlink: 56 bytes leftover after parsing attributes in process `syz-executor.2'. [ 876.714622][ T3451] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 876.764821][ T3476] netlink: 56 bytes leftover after parsing attributes in process `syz-executor.2'. [ 876.779821][ T3468] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:16:56 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) [ 876.806915][ T3475] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 876.823980][ T3470] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000ffffffef08000400", @ANYRES32], 0x38}}, 0x0) 20:16:56 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x3000000) 20:16:56 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x23, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:56 executing program 3: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r2, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001880)={&(0x7f0000001700)=ANY=[@ANYBLOB="50010000", @ANYRES16=0x0, @ANYBLOB="000829bd7000fbdbdf25190000003800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000140002007465616d5f736c6176655f3100000000080003000100000008000300020000005000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08001000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000006800018008000100", @ANYRES32=0x0, @ANYBLOB="0800030002000000140002007465616d3000000000000000000000000800030003000000140002006970766c616e30000000000000000000140002007665746830000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000002800018008000100", @ANYRES32=r2, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r5, @ANYBLOB="2400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000300030000000800030000000000"], 0x150}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f00000001c0)=0x40, 0x4) openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000001680)='/sys/fs/smackfs/load\x00', 0x2, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x2, @local}, 0x10) preadv2(r6, &(0x7f0000001600)=[{&(0x7f0000000240)=""/101, 0x65}, {&(0x7f00000002c0)=""/145, 0x91}, {&(0x7f0000000080)=""/54, 0x36}, {&(0x7f0000000380)=""/144, 0x90}, {&(0x7f0000000440)=""/151, 0x97}, {&(0x7f0000000500)=""/254, 0xfe}, {&(0x7f0000000600)=""/4096, 0x1000}], 0x7, 0x7, 0xc923, 0x2) 20:16:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r8}) 20:16:56 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:56 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 877.104959][ T3495] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 877.119993][ T3500] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:56 executing program 3: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_STEREO(r0, 0xc0045003, &(0x7f00000000c0)=0x4000000) 20:16:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000fffffff008000400", @ANYRES32], 0x38}}, 0x0) 20:16:56 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x4000000) 20:16:56 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket(0x100000000011, 0x2, 0x0) bind(r2, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:56 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x7], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r8}) 20:16:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x9], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:57 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000088a8ffff08000400", @ANYRES32], 0x38}}, 0x0) 20:16:57 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket(0x100000000011, 0x2, 0x0) bind(r2, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:57 executing program 3: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_STEREO(r0, 0xc0045003, &(0x7f00000000c0)=0x5c00) [ 877.440201][ T3531] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:57 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x5000000) 20:16:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r8}) 20:16:57 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000007fffffff08000400", @ANYRES32], 0x38}}, 0x0) 20:16:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0xa], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:57 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000180073fa00000000000000ff07000000000000000000000000000008", @ANYRES32=r1, @ANYBLOB="1400070000000000000000000000000000000001"], 0x38}}, 0x0) r2 = socket(0x100000000011, 0x2, 0x0) bind(r2, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x600) 20:16:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 877.758471][ T3550] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:57 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000009effffff08000400", @ANYRES32], 0x38}}, 0x0) 20:16:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x7) 20:16:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r3 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={r7}) 20:16:57 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=0x14) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x100000000011, 0x2, 0x0) bind(r2, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00d\x00\'\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=r5], 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x2c, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@TCA_CHAIN={0x8}]}, 0x2c}}, 0x400000000000000) 20:16:57 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x6000000) 20:16:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:57 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000efffffff08000400", @ANYRES32], 0x38}}, 0x0) [ 877.961772][ T3578] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r3 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={r7}) [ 878.035776][ T3580] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x3], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:57 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x100000000011, 0x2, 0x0) bind(r2, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x4], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x5], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 878.328461][ T3595] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 878.359315][ T3600] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:58 executing program 3 (fault-call:4 fault-nth:0): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:16:58 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x8000000) 20:16:58 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x100000000011, 0x2, 0x0) bind(r2, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:58 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000f0ffffff08000400", @ANYRES32], 0x38}}, 0x0) 20:16:58 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r3 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r6 = dup(r5) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={r7}) [ 878.524769][ T3624] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 878.528796][ T3626] FAULT_INJECTION: forcing a failure. [ 878.528796][ T3626] name failslab, interval 1, probability 0, space 0, times 0 20:16:58 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000001000400", @ANYRES32], 0x38}}, 0x0) 20:16:58 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0xe, 0x6, 0x201}, 0x14}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x100000000011, 0x2, 0x0) bind(r2, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r3, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x6], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 878.652105][ T3626] CPU: 1 PID: 3626 Comm: syz-executor.3 Not tainted 5.9.0-rc6-syzkaller #0 [ 878.660766][ T3626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 878.670841][ T3626] Call Trace: [ 878.674181][ T3626] dump_stack+0x1d6/0x29e [ 878.678559][ T3626] should_fail+0x38a/0x4e0 [ 878.683021][ T3626] should_failslab+0x5/0x20 [ 878.687558][ T3626] slab_pre_alloc_hook+0x4c/0xe0 [ 878.692525][ T3626] ? __alloc_skb+0x94/0x4f0 [ 878.697068][ T3626] kmem_cache_alloc_node+0x56/0x290 [ 878.702310][ T3626] __alloc_skb+0x94/0x4f0 [ 878.707654][ T3626] ? netlink_autobind+0x28c/0x2c0 [ 878.712708][ T3626] netlink_sendmsg+0x7b2/0xd70 [ 878.717515][ T3626] ? netlink_getsockopt+0x9e0/0x9e0 [ 878.722743][ T3626] ____sys_sendmsg+0x519/0x800 [ 878.727538][ T3626] ? import_iovec+0x12a/0x2c0 [ 878.732704][ T3626] __sys_sendmsg+0x2b1/0x360 [ 878.737370][ T3626] ? perf_trace_lock+0x90/0x360 [ 878.742277][ T3626] ? perf_trace_lock+0x1/0x360 [ 878.747061][ T3626] ? trace_lock_release+0x149/0x1a0 [ 878.752297][ T3626] ? ksys_write+0x1b1/0x220 [ 878.756828][ T3626] ? ksys_write+0x1b1/0x220 [ 878.761369][ T3626] ? lock_is_held_type+0xb3/0xe0 [ 878.767208][ T3626] ? check_preemption_disabled+0x51/0x140 [ 878.772974][ T3626] ? syscall_enter_from_user_mode+0x24/0x180 [ 878.778991][ T3626] ? lockdep_hardirqs_on+0x79/0x100 [ 878.784382][ T3626] ? syscall_enter_from_user_mode+0x24/0x180 [ 878.790383][ T3626] do_syscall_64+0x31/0x70 [ 878.795170][ T3626] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 878.801869][ T3626] RIP: 0033:0x45d5f9 [ 878.805802][ T3626] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 878.825423][ T3626] RSP: 002b:00007fb41477fc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 878.833851][ T3626] RAX: ffffffffffffffda RBX: 000000000002cf00 RCX: 000000000045d5f9 [ 878.841838][ T3626] RDX: 0000000000000000 RSI: 00000000200016c0 RDI: 0000000000000003 [ 878.849820][ T3626] RBP: 00007fb41477fca0 R08: 0000000000000000 R09: 0000000000000000 [ 878.857801][ T3626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 878.865786][ T3626] R13: 00007ffcd46950ef R14: 00007fb4147809c0 R15: 000000000118cf4c 20:16:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x7], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 878.984824][ T3633] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 879.009852][ T3640] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:58 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x9000000) 20:16:58 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000004000400", @ANYRES32], 0x38}}, 0x0) 20:16:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x8], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 879.184028][ T3655] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 20:16:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:16:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x9], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:58 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000002000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:58 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x134, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_SUPP_RATES={0xfc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, "3f176736d64dc5ba20a759fbba826f6bf7bd4cead582d48d0b2a6ea9cdb104f7c3fd9462cf2ec38907b752e212bed777fe4b9037ce98119f2bd426da07512f773d14d2bec228d81e7069a565491bf00637878203f1842d0cd322f15e1e79d9df2e0068f007c8c04d64093651e0b5ad8a283035b26445c70aa3750ee9c0b42b7a5de1d7a5e988763280fe63a2323c3d238379e52ac4c8762760d64ff11b8f0bca0ea37e9df88a70e6a78fef3af83dad0b1afa1e356bdd0df2565024ab57d8e15bd615161334ab95a7d69536cd098c4ffbbb1bff82b5491c46152a09c72cd6d378c75bc61c"}, @NL80211_BAND_6GHZ={0xe, 0x3, "0c5b0ff69e19ddec0187"}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x2a}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x8040) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r8}) 20:16:59 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000040)={0xec4f, 0x3, 0x0, 0x8}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:59 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xa000000) 20:16:59 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000003000008000400", @ANYRES32], 0x38}}, 0x0) [ 879.470552][ T3673] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 879.506832][ T3675] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0xa], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 879.532211][ T3677] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:59 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x7, @loopback}]}, 0x38}}, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={r8}) 20:16:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:16:59 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) [ 879.704052][ T3689] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 879.735078][ T3690] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:59 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000004000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0xb], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:59 executing program 5: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100), &(0x7f0000000140)=0x14) r1 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r2 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000040)={r6}) [ 879.882651][ T3697] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 879.903447][ T3701] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:59 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:59 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000005000008000400", @ANYRES32], 0x38}}, 0x0) 20:16:59 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xc000000) 20:16:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0xc], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x2, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:16:59 executing program 5: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r1 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r2 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r5 = dup(r4) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000040)={r6}) 20:16:59 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000006000008000400", @ANYRES32], 0x38}}, 0x0) [ 880.141574][ T3722] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 880.155160][ T3729] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:16:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0xd], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:16:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:16:59 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xf000000) 20:16:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x3, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:16:59 executing program 5: socket$nl_route(0x10, 0x3, 0x0) socket(0x100000000011, 0x2, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:16:59 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000008000008000400", @ANYRES32], 0x38}}, 0x0) 20:17:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0xe], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:00 executing program 5: socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 880.490589][ T3748] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 880.502765][ T3751] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000009000008000400", @ANYRES32], 0x38}}, 0x0) 20:17:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) [ 880.545209][ T3766] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:00 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x10000000) 20:17:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0xf], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:00 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x4, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000a000008000400", @ANYRES32], 0x38}}, 0x0) [ 880.765729][ T3785] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x10], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:00 executing program 5: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:00 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x259a48cb) 20:17:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x5, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000b000008000400", @ANYRES32], 0x38}}, 0x0) [ 880.932734][ T3798] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x11], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:00 executing program 5: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x6, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000c000008000400", @ANYRES32], 0x38}}, 0x0) 20:17:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) [ 881.191352][ T3822] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:00 executing program 5: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x12], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:00 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x40000000) 20:17:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x7, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000f000008000400", @ANYRES32], 0x38}}, 0x0) 20:17:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x0, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 881.368003][ T3845] __nla_validate_parse: 41 callbacks suppressed [ 881.368011][ T3845] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x48], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x4c], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 881.541090][ T3849] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 881.568413][ T3853] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 881.594099][ T3852] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x0, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:01 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000010000008000400", @ANYRES32], 0x38}}, 0x0) 20:17:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x8, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) [ 881.805165][ T3889] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 881.845165][ T3887] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:17:01 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x4e0c0000) 20:17:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x60], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x0, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:01 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000014000008000400", @ANYRES32], 0x38}}, 0x0) 20:17:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x9, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 881.983771][ T3900] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x68], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 882.146749][ T3907] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 882.172041][ T3908] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x6c], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 882.198311][ T3900] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:01 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x60000000) 20:17:01 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000060000008000400", @ANYRES32], 0x38}}, 0x0) 20:17:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x0, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xa, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x74], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(0xffffffffffffffff, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) [ 882.413480][ T3940] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:17:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x0, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 882.455982][ T3941] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 882.474707][ T3946] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:02 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x7a], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:02 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000030008000400", @ANYRES32], 0x38}}, 0x0) 20:17:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xb, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) [ 882.605768][ T3949] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x0, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 882.674932][ T3963] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:02 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x65580000) 20:17:02 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000050008000400", @ANYRES32], 0x38}}, 0x0) 20:17:02 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x0, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:02 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000060008000400", @ANYRES32], 0x38}}, 0x0) 20:17:02 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 882.936766][ T3980] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x0, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:02 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000090008000400", @ANYRES32], 0x38}}, 0x0) 20:17:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xd, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:02 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x81000000) 20:17:02 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x3], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) [ 883.172780][ T4009] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:02 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000a0008000400", @ANYRES32], 0x38}}, 0x0) 20:17:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x0, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:02 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000320a0008000400", @ANYRES32], 0x38}}, 0x0) 20:17:02 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xe, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:03 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x4], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) [ 883.464868][ T4033] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:03 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x5], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x88470000) 20:17:03 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000b0008000400", @ANYRES32], 0x38}}, 0x0) 20:17:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xf, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:03 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x6], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:03 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000c0008000400", @ANYRES32], 0x38}}, 0x0) [ 883.745731][ T4055] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:03 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x7], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x88480000) 20:17:03 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000f0008000400", @ANYRES32], 0x38}}, 0x0) 20:17:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 883.990990][ T4079] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:03 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x8], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x11, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:03 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000140008000400", @ANYRES32], 0x38}}, 0x0) 20:17:03 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x9], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x88a8ffff) 20:17:03 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 884.278605][ T4103] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x12, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000a320008000400", @ANYRES32], 0x38}}, 0x0) 20:17:04 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0xa], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 884.507220][ T4121] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x9effffff) 20:17:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000088470008000400", @ANYRES32], 0x38}}, 0x0) 20:17:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x25, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, 0x0, &(0x7f0000000140)) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:04 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0xb], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:04 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0xc], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000088480008000400", @ANYRES32], 0x38}}, 0x0) [ 884.814956][ T4146] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:04 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0xd], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, 0x0, &(0x7f0000000140)) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x48, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xc00e0000) 20:17:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000065580008000400", @ANYRES32], 0x38}}, 0x0) 20:17:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) [ 885.029888][ T4175] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, 0x0, &(0x7f0000000140)) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:04 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0xe], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000600008000400", @ANYRES32], 0x38}}, 0x0) 20:17:04 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:04 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0xf], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 885.299281][ T4193] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xcb489a25) 20:17:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x60, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:05 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000058650008000400", @ANYRES32], 0x38}}, 0x0) 20:17:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, 0x0) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x10], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:05 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000810008000400", @ANYRES32], 0x38}}, 0x0) [ 885.557321][ T4217] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:05 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xefffffff) 20:17:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x68, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, 0x0) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x11], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:05 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000047880008000400", @ANYRES32], 0x38}}, 0x0) 20:17:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x12], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x48], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, 0x0) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x4c], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:05 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000048880008000400", @ANYRES32], 0x38}}, 0x0) [ 885.879124][ T4238] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:05 executing program 1: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x60], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:05 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xf0ffffff) 20:17:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x6c, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x0, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:05 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000000001c000400", @ANYRES32], 0x38}}, 0x0) 20:17:05 executing program 1: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x0, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 886.164285][ T4278] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x68], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:05 executing program 1: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x100000000011, 0x2, 0x0) bind(r0, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="1400079d03ff0000000000000000000000000000000000089d0000000150839b0c546e139d4f45e3503f83e429243652e336b078e34a9f648e598b3fc928fa0cd9e5cc49a97655fde086fb8ca7b20ca0e59d5637ed7bf71d3122d07664e831eafb642ecdf2b5590104c59e1322fbb365e85bdbcc6ffcb7944eb7aa03f4261045d7064a43d134f16011877ac25f3ab300000000bafbc6e80032269ca1d54aad56ece4c59e69ca76e00d7c3de320cdae0da83be1d4475fb5ea2d54ff11fae70dfc986635df8802ca4b992aa18b13abc32fc261e717652c7d6f59cff18c4269762af81db0ed55e7d807e5b452985c8eb20090925ef2a1def876d14ff812bfdbb25a1ae927e96a8cdc0f72722c7c6a7ddee1a2354b5e15863f5ae4dbae08712782a0d850194d98de1a92cfb24ab0a3c3c7ef92c15637cf20fa716abc01c7d53bbcae769e89fd4eaa08e4130be1a8cad3ccac8b82b63dde79dc2e58414fe6e1816e58a2af5047910841fe74f55dd5aa76247c3b55d72f94b8d32210"], 0x38}}, 0x0) 20:17:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x74, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:05 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x0, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:06 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x6c], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 886.369388][ T4285] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 886.391390][ T4282] __nla_validate_parse: 38 callbacks suppressed [ 886.391399][ T4282] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) [ 886.427249][ T4302] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:06 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xffffa888) 20:17:06 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000020008000400", @ANYRES32], 0x38}}, 0x0) 20:17:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x0, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x7a, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:06 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x74], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) [ 886.578794][ T4313] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:17:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x0, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 886.629447][ T4314] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:06 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000030008000400", @ANYRES32], 0x38}}, 0x0) 20:17:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) 20:17:06 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x7a], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 886.780992][ T4318] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 886.801306][ T4332] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:17:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x0, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 886.830876][ T4321] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xfc, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:06 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xffffff7f) 20:17:06 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000040008000400", @ANYRES32], 0x38}}, 0x0) 20:17:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, 0x0}, 0x0) 20:17:06 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) [ 886.990055][ T4345] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 887.022474][ T4350] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:17:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, 0x0}, 0x0) [ 887.039395][ T4351] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x300, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:06 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000050008000400", @ANYRES32], 0x38}}, 0x0) 20:17:06 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, 0x0}, 0x0) [ 887.212184][ T4366] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 20:17:06 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000060008000400", @ANYRES32], 0x38}}, 0x0) [ 887.270951][ T4369] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 887.288235][ T4357] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:07 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xffffff9e) 20:17:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b}) r3 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x500, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:07 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x3], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x38}}, 0x0) [ 887.385757][ T4381] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 887.451949][ T4386] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:07 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000080008000400", @ANYRES32], 0x38}}, 0x0) 20:17:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x38}}, 0x0) 20:17:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x600, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:07 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x4], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x38}}, 0x0) [ 887.686990][ T4404] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:07 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xffffffef) 20:17:07 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x5], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:07 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000090008000400", @ANYRES32], 0x38}}, 0x0) 20:17:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x700, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2], 0x38}}, 0x0) 20:17:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)) [ 887.889193][ T4429] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:07 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000a0008000400", @ANYRES32], 0x38}}, 0x0) 20:17:07 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x6], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x900, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)) [ 888.092879][ T4433] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 888.108626][ T4452] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:07 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x7], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:07 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xfffffff0) 20:17:07 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000b0008000400", @ANYRES32], 0x38}}, 0x0) 20:17:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400"], 0x38}}, 0x0) 20:17:07 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)) 20:17:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xa00, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:07 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x8], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 888.349017][ T4471] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:08 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x9], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xb00, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:08 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000c0008000400", @ANYRES32], 0x38}}, 0x0) 20:17:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400"], 0x38}}, 0x0) 20:17:08 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000f0008000400", @ANYRES32], 0x38}}, 0x0) [ 888.551200][ T4494] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:08 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x20000000000) 20:17:08 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0xa], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400"], 0x38}}, 0x0) 20:17:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xc00, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:08 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000100008000400", @ANYRES32], 0x38}}, 0x0) 20:17:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r4}) 20:17:08 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0xb], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 888.834587][ T4513] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32], 0x38}}, 0x0) 20:17:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={r5}) [ 888.880087][ T4524] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:08 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0xc], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xd00, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:08 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x40030000000000) 20:17:08 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000140008000400", @ANYRES32], 0x38}}, 0x0) 20:17:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32], 0x38}}, 0x0) [ 889.032876][ T4533] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:08 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000600008000400", @ANYRES32], 0x38}}, 0x0) 20:17:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xe00, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:08 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0xd], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:08 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000308000400", @ANYRES32], 0x38}}, 0x0) [ 889.216394][ T4555] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32], 0x38}}, 0x0) 20:17:08 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x100000000000000) 20:17:08 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0xf00, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:09 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0xe], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYRES32=r2], 0x38}}, 0x0) 20:17:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000508000400", @ANYRES32], 0x38}}, 0x0) 20:17:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, 0x0) [ 889.482046][ T4571] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYRES32=r2], 0x38}}, 0x0) 20:17:09 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0xf], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000608000400", @ANYRES32], 0x38}}, 0x0) 20:17:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x1100, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:09 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x200000000000000) 20:17:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, 0x0) 20:17:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYRES32=r2], 0x38}}, 0x0) 20:17:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000908000400", @ANYRES32], 0x38}}, 0x0) 20:17:09 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x10], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, 0x0) [ 889.799663][ T4597] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB, @ANYRES32=r2], 0x38}}, 0x0) 20:17:09 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x300000000000000) 20:17:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000a08000400", @ANYRES32], 0x38}}, 0x0) 20:17:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x1200, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:09 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x11], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB, @ANYRES32=r2], 0x38}}, 0x0) 20:17:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)) 20:17:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000320a08000400", @ANYRES32], 0x38}}, 0x0) [ 890.031073][ T4633] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB, @ANYRES32=r2], 0x38}}, 0x0) 20:17:09 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x400000000000000) 20:17:09 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x12], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x176d, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)) 20:17:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000b08000400", @ANYRES32], 0x38}}, 0x0) 20:17:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="38000000180001000000000000000000", @ANYRES32=r2], 0x38}}, 0x0) 20:17:09 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x48], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:09 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)) [ 890.320690][ T4657] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="38000000180001000000000000000000", @ANYRES32=r2], 0x38}}, 0x0) 20:17:10 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x500000000000000) 20:17:10 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000c08000400", @ANYRES32], 0x38}}, 0x0) 20:17:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x2000, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:10 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x4c], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:10 executing program 5 (fault-call:7 fault-nth:0): r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="38000000180001000000000000000000", @ANYRES32=r2], 0x38}}, 0x0) 20:17:10 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x60], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 890.592817][ T4680] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:10 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000f08000400", @ANYRES32], 0x38}}, 0x0) [ 890.659440][ T4691] FAULT_INJECTION: forcing a failure. [ 890.659440][ T4691] name failslab, interval 1, probability 0, space 0, times 0 20:17:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x2500, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) [ 890.742525][ T4691] CPU: 0 PID: 4691 Comm: syz-executor.5 Not tainted 5.9.0-rc6-syzkaller #0 [ 890.751157][ T4691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 890.761224][ T4691] Call Trace: [ 890.764565][ T4691] dump_stack+0x1d6/0x29e [ 890.768921][ T4691] should_fail+0x38a/0x4e0 [ 890.773361][ T4691] should_failslab+0x5/0x20 [ 890.777882][ T4691] slab_pre_alloc_hook+0x4c/0xe0 [ 890.782849][ T4691] ? tomoyo_realpath_from_path+0xd8/0x630 [ 890.788593][ T4691] __kmalloc+0x6c/0x300 [ 890.792762][ T4691] ? rcu_read_lock_sched_held+0x2f/0xa0 [ 890.798365][ T4691] ? trace_kfree+0xb2/0x100 [ 890.802891][ T4691] tomoyo_realpath_from_path+0xd8/0x630 [ 890.808470][ T4691] tomoyo_path_number_perm+0x18f/0x690 [ 890.813986][ T4691] security_file_ioctl+0x55/0xb0 [ 890.818965][ T4691] __se_sys_ioctl+0x48/0x170 [ 890.823574][ T4691] do_syscall_64+0x31/0x70 [ 890.827716][ T4710] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 890.828000][ T4691] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 890.841105][ T4691] RIP: 0033:0x45d5f9 [ 890.845008][ T4691] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 890.864619][ T4691] RSP: 002b:00007f8c8fac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 890.873040][ T4691] RAX: ffffffffffffffda RBX: 000000000000cbc0 RCX: 000000000045d5f9 [ 890.881030][ T4691] RDX: 0000000020000040 RSI: 00000000c00c642d RDI: 0000000000000003 20:17:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000", @ANYRES32=r2], 0x38}}, 0x0) 20:17:10 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x68], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:10 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000001408000400", @ANYRES32], 0x38}}, 0x0) 20:17:10 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x600000000000000) 20:17:10 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000a3208000400", @ANYRES32], 0x38}}, 0x0) [ 890.889017][ T4691] RBP: 00007f8c8fac4ca0 R08: 0000000000000000 R09: 0000000000000000 [ 890.897265][ T4691] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 890.905255][ T4691] R13: 00007ffcf722307f R14: 00007f8c8fac59c0 R15: 000000000118cf4c 20:17:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000", @ANYRES32=r2], 0x38}}, 0x0) 20:17:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x3f00, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) [ 891.064479][ T4691] ERROR: Out of memory at tomoyo_realpath_from_path. [ 891.078590][ T4725] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:10 executing program 5 (fault-call:7 fault-nth:1): r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000", @ANYRES32=r2], 0x38}}, 0x0) 20:17:10 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000884708000400", @ANYRES32], 0x38}}, 0x0) 20:17:10 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x6c], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:10 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x800000000000000) 20:17:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x4000, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) [ 891.242186][ T4740] FAULT_INJECTION: forcing a failure. [ 891.242186][ T4740] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 891.255432][ T4740] CPU: 1 PID: 4740 Comm: syz-executor.5 Not tainted 5.9.0-rc6-syzkaller #0 [ 891.264021][ T4740] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 891.274090][ T4740] Call Trace: [ 891.277424][ T4740] dump_stack+0x1d6/0x29e [ 891.281779][ T4740] should_fail+0x38a/0x4e0 [ 891.286249][ T4740] prepare_alloc_pages+0x248/0x4b0 [ 891.291381][ T4740] __alloc_pages_nodemask+0xbc/0x5c0 [ 891.296698][ T4740] kmem_getpages+0x37/0x1d0 [ 891.301212][ T4740] cache_grow_begin+0x64/0x2b0 [ 891.305998][ T4740] cache_alloc_refill+0x359/0x3f0 [ 891.311037][ T4740] ? __kmalloc+0xd3/0x300 [ 891.315381][ T4740] ? check_preemption_disabled+0x51/0x140 [ 891.321119][ T4740] ? tomoyo_realpath_from_path+0xd8/0x630 [ 891.326872][ T4740] __kmalloc+0x2e6/0x300 [ 891.331144][ T4740] tomoyo_realpath_from_path+0xd8/0x630 [ 891.336722][ T4740] tomoyo_path_number_perm+0x18f/0x690 20:17:10 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000884808000400", @ANYRES32], 0x38}}, 0x0) [ 891.342245][ T4740] security_file_ioctl+0x55/0xb0 [ 891.347212][ T4740] __se_sys_ioctl+0x48/0x170 [ 891.351844][ T4740] do_syscall_64+0x31/0x70 [ 891.356287][ T4740] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 891.356881][ T4746] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 891.362193][ T4740] RIP: 0033:0x45d5f9 [ 891.362209][ T4740] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 20:17:11 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x74], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:11 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x900000000000000) 20:17:11 executing program 5 (fault-call:7 fault-nth:2): r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 891.362216][ T4740] RSP: 002b:00007f8c8fac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 891.362227][ T4740] RAX: ffffffffffffffda RBX: 000000000000cbc0 RCX: 000000000045d5f9 [ 891.362235][ T4740] RDX: 0000000020000040 RSI: 00000000c00c642d RDI: 0000000000000003 [ 891.362242][ T4740] RBP: 00007f8c8fac4ca0 R08: 0000000000000000 R09: 0000000000000000 [ 891.362249][ T4740] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 891.362257][ T4740] R13: 00007ffcf722307f R14: 00007f8c8fac59c0 R15: 000000000118cf4c 20:17:11 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x7a], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 891.561571][ T4759] FAULT_INJECTION: forcing a failure. [ 891.561571][ T4759] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 891.575769][ T4759] CPU: 0 PID: 4759 Comm: syz-executor.5 Not tainted 5.9.0-rc6-syzkaller #0 [ 891.581868][ T4750] __nla_validate_parse: 52 callbacks suppressed [ 891.581878][ T4750] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. [ 891.584356][ T4759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 891.584362][ T4759] Call Trace: [ 891.584387][ T4759] dump_stack+0x1d6/0x29e [ 891.584406][ T4759] should_fail+0x38a/0x4e0 [ 891.584430][ T4759] prepare_alloc_pages+0x248/0x4b0 [ 891.584449][ T4759] __alloc_pages_nodemask+0xbc/0x5c0 [ 891.584464][ T4759] ? ____cache_alloc_node+0x15f/0x220 [ 891.584484][ T4759] kmem_getpages+0x37/0x1d0 [ 891.642329][ T4759] cache_grow_begin+0x64/0x2b0 [ 891.647088][ T4759] ____cache_alloc_node+0x179/0x220 [ 891.652291][ T4759] ? tomoyo_realpath_from_path+0xd8/0x630 [ 891.658031][ T4759] __kmalloc+0x167/0x300 [ 891.662304][ T4759] tomoyo_realpath_from_path+0xd8/0x630 [ 891.667949][ T4759] tomoyo_path_number_perm+0x18f/0x690 [ 891.673463][ T4759] security_file_ioctl+0x55/0xb0 [ 891.678421][ T4759] __se_sys_ioctl+0x48/0x170 [ 891.683051][ T4759] do_syscall_64+0x31/0x70 [ 891.687499][ T4759] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 891.694181][ T4759] RIP: 0033:0x45d5f9 [ 891.698081][ T4759] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 891.717719][ T4759] RSP: 002b:00007f8c8fac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 891.726148][ T4759] RAX: ffffffffffffffda RBX: 000000000000cbc0 RCX: 000000000045d5f9 [ 891.734164][ T4759] RDX: 0000000020000040 RSI: 00000000c00c642d RDI: 0000000000000003 [ 891.742155][ T4759] RBP: 00007f8c8fac4ca0 R08: 0000000000000000 R09: 0000000000000000 [ 891.750145][ T4759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 891.758135][ T4759] R13: 00007ffcf722307f R14: 00007f8c8fac59c0 R15: 000000000118cf4c 20:17:11 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:11 executing program 5 (fault-call:7 fault-nth:3): r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 891.788697][ T4753] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 891.840076][ T4760] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 20:17:11 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000655808000400", @ANYRES32], 0x38}}, 0x0) [ 891.869950][ T4771] FAULT_INJECTION: forcing a failure. [ 891.869950][ T4771] name failslab, interval 1, probability 0, space 0, times 0 20:17:11 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0x2], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a00"/28, @ANYRES32=r2], 0x38}}, 0x0) [ 891.952727][ T4771] CPU: 0 PID: 4771 Comm: syz-executor.5 Not tainted 5.9.0-rc6-syzkaller #0 [ 891.961366][ T4771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 891.971436][ T4771] Call Trace: [ 891.974744][ T4771] dump_stack+0x1d6/0x29e [ 891.979125][ T4771] should_fail+0x38a/0x4e0 [ 891.983631][ T4771] should_failslab+0x5/0x20 [ 891.988167][ T4771] slab_pre_alloc_hook+0x4c/0xe0 [ 891.993119][ T4771] ? kzalloc+0x16/0x30 [ 891.997206][ T4771] __kmalloc+0x6c/0x300 [ 892.001380][ T4771] kzalloc+0x16/0x30 [ 892.002753][ T4778] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 892.005981][ T4771] dma_buf_export+0x216/0x970 [ 892.006021][ T4771] drm_gem_dmabuf_export+0x42/0x170 [ 892.006040][ T4771] drm_gem_prime_handle_to_fd+0x6b6/0x7c0 [ 892.030928][ T4771] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 [ 892.036870][ T4771] drm_ioctl_kernel+0x2f3/0x430 [ 892.041774][ T4771] drm_ioctl+0x585/0x910 [ 892.046043][ T4771] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 20:17:11 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000006008000400", @ANYRES32], 0x38}}, 0x0) [ 892.051965][ T4771] ? do_vfs_ioctl+0x6bc/0x16d0 [ 892.056755][ T4771] ? bpf_lsm_file_ioctl+0x5/0x10 [ 892.061712][ T4771] ? drm_ioctl_kernel+0x430/0x430 [ 892.066751][ T4771] __se_sys_ioctl+0xfb/0x170 [ 892.071363][ T4771] do_syscall_64+0x31/0x70 [ 892.075788][ T4771] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 892.081728][ T4771] RIP: 0033:0x45d5f9 [ 892.085659][ T4771] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 892.105276][ T4771] RSP: 002b:00007f8c8fac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 892.112483][ T4785] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 892.113737][ T4771] RAX: ffffffffffffffda RBX: 000000000000cbc0 RCX: 000000000045d5f9 [ 892.113746][ T4771] RDX: 0000000020000040 RSI: 00000000c00c642d RDI: 0000000000000003 [ 892.113754][ T4771] RBP: 00007f8c8fac4ca0 R08: 0000000000000000 R09: 0000000000000000 20:17:11 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x4788, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:11 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0x3], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 892.113762][ T4771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 892.113770][ T4771] R13: 00007ffcf722307f R14: 00007f8c8fac59c0 R15: 000000000118cf4c 20:17:11 executing program 5 (fault-call:7 fault-nth:4): r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) [ 892.321620][ T4800] FAULT_INJECTION: forcing a failure. [ 892.321620][ T4800] name failslab, interval 1, probability 0, space 0, times 0 [ 892.334771][ T4760] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 892.335274][ T4800] CPU: 0 PID: 4800 Comm: syz-executor.5 Not tainted 5.9.0-rc6-syzkaller #0 [ 892.352735][ T4800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 892.363109][ T4800] Call Trace: [ 892.366418][ T4800] dump_stack+0x1d6/0x29e [ 892.370770][ T4800] should_fail+0x38a/0x4e0 [ 892.375211][ T4800] should_failslab+0x5/0x20 [ 892.379732][ T4800] slab_pre_alloc_hook+0x4c/0xe0 [ 892.384689][ T4800] ? tomoyo_encode2+0x25a/0x560 [ 892.389553][ T4800] __kmalloc+0x6c/0x300 [ 892.393732][ T4800] tomoyo_encode2+0x25a/0x560 [ 892.398431][ T4800] tomoyo_realpath_from_path+0x5d6/0x630 [ 892.404092][ T4800] tomoyo_path_number_perm+0x18f/0x690 [ 892.409618][ T4800] security_file_ioctl+0x55/0xb0 [ 892.414580][ T4800] __se_sys_ioctl+0x48/0x170 [ 892.419189][ T4800] do_syscall_64+0x31/0x70 [ 892.423622][ T4800] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 892.429526][ T4800] RIP: 0033:0x45d5f9 [ 892.433478][ T4800] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 892.453098][ T4800] RSP: 002b:00007f8c8fac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 892.461524][ T4800] RAX: ffffffffffffffda RBX: 000000000000cbc0 RCX: 000000000045d5f9 20:17:12 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xa00000000000000) 20:17:12 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0x4], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 892.469533][ T4800] RDX: 0000000020000040 RSI: 00000000c00c642d RDI: 0000000000000003 [ 892.473774][ T4786] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. [ 892.477517][ T4800] RBP: 00007f8c8fac4ca0 R08: 0000000000000000 R09: 0000000000000000 [ 892.477525][ T4800] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 892.477532][ T4800] R13: 00007ffcf722307f R14: 00007f8c8fac59c0 R15: 000000000118cf4c 20:17:12 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000586508000400", @ANYRES32], 0x38}}, 0x0) [ 892.526791][ T4800] ERROR: Out of memory at tomoyo_realpath_from_path. 20:17:12 executing program 5 (fault-call:7 fault-nth:5): r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:12 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0x5], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 892.651442][ T4791] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 892.664578][ T4807] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 892.689700][ T4818] FAULT_INJECTION: forcing a failure. 20:17:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a00"/28, @ANYRES32=r2], 0x38}}, 0x0) [ 892.689700][ T4818] name failslab, interval 1, probability 0, space 0, times 0 20:17:12 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0x6], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x4800, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) [ 892.741299][ T4818] CPU: 1 PID: 4818 Comm: syz-executor.5 Not tainted 5.9.0-rc6-syzkaller #0 [ 892.749924][ T4818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 892.759998][ T4818] Call Trace: [ 892.763296][ T4818] dump_stack+0x1d6/0x29e [ 892.767640][ T4818] should_fail+0x38a/0x4e0 [ 892.772104][ T4818] should_failslab+0x5/0x20 [ 892.776646][ T4818] slab_pre_alloc_hook+0x4c/0xe0 [ 892.781637][ T4818] ? security_inode_alloc+0x32/0x1e0 [ 892.786931][ T4818] kmem_cache_alloc+0x4b/0x2d0 [ 892.791704][ T4818] ? new_inode_pseudo+0x131/0x240 [ 892.796742][ T4818] security_inode_alloc+0x32/0x1e0 [ 892.801855][ T4818] inode_init_always+0x3f4/0xa50 [ 892.808105][ T4818] new_inode_pseudo+0x7b/0x240 [ 892.812884][ T4818] alloc_anon_inode+0x1a/0x2f0 [ 892.817687][ T4818] dma_buf_export+0x54f/0x970 [ 892.822398][ T4818] drm_gem_dmabuf_export+0x42/0x170 [ 892.827623][ T4818] drm_gem_prime_handle_to_fd+0x6b6/0x7c0 [ 892.833379][ T4818] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 [ 892.839293][ T4818] drm_ioctl_kernel+0x2f3/0x430 [ 892.844144][ T4818] drm_ioctl+0x585/0x910 [ 892.848419][ T4818] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 [ 892.854337][ T4818] ? do_vfs_ioctl+0x6bc/0x16d0 [ 892.859120][ T4818] ? bpf_lsm_file_ioctl+0x5/0x10 [ 892.864064][ T4818] ? drm_ioctl_kernel+0x430/0x430 [ 892.870052][ T4818] __se_sys_ioctl+0xfb/0x170 [ 892.874647][ T4818] do_syscall_64+0x31/0x70 [ 892.879054][ T4818] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 892.884951][ T4818] RIP: 0033:0x45d5f9 [ 892.888845][ T4818] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 892.908456][ T4818] RSP: 002b:00007f8c8fac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 892.916884][ T4818] RAX: ffffffffffffffda RBX: 000000000000cbc0 RCX: 000000000045d5f9 [ 892.924872][ T4818] RDX: 0000000020000040 RSI: 00000000c00c642d RDI: 0000000000000003 [ 892.932859][ T4818] RBP: 00007f8c8fac4ca0 R08: 0000000000000000 R09: 0000000000000000 [ 892.940881][ T4818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 892.948867][ T4818] R13: 00007ffcf722307f R14: 00007f8c8fac59c0 R15: 000000000118cf4c [ 892.979720][ T4812] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 892.999706][ T4824] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. [ 893.026260][ T4831] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:12 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xc00000000000000) 20:17:12 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000008108000400", @ANYRES32], 0x38}}, 0x0) 20:17:12 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0x7], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x4888, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a00"/28, @ANYRES32=r2], 0x38}}, 0x0) 20:17:12 executing program 5 (fault-call:7 fault-nth:6): r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:12 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0x8], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 893.195421][ T4843] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:12 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000478808000400", @ANYRES32], 0x38}}, 0x0) 20:17:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000000000800", @ANYRES32=r2], 0x38}}, 0x0) 20:17:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x4c00, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:12 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0x9], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) [ 893.299690][ T4852] FAULT_INJECTION: forcing a failure. [ 893.299690][ T4852] name failslab, interval 1, probability 0, space 0, times 0 20:17:13 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0xf00000000000000) [ 893.393622][ T4852] CPU: 1 PID: 4852 Comm: syz-executor.5 Not tainted 5.9.0-rc6-syzkaller #0 [ 893.402255][ T4852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 893.412330][ T4852] Call Trace: [ 893.415638][ T4852] dump_stack+0x1d6/0x29e [ 893.419988][ T4852] should_fail+0x38a/0x4e0 [ 893.424430][ T4852] should_failslab+0x5/0x20 [ 893.429551][ T4852] slab_pre_alloc_hook+0x4c/0xe0 [ 893.434497][ T4852] ? __d_alloc+0x2a/0x710 [ 893.444231][ T4852] kmem_cache_alloc+0x4b/0x2d0 [ 893.449014][ T4852] ? ktime_get_coarse_real_ts64+0x3c/0xc0 [ 893.455468][ T4852] ? read_seqcount_t_begin+0x12a/0x200 [ 893.460941][ T4852] __d_alloc+0x2a/0x710 [ 893.465109][ T4852] ? ktime_get_coarse_real_ts64+0xa8/0xc0 [ 893.470843][ T4852] d_alloc_pseudo+0x19/0x70 [ 893.475364][ T4852] alloc_file_pseudo+0xc8/0x240 [ 893.480246][ T4852] dma_buf_export+0x5d7/0x970 [ 893.484966][ T4852] drm_gem_dmabuf_export+0x42/0x170 [ 893.490185][ T4852] drm_gem_prime_handle_to_fd+0x6b6/0x7c0 [ 893.495974][ T4852] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 [ 893.501884][ T4852] drm_ioctl_kernel+0x2f3/0x430 [ 893.506757][ T4852] drm_ioctl+0x585/0x910 [ 893.511023][ T4852] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 [ 893.516942][ T4852] ? do_vfs_ioctl+0x6bc/0x16d0 [ 893.521731][ T4852] ? bpf_lsm_file_ioctl+0x5/0x10 [ 893.526689][ T4852] ? drm_ioctl_kernel+0x430/0x430 [ 893.531720][ T4852] __se_sys_ioctl+0xfb/0x170 [ 893.536360][ T4852] do_syscall_64+0x31/0x70 [ 893.540788][ T4852] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 893.546721][ T4852] RIP: 0033:0x45d5f9 [ 893.550639][ T4852] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 893.570863][ T4852] RSP: 002b:00007f8c8fac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 893.579287][ T4852] RAX: ffffffffffffffda RBX: 000000000000cbc0 RCX: 000000000045d5f9 20:17:13 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000488808000400", @ANYRES32], 0x38}}, 0x0) [ 893.587276][ T4852] RDX: 0000000020000040 RSI: 00000000c00c642d RDI: 0000000000000003 [ 893.595270][ T4852] RBP: 00007f8c8fac4ca0 R08: 0000000000000000 R09: 0000000000000000 [ 893.603258][ T4852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 893.611249][ T4852] R13: 00007ffcf722307f R14: 00007f8c8fac59c0 R15: 000000000118cf4c 20:17:13 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0xa], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:13 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x1000000000000000) 20:17:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000000000800", @ANYRES32=r2], 0x38}}, 0x0) [ 893.657703][ T4878] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:13 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000208000400", @ANYRES32], 0x38}}, 0x0) 20:17:13 executing program 5 (fault-call:7 fault-nth:7): r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x7}) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x1b, 0x0, 0xffffffffffffffff}) r4 = dup(r3) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000040)={r5}) 20:17:13 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x5865, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) 20:17:13 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0xb], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a00000000000000000000000800", @ANYRES32=r2], 0x38}}, 0x0) 20:17:13 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000308000400", @ANYRES32], 0x38}}, 0x0) [ 893.896024][ T4899] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 20:17:13 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x259a48cb00000000) 20:17:13 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x6000, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x0) [ 893.963121][ T4903] FAULT_INJECTION: forcing a failure. [ 893.963121][ T4903] name failslab, interval 1, probability 0, space 0, times 0 [ 894.012095][ T4903] CPU: 0 PID: 4903 Comm: syz-executor.5 Not tainted 5.9.0-rc6-syzkaller #0 [ 894.020739][ T4903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 894.030808][ T4903] Call Trace: [ 894.034116][ T4903] dump_stack+0x1d6/0x29e [ 894.038471][ T4903] should_fail+0x38a/0x4e0 [ 894.042933][ T4903] should_failslab+0x5/0x20 [ 894.047578][ T4903] slab_pre_alloc_hook+0x4c/0xe0 [ 894.052530][ T4903] ? security_file_alloc+0x32/0x200 [ 894.057751][ T4903] kmem_cache_alloc+0x4b/0x2d0 [ 894.062529][ T4903] ? __alloc_file+0x26/0x390 [ 894.067139][ T4903] security_file_alloc+0x32/0x200 [ 894.072188][ T4903] __alloc_file+0xd7/0x390 [ 894.076625][ T4903] alloc_empty_file+0xa9/0x1b0 [ 894.081407][ T4903] alloc_file+0x5d/0x4f0 [ 894.085666][ T4903] alloc_file_pseudo+0x1b0/0x240 [ 894.090633][ T4903] dma_buf_export+0x5d7/0x970 [ 894.095332][ T4903] drm_gem_dmabuf_export+0x42/0x170 [ 894.100562][ T4903] drm_gem_prime_handle_to_fd+0x6b6/0x7c0 [ 894.106326][ T4903] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 [ 894.112256][ T4903] drm_ioctl_kernel+0x2f3/0x430 [ 894.117141][ T4903] drm_ioctl+0x585/0x910 [ 894.121417][ T4903] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 [ 894.127336][ T4903] ? do_vfs_ioctl+0x6bc/0x16d0 [ 894.132128][ T4903] ? bpf_lsm_file_ioctl+0x5/0x10 [ 894.137088][ T4903] ? drm_ioctl_kernel+0x430/0x430 [ 894.142131][ T4903] __se_sys_ioctl+0xfb/0x170 [ 894.146750][ T4903] do_syscall_64+0x31/0x70 [ 894.151232][ T4903] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 894.157200][ T4903] RIP: 0033:0x45d5f9 [ 894.161116][ T4903] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 894.180732][ T4903] RSP: 002b:00007f8c8fac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 894.189181][ T4903] RAX: ffffffffffffffda RBX: 000000000000cbc0 RCX: 000000000045d5f9 [ 894.197168][ T4903] RDX: 0000000020000040 RSI: 00000000c00c642d RDI: 0000000000000003 [ 894.205166][ T4903] RBP: 00007f8c8fac4ca0 R08: 0000000000000000 R09: 0000000000000000 20:17:13 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0xc], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:13 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0xd], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:13 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[0x23, 0x0, 0x0, 0x0, 0xe], [], @broadcast=0x1000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x5c}}, 0x0) 20:17:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001900)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000000000000000000000080004", @ANYRES32=r2], 0x38}}, 0x0) 20:17:13 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x24, 0x66, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x2}}}, 0x24}}, 0x4000000000000000) [ 894.213154][ T4903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 894.221143][ T4903] R13: 00007ffcf722307f R14: 00007f8c8fac59c0 R15: 000000000118cf4c [ 894.463224][ T4903] general protection fault, probably for non-canonical address 0xdffffc0000000017: 0000 [#1] PREEMPT SMP KASAN [ 894.475011][ T4903] KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf] [ 894.483455][ T4903] CPU: 0 PID: 4903 Comm: syz-executor.5 Not tainted 5.9.0-rc6-syzkaller #0 [ 894.492039][ T4903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 894.502197][ T4903] RIP: 0010:dma_buf_release+0x4b/0x310 [ 894.507680][ T4903] Code: 00 00 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 07 73 f9 fc 4c 8b 23 49 8d 9c 24 b8 00 00 00 48 89 d8 48 c1 e8 03 <42> 8a 04 28 84 c0 0f 85 4b 02 00 00 8b 1b 31 ff 89 de e8 be a7 b9 [ 894.528238][ T4903] RSP: 0018:ffffc90017647ab8 EFLAGS: 00010206 [ 894.534299][ T4903] RAX: 0000000000000017 RBX: 00000000000000b8 RCX: 0000000000040000 [ 894.542256][ T4903] RDX: ffffc90013070000 RSI: 000000000003fd97 RDI: 000000000003fd98 [ 894.550213][ T4903] RBP: dffffc0000000000 R08: ffffffff81c584a0 R09: ffffed101227610a [ 894.558165][ T4903] R10: ffffed101227610a R11: 0000000000000000 R12: 0000000000000000 [ 894.566144][ T4903] R13: dffffc0000000000 R14: 1ffff110115f7180 R15: ffff88808afb8c90 [ 894.574111][ T4903] FS: 00007f8c8fac5700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 894.583036][ T4903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 894.590582][ T4903] CR2: 0000000000745138 CR3: 0000000213e7c000 CR4: 00000000001506f0 [ 894.598560][ T4903] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 894.606532][ T4903] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 894.614484][ T4903] Call Trace: [ 894.617813][ T4903] ? dma_buf_fs_init_context+0x60/0x60 [ 894.623284][ T4903] __dentry_kill+0x41f/0x5b0 [ 894.627864][ T4903] dput+0x45e/0x710 [ 894.631652][ T4903] path_put+0x35/0x60 [ 894.635630][ T4903] alloc_file_pseudo+0x1d2/0x240 [ 894.640574][ T4903] dma_buf_export+0x5d7/0x970 [ 894.645237][ T4903] drm_gem_dmabuf_export+0x42/0x170 [ 894.650415][ T4903] drm_gem_prime_handle_to_fd+0x6b6/0x7c0 [ 894.656145][ T4903] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 [ 894.662024][ T4903] drm_ioctl_kernel+0x2f3/0x430 [ 894.666869][ T4903] drm_ioctl+0x585/0x910 [ 894.671098][ T4903] ? drm_gem_prime_handle_to_fd+0x7c0/0x7c0 [ 894.676984][ T4903] ? do_vfs_ioctl+0x6bc/0x16d0 [ 894.681736][ T4903] ? bpf_lsm_file_ioctl+0x5/0x10 [ 894.686670][ T4903] ? drm_ioctl_kernel+0x430/0x430 [ 894.691691][ T4903] __se_sys_ioctl+0xfb/0x170 [ 894.696277][ T4903] do_syscall_64+0x31/0x70 [ 894.700686][ T4903] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 894.706662][ T4903] RIP: 0033:0x45d5f9 [ 894.710552][ T4903] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 894.732071][ T4903] RSP: 002b:00007f8c8fac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 894.740588][ T4903] RAX: ffffffffffffffda RBX: 000000000000cbc0 RCX: 000000000045d5f9 [ 894.748561][ T4903] RDX: 0000000020000040 RSI: 00000000c00c642d RDI: 0000000000000003 [ 894.756556][ T4903] RBP: 00007f8c8fac4ca0 R08: 0000000000000000 R09: 0000000000000000 [ 894.764528][ T4903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 894.772493][ T4903] R13: 00007ffcf722307f R14: 00007f8c8fac59c0 R15: 000000000118cf4c [ 894.780449][ T4903] Modules linked in: [ 894.793231][ T4903] ---[ end trace 559f30ab34c891b4 ]--- [ 894.798989][ T4903] RIP: 0010:dma_buf_release+0x4b/0x310 [ 894.804456][ T4903] Code: 00 00 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 07 73 f9 fc 4c 8b 23 49 8d 9c 24 b8 00 00 00 48 89 d8 48 c1 e8 03 <42> 8a 04 28 84 c0 0f 85 4b 02 00 00 8b 1b 31 ff 89 de e8 be a7 b9 [ 894.824175][ T4903] RSP: 0018:ffffc90017647ab8 EFLAGS: 00010206 [ 894.830467][ T4903] RAX: 0000000000000017 RBX: 00000000000000b8 RCX: 0000000000040000 [ 894.838674][ T4903] RDX: ffffc90013070000 RSI: 000000000003fd97 RDI: 000000000003fd98 [ 894.846644][ T4903] RBP: dffffc0000000000 R08: ffffffff81c584a0 R09: ffffed101227610a [ 894.855057][ T4903] R10: ffffed101227610a R11: 0000000000000000 R12: 0000000000000000 [ 894.863148][ T4903] R13: dffffc0000000000 R14: 1ffff110115f7180 R15: ffff88808afb8c90 [ 894.871215][ T4903] FS: 00007f8c8fac5700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 894.880354][ T4903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 894.886931][ T4903] CR2: 0000000000745138 CR3: 0000000213e7c000 CR4: 00000000001506f0 [ 894.894963][ T4903] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 894.905062][ T4903] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 894.913146][ T4903] Kernel panic - not syncing: Fatal exception [ 894.920546][ T4903] Kernel Offset: disabled [ 894.924878][ T4903] Rebooting in 86400 seconds..