000000000000000000000010000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f736530000000000000000000000000000000000000000000000000000000000000e4ff0800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000b7d90c84c9a24a3e00000000000000000000000000000000000000fcffffffffffffff00000000000000000000000003000000070000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff7597980f83612bffc575630c476cbf7a18486b101e9b32c3cd99a43217b9ca666443e58a3ecb86b3099a615495ba1608b81800434abbaae997db8c12d5f552e922bc43a10ca0a8c55316e26d99c85dad8577422c88f309db14134912910086c17e800d6c04999fd07cf5588e96ee34a03087530a615476b2c8e6b37ea1ac15d51973b05c92"], 0x1) getpid() recvfrom(r0, &(0x7f0000000480)=""/110, 0xfffffe32, 0x734, 0x0, 0xffffffffffffff39) 16:26:54 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "79c7c13d898f0eee8384331f31b5226823b2561a666f0ddf"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b6ff6e063b9c9b8c7105a345e0f18fc5dcc8919c9b8a4663"}]]}, 0x60}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @device_a, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f00000000c0)={0x1c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) [ 1308.806425][ T2373] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:26:54 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x3a}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffe}, @call={0x85, 0x0, 0x0, 0x8}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x0, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x74) r0 = socket(0x10, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000), 0x10) pkey_alloc(0x0, 0x1) r1 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'virt_wifi0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x2, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0xa0111000, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x23151}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc, 0x1, 'macvtap\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0) 16:26:54 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x10}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:26:55 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000140)="360633d0360f01", 0x7) [ 1309.579464][ T2407] device macvtap1 entered promiscuous mode [ 1309.586075][ T2407] device virt_wifi0 entered promiscuous mode 16:26:55 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r3, 0x1) flock(r3, 0x1) flock(r3, 0x2) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x20, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0x4}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000040)={&(0x7f00000002c0)={0x1c0, r4, 0x20, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x8001, 0x33}}}}, [@NL80211_ATTR_IE={0x174, 0x2a, [@ssid={0x0, 0x6, @default_ibss_ssid}, @fast_bss_trans={0x37, 0x114, {0x8, 0x8, "57bb82bf18feeb687b1cc33560c5d68c", "0bbee4e068fe6711a22af43d73a50524bc65e78559890fc6678e5bd07b26be7b", "48ef032b6bd2e3fb3b3e58ac5379b0c8715fd91ae5d697415671b0acdf9a1731", [{0x1, 0x21, "867365d4c07fe21767c619222ce9a051b7bce0940ce5fc7b56dc8bde1ee69540e0"}, {0x3, 0xd, "eba0264233d696856b6fb20177"}, {0x3, 0xb, "33d3fae01796d98552fa8a"}, {0x1, 0x26, "3a35684ae27c3b2840456eb38acb723842df66bef1b0463f1bf56b507926c9055a300a278238"}, {0x4, 0x28, "ef3319409681c865027727804f14514caa6b74827bfbb32bff367fd2f38bace0587f980ebcf8b3f2"}, {0x4, 0xb, "887ec28f469bb0b846958e"}, {0x4, 0x4, "b2ea510b"}, {0x1, 0x1c, "964b2d31ed899a2a95613bd0ae57181534bfce3c716affd587187491"}]}}, @rann={0x7e, 0x15, {{0x1, 0x7}, 0x2, 0xa0, @device_a, 0x2, 0xd4d, 0xf8}}, @mic={0x8c, 0x10, {0xbbd, "2557e76f6b3b", @short="44d391b0f9112b93"}}, @ht={0x2d, 0x1a, {0x1b, 0x1, 0x3, 0x0, {0x800, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x1}, 0x1, 0x3ff, 0xff}}, @ibss={0x6, 0x2, 0x5}, @dsss={0x3, 0x1, 0x78}, @chsw_timing={0x68, 0x4, {0x7, 0x73}}]}, @NL80211_ATTR_SCHED_SCAN_MATCH={0x2c, 0x84, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x1c, 0x6, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x8, 0x1, 0x3}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x9}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x6}]}]}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x4}, 0x10) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:26:55 executing program 5: syslog(0x2, &(0x7f0000003140)=""/102400, 0x19000) [ 1309.766575][ T2407] device virt_wifi0 left promiscuous mode [ 1309.776617][ T2413] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1309.830381][ T2414] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:26:56 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000049008108040f80ecdb4cb92e0afacc2c230b5834fa4f00000000000000e3bd6effff0009000e00030a40", 0x2e}], 0x1}, 0x0) [ 1310.707154][ T2432] netlink: 18 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1310.716268][ T2408] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1310.740683][ T2412] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:26:56 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r3, 0x1) flock(r3, 0x1) flock(r3, 0x2) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000040)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x100000000}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x40004) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000340), &(0x7f0000000380)=0x4) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) rt_sigreturn() 16:26:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000380)="240000005200070400fffd946f6105311c0000040000000077000000421ba3a20400ff7e", 0x24}], 0x1}, 0x0) 16:26:57 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)={0x5c, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}}, 0x0) [ 1312.032502][ T1090] tipc: TX() has been purged, node left! [ 1312.047663][ T2446] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. 16:26:59 executing program 2: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\x03\x00\x00\x00\x00\x00\x00\x00\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r0, &(0x7f0000000040)='h', 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_MMAP_OFFSETS(r1, 0x11b, 0x1, 0x0, &(0x7f0000000000)=0xfffffe63) 16:26:59 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000600)=ANY=[@ANYBLOB="61125300000000006113500000000000bf200000000000001500000008ffffffad03010000000000950000000000000069164c0000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070500000419311f3d4301000000000095000000000000000500000000000000950000000000000032ed3c5be95e76b67754bb12dc8c27df8ecf264e0f84f9f17d3c30e3c72fe9755ba08508460b603daf5a7d1dbdd2d17f2f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a674f888a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fa9de56c9d8a814261bdb94a6538b89dc6c60bf70d742a81b72bab8395fa64810b5b1bfd3782519518c51231422bb8fab4d4d897db2c544c0ec50b8eac8c63d2b1cd06a39702bd547f5ebaa6954f01cef3c9bacec15e2e3b2bd352e93a22adfe8efe33ffa78b02af242f8ee5476d4ef7a6f0c4704403b9bad2b648e90fff24f69a5ef05f5408ea197ed09a9510ee6063229de2984abdd46ea3ec78e3127002ed37c2564b8f8a621483fb2a5ff221e0d831d64759d17b8c59d0f2b0727f6b7958fb5b939af4be5e55a95f8c6d785a91c7c3f0c17ae7f9ac5ff05f5ecddf0cef90d50e763be96496661c749e21ab63a1f50b30a65a9027ba357bf8c614497ee59b68bf6a5d45c81c567e347d545741fbbbea3e47b1750f272980087b7f8a13cce7014137f250370b8a70ae3eaf6f6f17759c3886871e97d063b7f26eed3226bb0b9ee6320a2b02fea7a06a0e37182adf"], &(0x7f0000000100)='GPL\x00'}, 0x48) 16:26:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="74470001", @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) 16:26:59 executing program 5: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x400040000000001, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x8) listen(r1, 0x0) connect(r0, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) accept4(r1, &(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x80, 0x0) [ 1315.466745][ T1090] device hsr_slave_0 left promiscuous mode [ 1315.485951][ T1090] device hsr_slave_1 left promiscuous mode [ 1315.498846][ T1090] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1315.506997][ T1090] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1315.530082][ T1090] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1315.538744][ T1090] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1315.573647][ T1090] device bridge_slave_1 left promiscuous mode [ 1315.580414][ T1090] bridge0: port 2(bridge_slave_1) entered disabled state [ 1315.606821][ T1090] device bridge_slave_0 left promiscuous mode [ 1315.613872][ T1090] bridge0: port 1(bridge_slave_0) entered disabled state [ 1315.675052][ T1090] device veth1_macvtap left promiscuous mode [ 1315.681164][ T1090] device veth0_macvtap left promiscuous mode [ 1315.687670][ T1090] device veth1_vlan left promiscuous mode [ 1315.693738][ T1090] device veth0_vlan left promiscuous mode [ 1317.920746][ T1090] team0 (unregistering): Port device team_slave_1 removed [ 1317.940756][ T1090] team0 (unregistering): Port device team_slave_0 removed [ 1317.958068][ T1090] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1317.976787][ T1090] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1318.057163][ T1090] bond0 (unregistering): Released all slaves [ 1318.126011][ T2485] IPVS: ftp: loaded support on port[0] = 21 [ 1318.348301][ T2485] chnl_net:caif_netlink_parms(): no params data found [ 1318.466877][ T2485] bridge0: port 1(bridge_slave_0) entered blocking state [ 1318.474463][ T2485] bridge0: port 1(bridge_slave_0) entered disabled state [ 1318.484569][ T2485] device bridge_slave_0 entered promiscuous mode [ 1318.493762][ T2485] bridge0: port 2(bridge_slave_1) entered blocking state [ 1318.501096][ T2485] bridge0: port 2(bridge_slave_1) entered disabled state [ 1318.513246][ T2485] device bridge_slave_1 entered promiscuous mode [ 1318.578484][ T2485] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1318.603384][ T2485] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1318.684465][ T2485] team0: Port device team_slave_0 added [ 1318.713232][ T2485] team0: Port device team_slave_1 added [ 1318.769414][ T2485] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1318.776921][ T2485] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1318.803729][ T2485] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1318.823489][T10207] Bluetooth: hci4: command 0x0409 tx timeout [ 1318.835704][ T2485] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1318.842914][ T2485] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1318.869889][ T2485] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1318.948989][ T2485] device hsr_slave_0 entered promiscuous mode [ 1318.957828][ T2485] device hsr_slave_1 entered promiscuous mode [ 1318.967532][ T2485] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1318.976451][ T2485] Cannot create hsr debugfs directory [ 1319.439237][ T2485] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1319.473574][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1319.483185][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1319.500167][ T2485] 8021q: adding VLAN 0 to HW filter on device team0 [ 1319.520590][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1319.532207][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1319.541128][ T9499] bridge0: port 1(bridge_slave_0) entered blocking state [ 1319.548640][ T9499] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1319.560526][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1319.579375][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1319.591151][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1319.601298][ T30] bridge0: port 2(bridge_slave_1) entered blocking state [ 1319.609210][ T30] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1319.639194][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1319.663136][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1319.684674][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1319.695762][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1319.708158][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1319.731224][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1319.743037][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1319.774243][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1319.783830][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1319.794720][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1319.804716][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1319.826138][ T2485] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1319.871507][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1319.880295][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1319.908826][ T2485] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1320.027855][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1320.039414][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1320.092895][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1320.103507][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1320.125990][ T2485] device veth0_vlan entered promiscuous mode [ 1320.136635][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1320.147207][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1320.180692][ T2485] device veth1_vlan entered promiscuous mode [ 1320.240053][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1320.250969][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1320.271482][ T2485] device veth0_macvtap entered promiscuous mode [ 1320.293067][ T2485] device veth1_macvtap entered promiscuous mode [ 1320.333185][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1320.345777][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.355961][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1320.366601][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.376703][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1320.387737][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.398001][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1320.408818][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.418984][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1320.429639][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.443335][ T2485] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1320.452205][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1320.461886][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1320.470831][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1320.481174][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1320.507480][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1320.518538][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.528717][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1320.539435][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.549548][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1320.560334][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.570464][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1320.581122][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.591221][ T2485] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1320.601936][ T2485] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1320.615621][ T2485] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1320.623841][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1320.634163][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1320.918764][ T3114] Bluetooth: hci4: command 0x041b tx timeout [ 1320.999379][T26154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1321.007575][T26154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1321.015660][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1321.127519][ T8824] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1321.136649][ T8824] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1321.152661][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1321.319147][ T2716] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1321.338298][ T2716] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1321.659965][ T2716] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:07 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x11}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:07 executing program 3: r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000080)='.\x00', 0xfe) open(&(0x7f0000000000)='./bus\x00', 0x103042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) 16:27:07 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000480)=ANY=[], 0x2) 16:27:07 executing program 2: setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000340)=ANY=[@ANYBLOB="d06563757269767900000600000001000000000000952a83741000000000ddff03000000200000001ae81a55305b6c27000000b8b504a44c05f16d8bc372adc37ee265b4ac28acfe987ea5a5ba010400002a668f26b135b6387a74171c7f0cb76d7ef1b9079de4962a589344222928ecb513741956234b1d4c9fe54651c724ceed"], 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xe, 0x4, 0x4, 0x3}, 0x40) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000000c0)={'veth1\x00', &(0x7f0000000040)=ANY=[]}) bpf$BPF_GET_MAP_INFO(0x4, &(0x7f00000000c0)={r0, 0x28, &(0x7f00000003c0)}, 0x30) 16:27:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000380)='ethtool\x00') sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)={0x14, r3, 0x1}, 0x14}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) flistxattr(r4, &(0x7f00000003c0)=""/186, 0xba) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r4, 0x8982, &(0x7f0000000300)={0x1, 'wg1\x00', {}, 0x9}) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) getsockname$packet(r6, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001480)=ANY=[@ANYBLOB="3800000010001507100000000004000000000000", @ANYRES32=r7, @ANYBLOB="00000016010000001800120008000100736974000c00020008000300dea823a2ec9e7a2d1ab581b2998797446811e1b3b91f742857ffc5cc588cb24c8885ba47c06714a960b2f3543efa74b1c10b3d7cc99b80736320b85db142ffdbafe58b231d3277644a4c12dac3f74c0edd52d30239446b89a297fc6fe07c99000000000002d658d4773601597593ab549b37f42c0000000000e20c77230dc9249c473dd53674cb23f3a0944a6762c73d16d4afca871e6df93fdc55ad3edcabe6c84ba747d2349f0f6e7642ff8ac31dac97048e3ea7256987c6e7f9c7c4dbf2982f03cd0d9eddc651af948371f1895017ef33eba6790d574b4de174222892211fd13879934cdb2004f03e3b70c8510124cda8f9514174557236a9f5720e58f9933591b62b6dc2b21945a6576a0000f450bf5ac1529b54f2478ea6ff070000e6a81f2f5efad18178fa6e26d514c2fdccb5f051b8d41d9040300d929ff0f79faa6dbb2c008fe19bd0f92e2ada902e12f9b15410f893ed43eb7bc6a8c19fdbd9402fae701cbd77c5b1fc1690390a1fa2ba33e5157ec7057046d69955a27462de7b5481427056caad9755fc68532bc3a2d2b16b0500000037b88b09a34c83889964ba55cd03fc09be77dcd069ac1fb10f6e716e12ad437b87a509344b019593374fa8ed0a2b8496501bb605c522c86b8bbc9d7e4000e95a345afe47bd4f8fdf468e39dc08008b8c69e3f4c0755bd722a28569fe5786634bd0054ac3b8cd8475e7ff775b8d384abd3b7aa71ca96dac7031d3cc815b9269b8db59dd431a8bd9ab00551c0e7a4b1399cbaad479407080446193512cd320712d7b5af1000200000000000022a2cbc83955bd866b1c6c32051a9764ee88352ac145bda1b606c1b1d1f00fa5cb1f155cb252b3db9f43604f851f4423a0fd56993017ecdc7429399ff5194f92877cc33970be7080c88c943f9cf4f3055dbfc18f70f08173d7f7e8a456fbe6ca524a6d539a4fd888b81a8ffacdb3f8977b3a54ce03efa1a0bc1980ddb0a0d4f3c03e5a5f41f06dabc0a77812621076e283b6a28b3c9fdf9e8bc1eaf3c27bf39049555aba62990ac6cdf28a8ca8b0cc247e1349eff50e43a8363ae1195d9993f4e4bcdea8f8edba28ac8088ed6bbaefcfefa4d45d4758a6490c7312ab3317f9ac3597e450627ddafbc296ce0f406ab7ae70523423e0673878f609ffae59d0439f49dfb13bfa3db35d57031de1dd7fe48411fc60db1064da590df87a343de8e3fc44f2ddf119e89caf7111ffaa57c918d7fd92d3176ae4bc2211d8b9d947bad788e85de95bfdfc33a8c6e34fb1c1d3254df838692065ce798210405440c6af5f377b38214b6ce49132bfba3f7611be6e08feeba24e2ca50d0881d54a25265eb2f54e17eda6deef3baee85e22", @ANYRESOCT], 0x38}, 0x1, 0x0, 0x0, 0x4800}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x50, 0x10, 0x439, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r8, 0x3}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x24, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r7}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}, @IFLA_IPTUN_6RD_RELAY_PREFIXLEN={0x6, 0xe, 0x7}, @IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0x8001}]}}}]}, 0x50}}, 0x0) 16:27:07 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, &(0x7f0000003840)={&(0x7f0000000280)=[0x62, 0x8, 0x1, 0x129, 0xb71], 0x5, 0xae3, 0x1, 0xfffffff7, 0x1000, 0x6, 0x4, {0x2, 0x0, 0xca22, 0x8, 0x0, 0x7f, 0x7ff, 0x9, 0x3ff, 0x40, 0xef, 0x4, 0x7, 0x1f, "5772fe389bfe33c6e847130aee92c12559cbeb02880cc272ebbe16f30683370f"}}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="1343a421e6030e9744e0e7740000000000000000", @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000040)={&(0x7f00000003c0)={0x345c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xdada}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_FRAME={0x1da, 0x33, @data_frame={@qos_no_ht={{@type11={{0x0, 0x2, 0xd, 0x1, 0x1, 0x1}, {0x9}, @device_b, @device_a, @broadcast, {0x9, 0x3f}}, {0xc, 0x1, 0x0, 0x0, 0x3}}, {@type10={{0x0, 0x2, 0xe, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x6}, @random="5c05eccb98ba", @device_a, @initial, {0x3, 0x35}}, {0x0, 0x0, 0x0, 0x1, 0x6}}}, @a_msdu=[{@device_b, @device_b, 0xb0, "9f6e7ffd21d34da2574a297ce62e03436d75b696005ac4660cda38f8a19f1e7fa29f64879607c3edb4765c4e6510d8adceb4ca1f4a7ec9f4266f041d43364120c0fab8aac029f9521af89f331d88f13e9752fadbd55550bb0168b1c4fd60c106ba162e8c8a8d6a994edb02635f255866055d13c190ef321ac79133906b32a68e921fd24f565c52afddca00e0b8d34116d11102f826713750513e28d726fe4c982e5ad6b6a75a64472a6edaa729d3839f"}, {@broadcast, @broadcast, 0xe, "ae1b7270eb2d698f2c9f4544f5fe"}, {@broadcast, @device_b, 0x22, "c8047ec81f997903ecdde2ba95b16a8016935bdbfc2dc137b7d4e017a1e4bb89b284"}, {@device_b, @device_b, 0x7f, "6bb7dc87fe320eb2300007fdb2a0d3669dedfd1831950acf88968169a31f43335436ab003884c1909aa11e729de7bad4afffac8738eeb1a90aa36639752ec7ac0f6bc7522b4f3b3e7a59b0a527cbe3eba541aa0c2199874ae4927eef5610d31850d8677215ce914cba52ff0be3d73e6ef557d5324d33e3ed959ce989928e82"}]}}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_FRAME={0x3239, 0x33, @mgmt_frame=@action={@with_ht={{{}, {0x6}, @broadcast, @device_b, @random="3f1cf02d4498", {0x8, 0x80}}, @ver_80211n={0x0, 0x2, 0x3, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1}}, @measure_req={0x0, 0x0, {0x79, [{0x26, 0x1003, {0x0, 0xff, 0xd9, "91e5b3128b28f2b4a061f5644b0f954a12ad3ac9181ed8630bacdc686dc989050d9f4e59d4447c06b5b67bdf4e280ccea3d3866d6994bf89bee41ba98c4c16f267e8a1d86f4442e9b5d97399a4b5b0c3eaec6af17f7ffefabea34380974094b09a1084b7be586494e91b33a3047b7bf112db82dc6a0d6b33a8f749f96fd5e12b32ac01d8611f52f7e7a4cfe699d3b03283c83d0eec97fa6c9a2862cca25445e15be9d0b48554e1ad85c721f3ff72a91dbbd4006b25a4b2909e7df85ef40d1322d0eab2f9321eb9cf26b9ad2d851364b606485d21201970ca795cc8eae5185c245895424326e19b81631f807fb542303ff02039ab028eb8dfd56dc0b1c94b9c8ccba44d0d804ed1320f830cfedc218fa42f1485014aaa461bc34e7d67d4373dffd93f4d800e0d1defb4ba73ff3172475224a7195146b227379b6721fbf5e184e7cad094bd243e75d62aa39fa45b11972962e75458b4f64274f7680973a0a1685097508958ef98b193048e2cd90101e3b3f4cd65bb63bf90e9557ab6d5c2761863abe68b8289f24659e45201ed60a94a0ff3debb6da0b44ba232261e28973ffa7b156e6d7eb9f8b894f3e50cf44a92ab55b57339a81bf86aaf3fd28273f30b55815c2ac9584058f1e5748b1394487e9fa1a506ac6dc593ff99b058db258f53855346457f2afc4235cf381e8f1812833d04d34c20dd7b133d6a4f3c2652f6b5761301c4f3e382bed7e61c32f91c00eebbc4380bc03d3ac4e72046ed2d1dff34027f9b4ad78ab0843470c9e7a363348d5d2cb28a465bcd3814eac056a4b64fb88e2676fe98a512ff155da7fbf244c05baedc9caaf50dd8aff3949cfe12e68dd66c280e15f9df81a6abe2d6eccc558335ec7afed11aa277c8fcbc40e0f699a28b06f05342273affdfc546a0d05904fdce45bc373254f517497b053dfffb8e3a769bb1f794b62bb1e29d007ba6bfc3de4702e4688060edfeb7f377373666a434df434665392bf800808c53cb727686ef6ffd675ddf063466ac8b9addbe85826929a9d14ea7df0e8d188be73e7f3f74f93f85091c83536cc1f7aecff89beb326d576599eea400a6315cc1c331712f26c59fd332e702301987344e75641491ee2914108caeeb04f25cf3940dd9f41bb33063eb08c7f86cf7a3204faecd92d2887c91b2b6c1f4cd6c3d69b9780a40d559f87ff87f47afa99b33cadfebcb68adbc905ce77a81eab7765caae10217a8fcee081c7b9b3d9317438ac8c26f315354a18dc035c6ba4b5228af94b7b077b4e0270beade2a986c946dec271761aec1cc4fe582b6108cccef79338c1fa6a9dda4579fd19ffd984bed6b21f3579468841a606546989935f1d85085af4bf705631067a517923714cbf48eb7916ae1cd824739fd08d3a94ee8619026ad056fecdeabe52cb3399db00a1480c2d8babe0d5ca8d6b4f3bb9b7889010c65798ba2b5049036c418ac1b0d274c1c9e9b0c0096b4e523311a21305cb05b7071791ac20177a8d96cc8b6b6935b59ca865b8d4466b519ab06b6b7314e4723693ad9f088cc5daae50cb9968602e2d248807ad309b43093cc0f6f92fa433b932c590bb1fb1dc484adaa4c2020854228f13a44cb28f045c6fc230a9c16e6141ec7c8bf398c57d4b6892feaece85000a72061c47e78071b6a2fe09a1154293111a66d0284be5da1068caa945e53ba82dac8282620bca4bbc4312d0bfaae13912b6f12cdd62e8035da9d9651c1976b50934f18826c8bd8fcfdb3f3ab08e67a3b05f46e7dd70ab22786450842c40adba3dd78d9a1b2436fe76ce65cc76531326735c6635fd93564cd20871eb6d8231cd87700c458f0c3d91ba9c515075f125538204d9d2befd8730d3ad5922e827e0f63e5c11dfd13f78186fa1202169a055d7369e6e21142cbc4a52a12eb8cbfd3b4a2b3e460e8a9e824b890173c7153842a038904a5413e057ae457586be2a179fc73541a61a8811510aeb2adc2bbd8ce0b8a3585e5ce51a51c0bf8f65f0e13640f520cc2e8176d071e2a5c321ae1a0aedd1e6ce4891a3d88b8dd7563aed8195904d3cc45714ded4f270a5d96e8910ee03e71f836720a283864a1aacc4ea9a737422ad5b638d43d0781d5d6675ecb177be2be7843e3d032e33fb824089dd2d6a1520fa9f11b85de86cc7e766cc8be5251d7ca1c1104f9475c21133e0bb8fcc5fe7d1fd257babbf342ba7f2d85ceb6500e15f428fdb00f4ff626e9834edda83f73dd49c6d7de080cbd5abb4638dd65d7d16770f30b6e226dffd62d6c26c53cb34a0f72f32bbe9dcf50286d7cde06a628375db6ae185eec8b5eedb4ee5530e98c60ac771f289fb241d4b95f0788738d12fd2a57e4c6937b6a828cb8871f7678716c296454bbe07313b75a36b7ffad164061ab32bc469bd89f3a65c80f69ecb067a291af67ec5f5d23f1b94ca984d241d25d9497ff255023490a14abb808e208b194226663327a3e32187e2a9dcdd7ebbf8e4b60f19d75716194db385e05514bb3687c8aded908624939ffaae704a3af27ffd364b617f3a0443c27d20a200127120cd3b192443725b5ec18e6456c17b2aad990a88fe42591e97477941dc3d78f4dbc5ea944417f1d9a27f2239c77f9e68ebaafe33e3454b613bee4e1004e7ba270b27445e9ccad2166dce74313c9ee2b6de5b14539578b98d2341d49f59b95dfca4410d4b773704fb0647a967a035c8ffce198ccc4bd538f8bb4e1f4349ab7f60c22600f1901c4a773ec0987ca8a35107dcfdf934b37cc233fd85d8549a28b6deaf5035f161d2f44c1c3f2f5e04cda403492a51ab30d2e9d639ed610a4156773bacfd1e9b260cdd13859b8c7597ac3bbd7bd1e58eb4801cce34f247721fddcea4fcee15822dab5e3797fbe386b78e7f2fa9087e96f68f445eb0116750d96ddbd082cd39fa92864e0f06b468569f2b21007507ecbe8054f605e198dc3b29315bfe9ec03665ec7b962986b494efc7b8fef0b307ad7ec2812b200dae0162c3a49cf88e1ca59d45ab9333ddf3c5a4ec90dcdf3477d9056edc6f57e87f0264fccc5b42aea05849cf3127fda8db34bcec351e5eddf3939d26782c045d64dfde457ab9c03d92b5ea3a3c55f4ce570282d12008fc77393541b872431a7491976ad90c6e95b8d41d3bf0ad49b736746da635049b4a447abb2787509baa2ae78e04b113567a0e009c54353bf70721dfede9917a27a70e527b5b045dc3854c51140e6cff3352701217213ccbc15843e86dc76ce131c4bfb019d9ebdb2551ddf48cea158284f958b40eed5cec51736a44dbffadfd7b01b9dc4d3c5fa4badeb0416fe8d4bfb64a42ab7e1fe63438179dc442b908a7ed54e354cf504d4391af774a4a8544dc6425787bb59b0f58a5bec0084c71bd0ea71cf5b468070c8fbfe6f64b2477b4ff020dac7f910d58e137be2966d3593677e6f8dba929569c284fbf35222d00ea6529fa24b897d7b52841de738faea74de3e3a57b2bc6a93f85ad81e30c77077a8b570423cb87c21c9a88a0e8e8c2c3f9cbc33cf0dd27a2a4aa2a6cf91b13b75f92f13f8b51c6325e8c4b91e1c45f2e4a7a0314938adce8396e24a2554113378510eae9cd1f540b774ed4f255e4cdccb1ce0700406946ca9e0f0fbede2c3cf7e023bfe114e5a18bace02731910d4281a7c985de13ba6f3fb046c28b60db5f2d46152927fec86763493cc8306a4cc6f785106d321c382a32a003027d19e5366286c74cea42f8d6fcfb9b8b399b6ac10203c40c0d3de702ac1a53a755d0276915ef88df29da3faf0a9d4a9eb69b5ea1b3a2d60f7705892e21524ef71956f5920c9a926685c9121f15c22241d663da11e4b9d955dd01d2276a58d0485f7c84e2624beaec61c210b91c54d2b97b85b8b15398576a9b8bfcd0f69e7be2612ffb5dcf80450e61dd4926f6e3cc97c3482dc80fec7de1cf331eeeecaa7a90a906c1a2a4a9044a40b7597517249f62e30957d3f4678e1d5222f2511c7dca694993ed4f96c91063bfe45da54777d7c646334bc271fc7b6e045bd01d38dc488a42291f11f3950e3393eea01e947bb74df45b4eb4f0a77dcc278a7a137bc10cc204818e4b23f6b862ed443359670e615b465577ac9343c88c0c9a5cd2c2d820fd592e2844e68498bd54c13cd46f886bd711aabc2707036a8a8906176c0eaf48294f07fb4776735910422283a914559a6684dda9beaab487e749ea98625c6963c1b910ae5f56c12e0ece58b76d36b30e9f0867c9069f60e2f7e2162a27c59c04b9bfc6ba206652aa55170b1d0a29d7d63a1bd803449437774dda1b069fb31f337bdcf5653eb26506781687caf6a404fc491428a568f0889cb9c56c8df2b49cc22155ff806f4e7fbe82312dbab47da7066b523266b139629c5d549d0c0049e19244bf5146f32204fdbae96612026bc527ea7c16784d6c7da812d72ebb984802a069a3357e763a0182678946de759aba960f17e95f4b0cf1fdc8a3569b0df7660e103972926f9cb703a9a0f24bd88fa2ff628e6670b9eca01a76c10f207c94a65af737ecf9d97d1c3c8289417d8aa53b6788838bcef2cc86d09b3c7a5cb649175807707a040c3561f1622a42c1856df7e49d6d13e1a0631acd3b3cb55b53878a5a547f3fc0dee628401cd211c524b5002abb451e686dd33c52116a90393e5c78deef81016a1fef269e0d06ec2a2c61d55109efb70759e88bbae379e8bf255f845d5bc5991b17b4db74fe7be6259a4787563da70ea0d407a5ea5a1e3dfeb152f999779b4d8026418e60fe3aadb3f2e40689659ced2946df9ff6ccee08550ebcd655d0e13dc91cf660c7e8da2093d2bcd7658362fb1962ddc81ee49a8ba7eaf35513dfa30538f6142d55bdad00fbd275df2c44437535146c182517f5710f74a4c83d418bad88744eeae3be55711dc4e84bf44f527691fa80fad8540cf364e94bb20d7c1a01d6e2e984f9cddf6fd3b3b4aa72ae5ce826a75ffdfe0e0c8725845d9ee54dbb8568c8350bc821fc7999caebf3516c0f2b66c7e240b2c922e97dc3d40d2969b34055eee12c5ca443ee494d93e6df63bd3ab014c4671de7e79f5e8685d5a71a2a9e165e1b168a894c2155e5e85e1365b38e9fba78a7d35714960deb364c411604613f0736a1faf1552b3818892923a54fae92145dc8cc4b19414d67122782665af22bdbabe6081d44b90ef913a92f6a0996a6b9a5831a8d555813586f7ef8bb82e35a57e29c4a50024540159209c0660219b67258a07aaa4ab91135c40823eba58a68572959c30e7e17836b39dcb2a957f3fae4e1f70dbadd110965c788b59784c0fccc0c035261aaeb790f93e1c11565695cd3e4d74dad147a7ddb29c2baac10ff47c36e6397aef0485fa5374cf163a42c3f45685f7299312ce62e7136ea9948f904e3e41ed33c1a9064230f3b85bcf572431275c1c7891e90948254fbfe4fddc136f576c5d9383aa914cc7e7a63042e0c4e8978e841c73e9784dd7032b29295746d75e2c8c4b568d9cac2fb610796246cdf024388c365919e6994916818b4b6b9be714afbc5c327436dbf3c7331721d525c045756c981f5f3ee5e7d60f4e50314ae5b951a8186637af26adfc5bcafca23c7520dcce6688df0f6a30f2b716bb3923ff7f0b9aeb547febc053c5d6db0d8ced147f72026b116d31630419fada3d72110f145b9efe7db70e3c64d3d1c28929e33da842af7fcfd42d66c54b7c1641aae5f60f13a84fabe005ce3ba46070e215613b3db837b9d100fcd047d648e8d113c908e305c0dd81a5ee1de7a75863d1fdae385debc72d03f8f7"}}, {0x26, 0x27, {0x8, 0x0, 0x40, "4592cd79a4b28047886e374c3d5cf603d725b63b82e9986c48385410a3e30c86270c0d1a"}}, {0x26, 0x1003, {0x1, 0x0, 0x8, "67a4bb03e902d0743dadbfd7b60cbd5ef76ce82e858e3bd6285c9f384e38d5c0033a0671ae1d005b34be9c6bc90d6b86392df26f37861962c716628b720dbc100f93afe0408be4b83c6198fdc32d0c10a45b69db0bcf4b7f68565ce2ccec3c8b2f49a7d2dff3d6b7a15cc29e960f9a73a7ddab6746047353ffec9534535f89f0bfcf61676de7afa323d686876152dd37dd110b8017be4dfa3cf3620fbde31bc8899bd3d1dae91f9a4936b06d1200de6810c1182854e06daf923b4b957201d0b0e0ca6ef99312e2dcba88f1da1a6222d091ba04a03f50c941166cd7e1be773bb4a7fc7e6ea8b13c42e1f0564cf5cd76c5ac8dc3cd307da3b5b16f6d3b7ab6af7bac2f0206e99c1ac880309bcda55d1c03d199cb171f6294b97e85d30f969b0a997166c4548b1912e568752486df7e7bb585ebd294f6cb91ead382969f97f237c2cc118c1ffb82dda7fe7445189beb6f02dd00b8e86c76e4fe9fd5aaae7e4e7878ab8b6f19986802c0b5434a2315e30e11b0f08f1d3f781336f5874499aee45fccbe8d96fc105e6bab02259a92901e5b2c2d35ef3e35d3708eb38e07793f770d165bdd90161b0213cde5fc4727e699f0a7b69d1a46d346fb8cccad3bc967ed3e51791fd674c6525e24bece9f1e67348afa931e73b0a813e1b609214d3d5631a4ccb687c918498efca946e5a87b422e5a5115e33a36a661833c3fb2382d95dd9e898fb571c88e0eff48a4ce571593de87ac2ae58deece179f12c01c2eec981f5908ca2463420f19d123dec418a1893b4e8ae1fad5fca1c87508e93f9adac161671422cd2426a499ae9e71fb8ea3ba830e1787910ef5781afbcc12d76148654799d7a79903a1eb3ceb22ab5fad61bb3bad6fe593baf4a7d33f2b1c557c985ceaa4114cb7613e3b40d348f591f30da6196b99f9b1fccd832ac132c265b00ca04c2f6bc0dd152fc91a8cacf04c8bcaa64b88b172c5b89ce666817b2342de1313222520f05e6ffa3aaafd9ce98e4bd1d90261e62e25871c7839a65d105402f37ef12549c9f585e19857b6058c90a8af8f336982ddc108e0d69689389da9f5665f5df7e3ece9b41520c5fccd73ef1f4a2e7445af4aa7ddc6a9fbbd9184ef64ca16648f687799de2100b0f45a9ab1f6494fbaefeac2cfc5a393d85ae890b5a6d618c4f0f5875f697daedd0b56f8408b8fa7372714a2e59b54a4484f600edf36095a69feba468998f79292e27cfdada507a5814a6a7073b022047ff66aa87f6e44fcc5d51ed6a9e8450dbab9a7a041db5b17d7a029fc1e4b5809cd2ba7ca8c318a00dddc37aa85d0f84f61d1bfa7087d4cf70f4e0d6b78c681a6ae182c829afb0a181fc3333de1de5105e92737bf6e66f4f72133d6107f7baf724ee0f2242d28f9b639ce1f74c522987ae3e5a883aae69212d91e537eb933bbb408e66a939309e7279d4ac45f6dd823e3e9646f34e4d0dc005005ad800630885b1b52c87aafb987376dc5becf211ca31808207b5f230eccfea05e2286eb498734e267fd7be8ef4c7af486a5718ce70e328f82a1ce3931e805721506d9c19610df311a4a08306d206d45c1b6c913ae2962a390f42f65f4cae7e116299fd377670f32a5a2992b993d26ff8a158fd4b5bf3cd5a3d42ec020f7804a4fb719aba6890e83c2a2e73b1b9dbd7eecc2f62145f0f1b86b9ca2592feb0d0ef563c9b87b48134b2de3970850e39390e7f6a66f1ab1be91d1c48b2ffcb646c58fa8c7f7d686244414448c3c07c2df9b33808d72beb7ef4596d684173acf1221d2c8d17093a5c23c16a70e34b786df4145de3094e8fdd541b5d7b71f5eb033af4ebc89180abe89656588b113f8e4ff2570f50bf0016a3259b83b57c68093899853f3e3563d94ddbf6631cf62178cbd24ea28180bcce2dfebe7f48d24987e80e3766466796dbea5bbc71f4ac49f9046fc5502f08dd6b7d5dbff8e3a287b9c94b2f50c5ea7da5825203415e3942f0a2e77498dc27ef47817038c3f548f75e8f816e94de45477489896be348ad49739bc7140d6168329546719dabbe373cbc3d5e4928ea89175e93941197a7bd86289550cc83bec62b00ddbf5c82a913c0ff565defb576957911e31b4fb7944fa73f87b1ce46552b03de440ddecb58568971e9980c4309ed9cac7841aed6162b6a13bacee597d4da269e20793fbbeaf8b80af962d4fb157f7158eacee6e3772b22a77d0f6e38c9e686910a8b19c25f61708ef0633fc8075879f74b8134cdd687fbf36cd57b8c7b805efb878c367e9dcb6f52966db7768e14cc781eac6557b88970bbf1bcaa8d5d23e9c50a80a2bfc031ba09fe14ba9d609201532d328a3793df4b0b3095a70c42d7a4bf360459b9438f1602eab8d99d0790c05285a7f01082843dcefdd7fbb5bdacc63a9d81a388d6dbcbd9cacd2771998ad9308868264e2ec51933809969a5ca257bad88dca3549df6fa34a6b6b35680f64cac040809861562b7a36f5f0f38a2c1f16cdf4d489293965f2f443cbd3fe11f8394b670280d3f0a105559c8642ba51e3cabc7ff0b78fbb92a1af49a1522336c9eb7c2e347793c6006f143f7d24f52072a8d41f7db2f9666e69703c5f9faa8375ee8d54bcf52961fdd9e88a39b38af2333f8eb94fe9d0f4a34fd258a01f8a384cabb1f48f6b751e933cd46babbaa8fcca499cc29f9d0c9ae6483e6e6a8732eddcfd26b50d92dc10fc00a0c55141b5c60a8b488b8b63fb3fbe87394c5c4d541b6a0e29b2c6766bf6507e1e5395b5b2dc45eee51441738f2cc0c25cd353e322d5478b08659f3983510c4d049902d567a76e6469e485119e0b67ed28eafea2f8037cafdff8c2df19dd0f7ad1c1b5f9f7e604dce2c4ccc0edf1cb14734cdf3dd8dfa368af64b20914fed19faf6584a2e9813a4da16542bd6346bb64da3a2f14eb4cc7cd04fd996b32681d1cf7bb12dd3e85e7d6c772f65e09d0d6f6d4f23bd58e4cb290d9891bf6f7f4da67e58c21c5f25ac05a2f6b41717a92f91b73684e6a5164bcfbc3a9a6b14c8696defbc0b11d6d2da22eb345f04d1a019f42d302ba5d12a01258f68b30d70fbfc45d183551f6269a57eca5d8523389f419eb06d3c1d1b73c657e435bd868cc7bfff554910424065a0a2287ec1ab05321eb7ae4facbfe97fea3c6d8ab69bcfb27377fde277b28b66172983313909c3d9ef2ac2e4f43d8de88bda1379188ff4e92bb1bf6825bc2d0734e6f10259456180b3e3e255f5b867203eb2d3661c5d4e831cdbbf1f3073a18a5424d40c99d3f77d0bc6e4b81dd9d3a961443d323c925a9b5daf36e71d58bb642079f5ace33e24ba20b688762f17aeda34fa716470b58b5344a0debc4e6c601ad638084ae1245305ce6cfaab05f20d6eb940cc231eb15621c984fb8f9ab09bb352f797bb461366cde2845289d13d45436181f5de7bd83141a71b3825126b07e8448e778743d2a3d7d28359a78d5fc7a9c89e44162cd7c9586ce017640864bc3ea7bf4389345a85d70cad14df4b18f5d5206bb17175790cee65ebfe590b574fb6148408978487657e26f76ee49afad16925f994e41a56dad3a9f92717f90f89fe913052cc3f5833f0d1af56753d0b0dd3a827822d69c004d68895c91bb150d62b7f1d14178d45501a9f32a8e44d62a1060304bb2e0032091841dc0074e564445a9fb7e275935683011a203de6c13ce8f33f2e7981cad4dbf5a1ddd2a3d5ce860f27f316ce308f8498048be59ca02bfa5a51512e537b8274301fb95342e5349a11138367104ef4f5c1d807289e80e9656820233771420949e89fb1f013a7b515a3b0ddf925446c654eb1045a6bd27b4fd31142270946b341f18e40dc1bc3dc7573bf6b84f83d4470f8fa24269c5aad8b080e63f9edf44922ff34fc592ff121fbc0081b901076472916e2932c1a0edc7140dba3ecbb94f57361b3f87ac4040d6486e7f0471a1742e61c625a5663250473505675761042cc2fe3e026e876c78d70ae85d09643c86ef2139e26e565cb9ad0c067dca7cab34d07c3929d252096d8d8b82f8635e427c41bf83304c0f4a2635cd024a320faf5883fbec2c9986392fe441dea3020c2d73c659fe98433c85c3ceec4c1fb69331b8f129173b39b161041a64e8f256dc83772ff7ff6f471711cc8ee0b6550c5a3b2999043711eee35f73c5d95d225c01aaf66b37a9f28382f2b468f4aae324279dacfbfa9ff8fc0a8d84296261b199d083d99b9105e78fbe21dc14b3ec48b8ea3b983663a7df5b3c14ce660ddff961f4ff15b07058387763a5d36656d51fdfa1be8b798d0322ab83e8516c4b5cf533b309e48dd55e50da00813dbb72d152c1673e1d0ab530c79be6ed7e1432b1faa0eaa7ad8932c8104f6339fbd52911a37520bccc55d680f8c8fe0bd0b40e54470743c4228bb2ebaf171c02b7841fea1c47a503af297b5e16a1cba043c51ee10877f50433979016e293ec57e90d1ec356c5d9a92dc12ee35a29fe52932686dd1d612e6787b99a1d42ca7e888b157a9434a436e0a308b315c077956e561138db347c668fa45aaba63aef5bf72d03f8cc44bb79aff8b5c554871cc0deda145a74dc4f082f96f67c435d51c60c4c29ce787497d189aa1d9d8d9b1cbe126a7e26ec22babdda8af553e41968434aab25e9101270751493b43a6b783ab1def72ea264b5b133e784df659e48c969aa9c4e9d607e65c71e3e03a6ba6c12963d4995f6688aa2443b862d995773306191c52e9518f1987f2e39dd7c818ea34f7558b8d6abcba57c852e5ec3ffb2ba68ecd3e4c2c99312c0931c58a7f1735c585cd8fff29fef8de8193211f0a1047cd41ce879cb85386a7c21c732d693846900652ef4f57ccdbb015f984ffa1151b186b7ff9f2d04a8990c633803f3c3f095d4eb15179873f892e7b321638ce461d0c2bca32414830d442cbe12a046d73fc1288adb6ee29cce51e8ed7551b35e97c3a284acc6617a2b6f81c021c00eb87d0eb3cb26b012c0ce501a48b9a21c0dd4b32d8aa04b357bf97cf6e6748e2c64d3fdc7b71084820b6c141b6b7fca5e2ceefa2c6647ecd98589dd4fe0e37f7e5d9a5256edd3feb04efa4fe8a0bacf098d492a347251fd813f2175dedd71ead478b2af4530f7d30e8f79e59895dfa936b5f9f24822dcaf8df58a6c6308ffbc61e6ab35a3b9581f40b7fc461ca521f2b7f8cb73de95174ad1456056cc0624e742b73deb6952301b2ac52623112aabf9fbe6e3e8a2fb3b580599f1ee77ceb56fcff3d94fbd566b0ef4740bec5e2eefeaeea3db0c978b6f3502b4ba9d9696dd9dc2a3852d700582c2051dfb03496056a3b6286b2c181298fa313961a7fa16aea4340e88951635ab32a47edb59d7087abbde5082fb963ee0a14546650530be506db7dd856a22849cd92669f85f0b9a401f3567542ff5f5ba0850c6c6e6c31421451fe548afd8077ba261b5d5910de5d75fc2dcaf615fa217a27724e6cbd993bd575da5a9083c9ef177e9a4f9de4f68d2c5cfede1f6faf055e0e32000eefa2c4a1915aeefabd140517e1343a7be54e7e7645aa9af14e03f08f580bf1dc3645aa8c7ac230b62b1272a0eb35be7a4925333be3fb5e79e7c2f81c6341b5da6514a07287b8a89325efbb31103d03e6e73a62c796e81ae423c903a2ed78886cc807b8696dc62ff34686f8a62d4f142a3b7c9a8cd3ec7205a49597e4d483d87772510922d373b926b9246068d77fff463079265a9b586c00e4d15d5d8374d18e7bd0f0b6d7fcee556e7ac5678143ed94cb95222dd5119ad4726c6a8b15c34ae251d1e3b86f675287dbad1639da4"}}, {0x26, 0x28, {0x1, 0x0, 0x3, "57522ea6e5173fea622c86532962457400139235da653158d792ddea26f2e220efc4c3f6fe"}}, {0x26, 0x1003, {0x40, 0x68, 0x83, "192c2a049c20f69e376766c2f5fc0502b43eb8447a0f05641e2ab254f64d3fd50225ac4dd4d0c682033d0737f2642cce74028f55ad01f63c30f43ddd757cd2553aaa41078e3da17673638d5f19b751fb95b07be5d3cea371a16e3d8fa8d6ddca80ba5ba735480fa9dcb0ea847cb289ac7a74a9126e6098a2d00a8d131a233567cd9f0c2769ed6c31bc01359c8fd67d64b823ca4c423a7716acfafa105bdb7de157e1582dcfdc70e396efe480d7461e4da888adce5738f78574c2f1af62a2408f52cb95d606c711c683dd9be32c4cbf20dfb8735bf8e6fd5fccea84369a3b81a10d279970c84aa5bf64ffedb8ea9c7a5b2fb6108feb412c8a05e32c657ed2e09e6813c59eb337f8307bbf168e8eb481238dbb8ee0da2d2ddc7697294271565ba81956b5dc2b46e89922768757fefe8addc67a0e5047b3202e54c90cf518e85f1c2355e6af559cfc23864909eccd204d12a6b9be84ae4c91895ed8be370e2e9790038b303b039733fd1a681b619a0a8705f58f6eb78fdada62dd9aef9f6c1a2fb92e40a9c57014b2e2aaf885179d4d81301bdfa3dd65d761135d3670b64ad1120e9fe7fb52d30ebaf39d43d65d108f44ed6cb9b549707294398b642eaca0319077cbf5d0eb55cf5d0817a1f92c42cd348795df4394ca69cea42c2c9321a43a99d5f6b7efc074e0a30d6b3a69531cf0222df7863cd7491404f7e14250076532c24103e012453e105f4bc58cdaa18efb8cb10205b8e5b6630b31965063cd3879e807f169d91a0631805b835baf692dd483e1fb43b9fb502c5a7bcefddcb9afd69167c8ec6df1713678e42552f3afe1c2956a91fb4236e471f7761a2f8f0e95ea32673fd1be5aa4a5ebc9f0c59ab33414304ccfbbcfab4b09fc5227ccbd12aed9df8a2aa1dc4387555cde9fe5d1e10499e9a4bcbd9657c66651e3d6e8d6fb9470a2bcdb5ce6311a074ed476ea958a6d9bcca7bf1bcdce20767f5b61dbd37e33ed5ac4a7c860eb927f1b70e976e9aa5f2ade0aec75073e4cee712e12a5b5145077340226a107ac81379a8ba661c822f7229f52f9c00432fbecf65007664bc52e99d2790e4fb30bb4b9f79ae6c6c2284e837f6ac9b1ae6a7d3595d30db63b3c43ce8ade7d98dbbfacc8298e0e31348f19f89ac7c064c5d10003914c45079149a5ae75900995b38246f6ebbf7abcb5c6552a31c11ed87c58329dc07dc751b87281c161fd7d5799f56ddca2723630be1ec2170dbf23cdb19888d28261611a080c0a8fbc49a38598fbf134a21ec9af23bc1139b7a50439f224f6a883b0a7abdaeac964b60dfaa26debf4c289d72de0d4a41be283497599e1947eac90acac3422a4b8052cd032ef56d065547499c37c3c6d89baf34f541680efc56ce1f90ad91556c58ee30c4a953a7753fed01b2798bd5361d1a84fe1ca7e6c83e34af8c1161713f309313e39f412d740b5df9494ddc35b5572863f32c499237d48f282ff15726359defb4b60999c0439db3ead7407e37e0a775620bec02ca6287b6d55bba252d8cab3cd907eaf253ab2a410fc87af5bae3ac7dc6d16456cfc964aedcc01cac31bf8176b35a1301dba6992e88609a1f2466e0d736303363d5058790e38c39afef698aa1eff29fce8b7ca082d05bd108435e08d71b88d5d81e9274caf711ca568d392a2a17f92722a635a6e8ca9039b5bbbac5fce48083cd8525deb39a407bdee698e4e49c31a33f4863a6a75817247e856b9e952fc8c029aa2d962a69b65818eeb4668451df031590844214b80dedbba1aefaf33a0cae0ec00dea4e1a703fd9352c3048d83acc7fb9974d1b7c0e357a185aec0b1f05a06c3324ec011406f675cf748af372e0892af2ca299b8dcf8e9bfd18d38e8e7c068d8e8f2ab095053291c34f53f797dc2c56caeddc30613b683c449fb6905c75083e22026a8f51863d27589470d41eabdca5021b68de5d492c3f2129e788235e7509b9bf0fe65f63c45de3515f9ebf1fbdef5e91881081d6af72a18ee3271de63eecde9bb5b55730d4f5a29e4561e7b4d40dfc7df120b292dd16cbdfec463bf580ecb5d001beb53fabb0edc7d0e5d4ca0a231462eff5d6fd5c5dbb1809b0d6c91cccc7d58bcccd69c7a53f2e67633f58124fd8cd67b806f4a893d9f24fe0e4957e3554fb0c8d1f32cb9c6847fa6bc2d4237cce0c3687c0f88d8a2af34474d031d8d5c7a45057e64f505fb598ada91e3dfb1d72986c259d4bdacd5e5b13cff8b45888274988392c3b50e3f85607144337dfae02be7c3c730e9117c7e069d8f5b474132f09128bbc82ace97b8532ca83fbc625a22d6053d8af6262dcafcce4d73af57eece69a810e4e904264cf099c3e3ce8355d5762eacdafe20c3e8ad6c19aab228851e6486d7c3bfbcd0f4cbbcc2f08e89287f8ecc58dd2368fd95f1c0c434c0ba3d7611ccde0cf4f1ec65d569fa05ef75c834efe9a1f5f5ed027ce9f1716082ddf38abf3d382109d3bc735b9f9b36687984968586c289e720af3380582ec053020d24d886ed9d14b35ccf42c67da0bc8146afbe3c71d58e877472e44deec56a1b8929ccfc0c84cc774130fd7e0a6736121496e4ba87f1abdd5cb542dcd71de67a53b08b2d5ebf564c971c4ef75aefbc9e90c796e404719f70292f3493110e146afbbed0c96bca2e7c63408293213b2343daa6c249e89f1fcb534579041c02468095a9e2e746adf2521d767a34fd56065f839167228509cda9d6b484d881834ba76c48807f7fff041a54b92827e9db6f1fd763e16b998d478406cc5ed183127470aa4e2884e4bbaf98f245a332aa81ff11dbf304f6a071d0e7038bdd589fe1558b11b93255dfde3bd3221775d5e36d3f78c60c0cc75aa21934ebaaa6cd7efe2536623ff1dbf9cfd9414a938a9ed37c0032caec37e4af1b6f81705a93a685d5ae87df46caaa8f6b909c63f280419a8e689c61b829296ce14aa728c2cc0beb9c33028f6c53b191236bffd0422b75d25842e3072a2c0c9ca94993ebbc1a5d40b1d211ee418f68d7302a65f5a8d5f1c15446e04bbe274cd8f3a3d02c9788cf973fc97fbd1fac41aedea41b25de200ae8fcb41da91b6b3cbc0359c738cfb279bf42de88d31c15fae53a180d2f3625c90cff7d2bd3530b47b0681080985a56b782311ca210698b9d34c45bde3c5af807104074ce938054650edae2dd62ee14f0a55ad9eedf459c14db8a76f734f425a03b6d64ab6087e8df2fddfeffbbd0838e7f9596c4962b92e38a1a5fea28b76668be0c884eb6f10c4ab81c38d6d63b534ed393373da8dbb916f0a40c5ce646c48dab754b77bbce306b9f855892194de3f2a21c6b5b2621f5614b76b5061b846267415315b79915f3153a78431b33519a5a35255b4f08e0b019a9b15ca5622e8398fdfd3319c1ac7d003d66b89fd8daf6c4b62b6fcf0a17bb33d0a46ae50129169236cd51de16a2da33325abc00d068bbf727ce7707cd3548cafc124ff1e387c60c697ce16f506a00196b84ab423c63ca37d7206979eaa31d7712dee574c11aee77f3a575f749d2b3743c538faf23b55f150a56c00a7875679a12002dff54dd221246acb95c7f4668211ea9334cabb8cda7238715d1f3e00767df33f853b8e4f76d6aefb56e2778972b70d29e66b68788ea7b327d329ddf75f00568b52a1c796dfecfd2a51331acd25987c18c10e7c39e636e01005d30ee230f4adb587baa8e22c760e195326732e8500364aaa1b0c152e066678a78f78bf1ece414b98eaebdef6dd63658253c3fc460341932cd00f6d4086eac84125f8c560d6cce031c91581b90521ec7d188334127151a4c93a7ce34012e6ad0e14a6a546b569e598d43fcdd8d506ab17e32fa41e57345a53baefee407be3c8ecfb0dfd2d84a95eaa0eb12558b8b1e01b53811f0f66bb5af110c49ea85b6bd253316f5146152e16fb48d44bf4712be746925e4b2239e6cc866cf0656e25425358d7894404d5c36b66283d182d9a6a1b3e825fe28b7d0efb491ae0e9b7a9f8791c5d8b215cbf0ccb0dbc0af8e992bf00110b2f14483cbe8451719306a1358a8c08459cdc1aee4feb8c0040d64dad1d3ac60e419cd53ed49da144c2d1da25cf6a62b5ef916736b624ed358172a11edeeb5406903d5a9091dea90c9020bc2010e740101f556b50441751813c584807dba243fe190f8f692c5611c69754bbeadbe7aeef27d948c9eca2168170a35765544226af63e7f8fe49ab98cdedd5613b3acbaba5fe213eb96d0eb08693197e204f1554f7b2ee00f3e0234c27ae1d60bb7fbed0cccf345c19ad69ab03b22dc2153089b3cd6f12846bc0fe2401d483ce7158ac5419f6eaeae36ed5daced9613bf5f369585f779aeacd20778f3c64d085afa101b9d8b42763a96b56476ac9d868e1f147eda978b27521f7f7bd4901fc598f0ebfa7a861a8c5784f9e799f53c42b1bf110540cbc1eedf57174a6379d2b48862e6a49f40eb80ac86e69c93f8439b88911165cea4f525874609c8055ae101a5436a21521fdef4db12be47070a3701db95a621a5aed44fdd7691525ddcb228f3827d17552e059f42d2ea410baa8c3caba042f0e121dbce98f1486bd1296aea9cdddfbc19f5e82a64a39e28684acd4b2d4a0bd1f6fa23424804c99decff3e39058f8903b5dcd23b4dde411fc61b9672292a7fcd753f0d1b5adce769427f6f230b8b24e9e6a72a5d7fe4159c253cfad68c51c708f83ce05422f4dc290baad19ed1fced054565c951f841bda863051bd99478fbc653af7c38e1f045c670bf96233d4c454795cfaced79338f3409185066d75664551f5e383e2ac44c5fb7a04b1f97d6f59f7ed40c0f4b160e7acd34fbab5b2a15ceca9e69a3509c3b774ba293bd3a1022d63d81b9c11553f6e489b4e97a2c95457ad3446461bfc357d66037754a5a84562b7a726f8233db2e51576a418dfac72fdefb6efb588d8bacfe8d39c82e99a2476e4fda374f39fb3f1cc4e9537bd88a9220261ccb9234818e2ff26b56904c3bbe0dd3ec50d847897ae1b1b184bfb7bfb3c9e545d4c8cd123f5e883c66551fe7a46ec0f3d499b924fd4f814cb4e67850ad8ee02426b9411a9ea27a02920e8a380c8167da4fcceaf2e0e4933d41b4a3c3513d817345d98ffb767f2345dc27909066079247f43dd3b78bf602929cb77746e8821d86f8f3a98815cf515154387c611ca6f48e0ce7741821f84c4eb40b7ece6c7a96f782b8e2528f02411a3d55a56c45b35a0c15a4390500b124e82922dd4e8ffd6ec9a80ce195cfcb75a979826b188fbf00eed0bce6b9abf1cb9d7a260a6c8a97f63c614fda4b2692cb291fc9efe06ccf1fe7eea8df742840f7d0d450bfab0815124500bf9543c34477a5ebf9be42abe5400410a6a4f3c99539296c3126f25d63bba73c2e4fd9dbd7be64d9774134d608f7eae5169ab8544b08147912f562d8868f9cc26d8a0290cf79eb3750c3580dc784c84f8b5cdf4206ec484dbf58960a027b8b1d98d1b390cce4d17647432cc7061a53af92b8d11a3d9ab9b70552105edb479f634e19bb21cd7572b6a8439b2fce2947e378d8bf243a0b4c28e18a436a14e2d5e22fdb51412da31eec85086cd3b1df60487bfa9ffaf3085df4d2cda1329962d645f6947fcc7171ba0c666f239624cd1bb6223f70c9d8e4c60f51d9cf6daf1d392cfa803218639117bc12fdff0b086b024bac66e9c6f4c7c6d47bf305af366d888a3f441aec73e28a8e0f60e2824597cc0715138c284df96020188e04bd7f29a466d06afbc92acdae73c6b67d1ed8d62b2a700a7d2a3342fff1d43e7112"}}, {0x26, 0xca, {0x8, 0x80, 0x48, "ebfc68ca1e54b8cd660fdb567833e34f5a830dea0e357143d99afb17a3ddefcc6465214b95417d68912e06f6f5ac4cee1c7ca5f72fa379010ed7ecf67e1ecf1c391d73170ba31a2a582ef8f02a10f35000259276629f3d9e5bb21996c4d2ef32a1cd21bc36d46be5d28f4959aa55252539d877701e1e38e484846333a9c5e0561418ae1f76ce030e7283ac57a5b4abc50e60aa553f1b2a38ff8bb3f675623d2a20a113a22b65b145233be0697aa1ffeebb2dfff5eb070f041c7ae739b80a43832cc44545cc105c"}}, {0x26, 0xe6, {0x6, 0x66, 0x0, "8b301dc3be6ef9614c8915ed95c748d57e3240141414377a05bb3010f65c61c9e1b4ab4032b9669b21e7c987aeb2592202bdbe52e46c6186813f2c0f95f9a3c62552873bb838f4f6fe77d67f485ede75008c587a5e852cfab33efd2354a657e0d362dcffed963105b735f94338b7f314043ac57d0eba928ac41f04e6848e527b1c8605b7afd842db5d05d57d4fe78b5eb4482499405d0cca7381b2881aa6e12c16bb1060c4a8d4b7f1a992aeb9d7f0ead694c10ff06443a52ed4d0edeb41b9b6b51fdc25cffc8f3de61fcf904b68521a89cf1e0b57372059fcf354d0ce849dcb2ba7b4"}}]}}}}]}, 0x345c}, 0x1, 0x0, 0x0, 0x8c0}, 0x4000000) 16:27:08 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000480)=ANY=[], 0x2) 16:27:08 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00') write$binfmt_elf64(r0, &(0x7f0000000140)={{0x1b, 0x5b, 0x7, 0x7, 0x31, 0x0, 0x30, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 16:27:08 executing program 3: syz_emit_ethernet(0x2a, &(0x7f0000000f40)={@random="7feaae935d05", @local, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @local, @rand_addr, @link_local}}}}, 0x0) [ 1322.545128][ T2745] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1322.608009][ T2746] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:08 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000002c0)={r3, @in6={{0xa, 0x4e24, 0xffffffff, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x4, 0x6, 0x631c8bfd, 0xfffffffc, 0x30, 0x8, 0xca}, &(0x7f0000000380)=0x9c) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, r4, 0x20, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x23af, 0x6a}}}}, [@NL80211_ATTR_TID_CONFIG={0x44, 0x11d, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x8001}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0x4}, {0x20, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xe3}]}]}, @NL80211_ATTR_TID_CONFIG={0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000090}, 0x4000) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1322.967946][ T2745] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1322.982313][ T30] Bluetooth: hci4: command 0x040f tx timeout 16:27:08 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet(0x2, 0x3, 0x5) setsockopt$inet_msfilter(r3, 0x0, 0x8, &(0x7f0000000000)=ANY=[@ANYRES16], 0x1) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @local}, &(0x7f0000000080)=0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x50, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@TCA_STAB={0x4}, @qdisc_kind_options=@q_netem={{0xa, 0x1, 'netem\x00'}, {0x1c}}]}, 0x50}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 16:27:08 executing program 3: clone(0x26100d00, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_netdev_private(r0, 0x8992, &(0x7f0000000040)="aa9069175fa7b0a7f93982b4f93a") 16:27:09 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x12}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:09 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000480)=ANY=[], 0x2) 16:27:09 executing program 2: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x1, 0x0, @loopback}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) close(r0) 16:27:09 executing program 3: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000040)="d3622fe131479cee20fb093ebd75dc0b411519fd3b65006522d73df58b9257b566c6fc626776defc3a2e249c910ccab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fbf8", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1ceb", 0xf7}, {&(0x7f00000007c0)="a0d3908ba277a9c29ceb0070daaffeaf722bddb56f384553233e76a108c9dec3fe18a07ca5dd14c9e2ae5496a06596781c9f0adc05301c18ecf8c170edf0ec600945c10083f7ff4bb0fea0df0f9aaef5a97f1eccc85247838cdf7b2efaa4bd993b7e0c72e65bf5097030b27b53c8dee7fdffe597ee737cd3bc8901b810deec9e52076963e41209142304279ceb53b65c30b6c92d9c3ffc4c3fb695fdc03a42cb6eb6355a51c9de9997f28db04a3a4d2348c1b2aea98929bfe60021aecdf88ba480e0e2c81785051299a958dbacd45f99f6707c3ffe1c49dca6538e00"/229, 0xe5}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df96", 0xb2}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a) 16:27:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r3, 0x2) r4 = socket$packet(0x11, 0x3, 0x300) dup3(r4, r3, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f00000003c0)='dctcp\x00', 0x6) sendmsg$NL80211_CMD_DEL_INTERFACE(r0, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r1, 0x100, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8080}, 0x4000041) r5 = openat$proc_capi20ncci(0xffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x40202, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r5, 0x28, 0x1, &(0x7f0000000040)=0x7ff, 0x8) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1323.967160][ T2785] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:09 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000480)=ANY=[], 0x2) [ 1324.015918][ T2786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:09 executing program 2: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000400)=[{&(0x7f0000010000)="20000000000100000c000000d90000000f0000000100000000000000000000000020000000200000200000002cc4645f2cc4645f0100ffff53ef0100010000002cc4645f000000000000000001000000000000000b0000008000000038000000c20200006b0400000000000000000000000000000000000073797a6b616c6c6572000000000000002f746d702f73797a2d696d61676567656e3338363633343038350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000d9ca5cac99fd4329af4dde786c1a5d13010040000c000000000000002cc4645f", 0x10c, 0x400}, {&(0x7f0000010200)="0500000000000000000000000000000000000000040100002b", 0x19, 0x560}, {&(0x7f0000010300)="000000000000000000000000000000000000000000000000000000001481910a040000001400000024", 0x29, 0x7e0}], 0x0, &(0x7f0000000140)) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) renameat2(r0, &(0x7f00000004c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) [ 1324.431099][ T2785] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1324.433270][ T2796] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38247!=0) [ 1324.452203][ T2796] EXT4-fs (loop2): group descriptors corrupted! 16:27:10 executing program 4: creat(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f00000001c0)='overlay\x00', 0x0, &(0x7f0000000080)={[{@lowerdir={'lowerdir', 0x3d, './bus'}, 0x3a}], [], 0x5c}) 16:27:10 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') lseek(r0, 0x40ff, 0x0) 16:27:10 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x13}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1324.692361][ T2796] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38247!=0) [ 1324.702943][ T2796] EXT4-fs (loop2): group descriptors corrupted! 16:27:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d0000004fbc3a4ba512e16c472bb6f3a43b6449098fb98d8cd9bc3f8d00000a0034000202020202020000080035"], 0x74}}, 0x0) 16:27:10 executing program 5: syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40}, {&(0x7f0000010100)="0200000011000000140000001f22000002000000ed41000000000000010000000200000093c1645f93c1645f93c1645f00"/64, 0x40, 0x200}, {&(0x7f0000010200)="02002e0000000000000000000000000002002e2e00"/32, 0x20, 0x2200}], 0x0, &(0x7f0000010300)) 16:27:10 executing program 2: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000400)=[{&(0x7f0000010000)="20000000000100000c000000d90000000f0000000100000000000000000000000020000000200000200000002cc4645f2cc4645f0100ffff53ef0100010000002cc4645f000000000000000001000000000000000b0000008000000038000000c20200006b0400000000000000000000000000000000000073797a6b616c6c6572000000000000002f746d702f73797a2d696d61676567656e3338363633343038350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000d9ca5cac99fd4329af4dde786c1a5d13010040000c000000000000002cc4645f", 0x10c, 0x400}, {&(0x7f0000010200)="0500000000000000000000000000000000000000040100002b", 0x19, 0x560}, {&(0x7f0000010300)="000000000000000000000000000000000000000000000000000000001481910a040000001400000024", 0x29, 0x7e0}], 0x0, &(0x7f0000000140)) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) renameat2(r0, &(0x7f00000004c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) [ 1325.062514][ T30] Bluetooth: hci4: command 0x0419 tx timeout [ 1325.070504][ T2812] overlayfs: './bus' not a directory [ 1325.254328][ T2817] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:11 executing program 4: mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080)='/dev/fuse\x00', 0x42, 0x0) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002100)='fuse\x00', 0x0, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000000)={0x50, 0x0, r1}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000004340)="9eda438838743bd4e9720bee57093515dc189a5ea685e9556c1c2c3cfc4df50d66d31a48aa312663b68d18c5826b5b55fb738208863dac0f10f423aee7a5d8ddc45ebdfeb7424bae859d7c37ecfc4b63914d5a56d91017dd22bc84f759a15969951aef9d5c88c96560896988fa18cd946cfcc3a0f1c993348377904eac32c980bdf7976ebca2b499cab63c4e841514277fc71d4620e29a92523402485de0e82896484c0ae497a4d686df23ca7b68c3fd5e624d3510d7f94838e54af877ca58a00c5a672bba11f5aa1ed1980dfef47b9973d0bf456ded5e72f1702b3dc5197fce39cba53a038d8dc0ec783ce70577107dc5e8b299e64a0b7f1191f0926bd25762370191710bab2f44e9069f55f8a3f87e4cb488a2fb3348c0bf3b3874291f83e4776b160ea73aafa3919c7c069c73c0052173a63158db8b65541d161f9c964926ad7f06bdd6cb6a32135b04e35701c2e13c49c1f75dc7a25d623378860692d172ec3f1e1f2d9dc77c015c13721efcb101c2390abb847e871132f472a37cc0163b39b1d575a5444e246a08a1afb1a696cabab29498a314429a3b9f44c43ba29f71fac1fbe0d01c3c16d22730932704bcfb0c1b7a432bc51dd3f5dd5afc3b342cbe6a6ff899039e28f9a51881b1d46fdcf31767cb6f5c5c69ab3c80615d77c4d1664fc4ec831b8cea2e752bbb7a9ce79df875b29f1e232751daf32a1a0c4ff8bd0688e2b8e2d668b8a77e20a9eb6ec2e2c23b94e507baeacbcfa31fb6e1ca3343668f43e3aa6d85e7c29bf0bb4dbdabddc92be7f4a6f5d21b19e6da17bfb6cc926e3847532fae29c7b62fb909130ec372d3c16cfe6aaf3ce2af0fe7610fde7aad61bc80d2f96b999c8ccf6d22cf903ca8ae8b879ec4a416f334982e9810c0140a18d4dc81b5edaae23e9f4abaf40ed71512aebbba5bb251545e188db789558a845a2877b14bdaeec3c738b7d730c0860531bf5517d4f0e8f95ed3571f8a35816d5116fcb8d7cbf42b7d5d5e65541508c898bb2e0fe96297d2ab7135662de39df099ebaed5871111f5346278cee5728cec512e6c0a0d65b51e3d627873195b84103341c2bc83b6c8fdd8ba17f5957413f61c69d618c9b9d0b1f08dc81921b6c662ee1da3bfa019b095e9a03c2db4d645ccb7364e895098cbf7d932c72d80663c7a1694d122f7348393079223c11d36c64a5856eae0397ab9a9d948204b74e56525a9d552dd0916de81cbb5af3c59b3d7f8f9154423ce2cb45a5bc808e24bef13212019a19545fe54ba84d01534358380192b8c7b0eda907810375bb66a578a58fec392b47991271c8367b91d710e8a176bc1a4e96f0e137d4c25fbb03eddc392f9f170dd744472b864fbbae7c93d86e682308b21b73c5652065d72cf02e1152b44024a90a3b52eb0bb3cb412e518d37a68aa4c7f46789c54ab30d3a73d0a8712fde612294cda2aa1ccf164930b9b1d17801d4fbb06e849d39bf2b5141330caa0d2618b616f1c67e1ca57080e79ed9092ba7a55e8121cfc825cd26a0199a479a7ab1b7b23d2a4dd82fa6d04ee41ca680435efc934f0451e865e8632ac2f1115f4cdd33b0fccb7a2326127faf20cba37c828613dba5a98f4e1ad25eb6b91078cf73d873df9ef91531476f64b83559ff7ccdc4c070d478b18196ea05fe8d4ea0216ee5273dfabbd04582f40f064c9781afd2cbf30901f28cd09cc934f1b2d50883778274177e3dba8af0a1b931d80ce1a6c4085780ea2195b65ecfd2953f78a5290fe560d0cd6a5e73890a5a82dc410b92a3ef2be05ec5607820fd4ca6b9c3aa258d59022fdcb21665f1ce4e8aad8fd918c43bd3c2afe3dc223ff9f48831d401c8b6996190793d1dd7551f8511b69283992398d8f9b4bd2b3398d3b8c6f3c5d8b802ca5282b70242df2b7be4b38e70c3065f8da888631375afcc05ce578089c4f783776b286b7a60d1b5e189e2742a3240c1036a953d886885422eef01413c38099b64505fd5a73488acb4e611820674c58ae74d6c64a885d4beda9bd7903bcdc71e3711e2a057c0eab2100c321050ab14c6e453c53182577ad3178603cd9afde40a701120e9a36074fd582428c74e02781318e6c65450f8f020bd22475696fe13b8c59260e53a06d16eabd135e887a0a6bbc8ad21be7661df76fec5b13844f68b8eed1a7379713738beac9f23c7a26520e19797a910cde9fb285179526889b908b7eb49bb06f70f6271fba8712c1a4269ebcf4b7d043e924e3d2c4c753fd7e547d95841e335179836f76424e728810d7f32b78256ea30c79d9238a6588426e1f2d4c0b03d5605bd826ed24f0f11326b4cf958632b86e017aa80e142db1580c44f76d9c98196f3f6852ab2bfc6a01a3553a130c2d171957f5a45c3550fbbc990ef8742a98a86b280a57b9f198ff436bc01161ada50e6f23026c3254adf2321bff7e20aa54080bbb57d8d52c6a6df6107706a2e5bc6da68f17b474c0edd39401d765086e885cf7992405f856557915603cbe8894676e996bbadbb649a5e7498b91f9bd2f697dd9ebbe4d386050258b9f4c94781e61c660651c3f1e3ae51f8c035eca365bf15d6db48ea9ce183515f4a208d010f7c23dcacbd6e225490d7e9c133525f5c9018d752b21b4897bf18b64b6a9936f538a0a8958fc934440aeeaad2b68ac844d76f0900a6c95bd0b353d85d4fb62eb88360112237fd8c636a80e3130b21d66ae8ec58a4b76cba0602f96da919f7e84fd37e3ec2379f58e389a39c78d2482e03c379e3c4649ad63a76e3707ecff07d2fcb0c9dfc524cab49e69a09c92e4f88714335cb57d3f6184d07bef9657280fb5c9fd2d8f940f7ac6c5407e3077aa2e4ba8e217e0ee19e302d6d90e3be05a86dade35d2e454e511afb5cf5936f1d11f2fa6be6ceaa817dbdc7a6aabf2fad8ff3efa8382a25099f0c5989d2ad56ae0f4968b2cfcfc67b4f1c161c75900b4848f59a3c0376dfcb7997bf28e9e85d6dd942a360516de38e1c1a038a796f9a77ff2b0c7e5e8f4932391a0e58e76dacc6f9764178a211dfde3e75d367d2911ff398126ffdf83cf2fbdf1ad5232bed9155f7a168638a572094a9e934d4969b358cf6e121d7fd2aeae2f499068b42c152f0e3403a230885d6f92f038ddaa23499f804ffb06abdbabb51f6c38c92fb1a6271a4b13d6d11125b8ec12efa5907dc65062797fb9cca15e2f254e76b182d3fcdb4e96ac4de36d6df7e7bba5c32f422286b1be3b79bffb6fd693761952d195a84ad9ceb07287a0fbefab9e0347b513c5f60233ccd4b52d90ec144a2f896d9dc7f279f8aa93038f3efa286e1c3006933a4d7183d952f8d28b141b28b2af355b5bd8198dfde1ffb8d09202aff0d16ca3fec194662892a49f829813970a4520f1228aa03d211a45bed3b2e05bf1f10b1a152761e7b6c6ddea863a3c02224256092c70ca70dc185c4c385dd98b09e2682661e1e66f71d9c4037048eb70e8a1cbe57de87ec43713abf5fdcf63b9c482f318e3bec37e878dadbae15a02d731e6c8574eb14c059d72f73be5174add786d06b585a28a06d349d8e434a491b34897b3c1ad786ec8280d7f57edd4fbc6aea5485d659b59d393e331cf91e6ed76f340fcf7cf460892fa7318fc42b883f61d888ad982a751accb613c66661fba5f3d6de751a6a9ef8a4700316aaad04e991aab7903f4ef012ec2a8c092234e74ef335daf360ae47bbd2bbc6ad8c1a4f81efe8bbd703cb55ef36b32b4e30cb5a3b165c02ba295d0e1c40ce6ff8f479a74f01275f113ebfa8ade37a59ce70e6ca2a6f48f1be085f61bf772e2c2da523a2cfe63e99c57bdb1ff23139d4fca49eff7547e9880eefd3f7511a677efa23b52098ba89037c48dfcda2e8c1cfb9f892161049e53f8cee55256279512aecab8c441600dae0fd957883273047cf5c66ba209f830aa2ce0cbe41ca08c0cef4aed7f4324009200661a7ce680e5a8df2d051c1d8b2f63d25d8d74d05c75c46c8f3f24d625539e63459650960498a54ec3b16225bbbf4d3930009df265839d72611f5332a904cdebada108236e4414a2909ad01ec44b9d7f75de4385ad7ca5152e890a0919b3639fd1bcbca3b737ebb8d9ae541b1271cf2166ba15830e66f3d3afd3b754a7f81ad4f0999704ae99c114907c5be4a4797f13b80564f234723a34dbe137dabfd7fa23562df679f54a6ab54def6d63deae9844f72fd73efd0413551f5c4b9ee826eb3b7faf92a59ea34a16723b4fea14d1c8815a4e2d39fc48d1dbce526a7c53f5a96d0ef6463a0cee73fd3505f5c764a264b83c4a21f80e8b61c82d24442d13da99d18dc1b2538e7a510f6093d9ef2bc5cc777d4f98411e93919eddfd69d6e20d227cb61c50f358ea227f4de941fb080c1cf6b1f6e25533768fe133dbfc3f9d29c603bed38aa3c5af5b81a706b0067b40b88f992610d04c7cc36b8f649697cd6a93fae51138161891ae75a7147780fc59af5a6e18c54f9d2a4fe7fa92314b399afba9a40d0cc24f70a2593acf8d179215e06b7a9a88224bafcb2cbf60caf5fe4ff38208a70793b5dc33cd572956260e1c86312d3ba9b3a4b2b44376f2e78c616a6c0880ac8dcbaa30b9f761d500fd03a8518dd0509157b184a2d95e0caf3ffc8ac2db6c54d80c71a1e5b9ea3bf51071e2118af204123daceeb04e4f6f31f32a4d3fbb76ee49440cabda2c121c1b99acab5b87cecc37c3f9066af34ab29d6598bbfd91047a2ac7ce3a8f3027ff5e6d743506f161087278896a98ed37122ba208b61cf54d3929555ab06b564cd5e4f46f4755a6cfa2ef2b30d29ea66f2749d4060d411fa9160c91b6f55cf071ac8222c6313df18759e2958cddfe3db4cbeb9cd39abcf5f0beaecae8437813995cb7ed0b87d42ca942ff7245ece204798d01361c5f008e0d82bdf76660515bc78f7f8f409ccf68614b2cb50f5af2615661326fd971bc57eeeade60ea906b8df1cb0dfafd318cd2c396309c329d0469ca192aa8f51d7c4227685440f073983255baf054b97b9d7be1d1470d7eabd5c09b2116b4e86b0567b7e97e088717a4fe3dbdd310a1c39136ea4d2c47492001f9885dba03bf97e7da376171d666441cdc2f999db137603d57df32b4260fa0165e82917bb1631ea314e7a7437e66fc68cef22cda8f456d6e583f6e3237e0bc79987a9103f7cf0918e26881f67ea582e1ff3a49177599d385bf6e42572a2547933aeddb826530e9adf30dd84c3a7fae5c4c26f6c6f3a9f0906decd314e2407825abef959c5416d18a92ff34e6c521a16e8a0a29937c77d4ee99b41d530a732acbe0bf5d274df9d496b47a9a624546bdcf9976cde12ec989cb2a70b33a7c8a3a77652023164695f9db30dfcf587f0cd4f73e385730bcbdd688f6dcb08ba0efbb9f579220afefa4acfea522e864fce9b1782ce9f14824d16e9d33a2609c23ba3c5a1af02549357a0dcc12e37819d778021762cf895abeac1125b744c8b8225a091e7be9ded9993cfa3ca9abb83e25c8f559009977a2ed9374a89619fae5ef6d164bb73d242004dc8428e44689b33ee3bbe88bb4962ab0a32a90e7aea044f08410752cb2d7aeaf3196648a3a99092665b478bb394b48f79b36db0efc7f50d6a5179c945f5298cfaac5e5dea715296f92abce7281d48a0c9c6b785a35ef5f1697c047ddb254fe9a8ab9f498b0c1ae09ffd01a3d8d427fee7e36c51e0e5c2fee2245fb8464626ab5c9857ebce91f7d22bf024d10c2d71021cd69268472de419e6cefd970cc3a8e4d1bbe6496799aa7f100411766e712aff08b731460f14f9d7356db12cf8e1c6121968dc68b1d81c086b325ca4ce6fe1f476707e08fa913144b757c6be17cf93150db29544d207f09a896f33b7335d9339215da751e7af2c6bdd19db6f521af2c8a5998dc607f97026d07111488741134c1c86eba123273d1fd5ee4b471e86f9ae9478a04c7482076ab34a1eca5c64f89e5106eed44bceec019c67c12fb4db4fdac153f4ac3b63ffeb6d30de58ec039e2dd3c181e254cd94d0a2b0b44490384cc5915b54ee1db2b6d059879bf8126c9ca976d0f7862da07ecd350930a081810a7afd72b2ad3f65b96ae9c7f91227a2b5513a559f36b90fe01be9ae5ad3ca65e2c26f358fc26b858a3633fda7ae49a5fb705220a5819b3cca41b1ccc21d7c40f5fa9c422288efa5394e4312675899d704a2aab62b8363f58fd4bc12a8bea6ffc45b4414237bf5f019321206dbba439acb5ef26641f30fdac20f964354bce94e4c9d73e137f9806deefaf6f4acaa0e76ad4fef9f6cb7fc01bbabda9612c05adbe46afcf94819e8a4b4b49ff764784fa432d47fb6d4230900043d1b4521cd6839fe8c5df4d1899fdfb13880e207cac73f0a29020bdd563bd9c2f6bcd1ec523b3e03ebf6164fc65af001830c51396f9df2d346f83a59cfc82201cf1150ea57259d579fc2ed199b3fbe42d5188c84e4354610743e5b23a265246313cc63913f17412fa00d98b379b80b96d936969572e11316bc8926cb23115186f3b2387b82c3898fa41bf16a308da62d5a3eb3609af1943fddde08a4036eb2a41b7292caad9eb082614b02a1fa255bc7abd4d0e3b4ec1801e131e68c7aa9da1a0ff10f9de87dec8fad1ad8bfa99caa49e203a7b9c33e044d4544a537471e7a452468b821959bc488c6b8cbf81e90081a26de273ad1203cc06adb6af242ab19f96c1c66b58c37e2c9309704fba63af99a8d9c5efc651afb631fe9f546b938cc3b8e526c4159e5c9f7afb29fd1d55fabf09367ce2a63a35e7a2062d1c772ed981fd77157a847f687a177cf9886ce41df8cc509302b46bc1e2ba896b1c1656a1bbfdf4cd9ac39cf8510d1c823075f16550fd044aacc8d42a56f03718f7b18475cdc3999faeb25ab3dd8a807ee04d8e5d831d08b4e309dff50330685138797e10c6362636f53f22bfc1f3d5090a5d369282d9de36bb4e2505411ccc6ea395afa1567b15a2fb4be2adeea7126b1a8e80034105e0d98bdd78e796ce1cdc06a4ae666fc0baec5c52614340ed997673e26ec47c88846c000bb7c9077337cd44f5c041fdcc64986e5e1c0f488148f0ee6f842c44c0b72e82109270341bba6e9080b70fcf930d0f10be5a36798e70111fed72727b72282ff164fc08319d74f1f57cde71b57cb397a9e753f87b97729bafba017a24cbfdee5dfe7fc296c112e93bb8fce560ca80a3afd8370baaa79ad783b51352b5440b144a47378c9ae22eda5794328e95bcca220fd07bb56915529b155c61858efe89ad36a79288e74c0e251addcfaf797432175a5562b46eff5e3aebeb74623e18beef85389383c604d8884431b07dc4bea0174aadc337ff41f558a63f16690feae47efa2a5d1318b7397e1e4ba398727d286791b71610e1d78d32800e7e113c12abf0f60b6ca4401ecd23b7aacd990633b2b017daf6bfef1b2361ece74b7dbcbb1a73d4bc1f9d2e5c9fb0b7980d25cc44d1b10c09ef5a6a05c84669294a5cadf0cd88ab449f9f0bcdd8c48590d416c5c1feaa494a2145949c2a3373df7c6014225f2745bbeb20ff294d22c0d96ca111e6926946207cab56a03162a49e68968e398f70690188ee3ca847ef421742d60b9a6ad029e8a3d607950b2bf8ad8ff297cb39acc94905635770436e134435e28205140331b5100d9f64469792fffac87bca0835cbc617446ff86a7b50418c305f32e658b32130e491e38709fd3697017ac8084cdf1ed81a28375aed092ab4e32ca88a933154dd3a9e99351acbada926b67b310c7070ac1a414a28c5abfe1f45476249a12f18ca2d981528d881ed3c5072e46a6eff3cdf37dcbc89c7f79c88a1f8d15d15beb66a0e4440c7b93e379c4e2bac1d5c8e85f1852887e2cfeb178fba1c67dc2adb0c87df8ca4444ca7f455509f492effb5001328b8cc696e2933207a2d78bbce8562ca34a248193c914406b161c8141479d891b0c6110ec1e25cad38299b489f2ec437017cadba67dcb58abd4933c95b3526f1d4747b8701a7d71e446e4b62e2941d4281faca0cf22914be5aad80f47100000000ceb24e82508fe55a92fb6db70d03d1c1ec09cfee31639341756a4630a0eaaecac7bfbddf9d30c42cbd45eb181d5bd341307ad26f496bb042e2b655c03ac3dcc587acbf50f79b5c239be9938b62d3251b199f8413b020605d5d0552cfd9c39c9132719d6d0a326b000e12fcb51bc274df79d11430060d05978cdd50583f1bca82c57dbee605e2d00fcb5414af13a596d35cb5ba62de6a28cbccc857d23547b1c7fd5ac8fbf6758d5b8451fa46d9acc00344dc2e565674b1dd3547eb8f8aa5fff99042f8d1d59e6ad2f53379211e6832fcb68f5777eb2db85b28f724f4e4ce6342cf55713ff7b0cb4f7f47dd12a6566b86709eaefae024373267ce72a89e7f3e42ab48edcccc96b5d0403fe93a927e5ccf470014f220b8257393226cd7b996f20e6a34f81206733a9fdce03b701943c1b560d3eab68c2c225cf7f7f2b56123be2bb173e9e5b37f4d3348f6b987764ad07c2acd44514ff264d7eda31e5e517a179414841ad4553d51c08f435e05f10aa82d74b97a9ba3a133e6c9175fdcd4f3dc9c16d3be1d5bbaf13240177081ac1d56681bfa988a93af09868afd608520c0bfd71d857a6661fdaf6f2e166987eb007449dd26334ae932c5003fefc0f983b9e49cbfcea325f2de16a9ae935caa46f5b3433957fb370971ed957f138f08a60fed5b84995e428e7ae7d5c22021ff016baef0e713a118344c016a99ad469313ba7f2452da0dd82e019f64aa229cf80a69b3e08ac5847f10d247179855546313232f23e055c2f74ecef14e0fdcc29a9bf0976fbb249bd5c7903183d2a53c70960a183630e7d4928daa7091a85ad987d2a4a5b8f6be6612fa72d9fbb33c67bb38eff19f2e784f94e0354cf6d35a5b2c62233c039de3734b38e97ec72bd673fef09fd56fec329818cc68cdf12cb52f7d37a8350c16e94208880bfcd3e895d7aa4489e3dd15db4a9026f0d2a46f1e89c35845dbd976a1992b87c15a0c7580e6424b8792a7bb7b933d7c5433d4133ba4dbbcf7995d6ed3feaa32f876a287feeb9cc6107778c1f83e0119d980b9e994c2a3ae3de24a103efb3cacb746b49d1ad85746b233ab4aaf0e988ec2a786bc93f32040d3bdc3008031634cdfded5ac95b2279e096243228296591e7ba53c4a127772cc4620e6b238ccad250629194533d0a669ff3366c52d64928693e0b0cbb0b8e2c6029089d4dfe2b4b6c5dcd85f1a02770611e65001e48a32a8b0431a3b9d77fa3a95be38a0436a704c05a8e0183f3214c25531a63796f679bf72885aa766468d42b2543542d7e82544efc5c5e81e6a91a0f5d4e68000cff687d63e45c9a11d4ef515050daa592c9a828ac7c0488e7cdb3d6fdaef5e9176ee68d981ea50d386d74df3b40660351736deb03bfceb721878cf9894b0302df15964242ab6b9f77f98ba1c7993735983d2b022600ab74a19e3636e1400d08ba45d3a5c2774cb06a1c358bbfc11d27efaf7ca53c2e7757c8c76da24707d91a4a5244262898d68083ff91c514d9b9b1ebaa0cb0b10254fda1b1e82b9a1a47f117b5b280ddbec1f6732d11117ef1a7a674699df87fe795d1243cb9c4527e364e2b711b6562a87fafc130ce0baf1701686639b05f0c8dc708f008b1e6ab89e8d623bb83f3d54b7bcdbdacd055ac4eccbd36bbe0af0f65a00e3d6dd985ae8851d176976cfb5816d1fc2a63d3546aecaa4e712ca6961d1f181315d553de6b53485faed0dcfcf819a1ba3badffe797377d3d1ddaed8e7a0acc0c3d277762262a139f94de49faca167b11bf04f2104a5ab9a73367a6461f7124c91a2c4229ef98e6ebde9aac283c7d029400d71293f488ba169b62c1e94689cf5b248ed4aea62b88d65bb764cfe27d5231a58486e7381df518f4ed81cb905108c54a5050a94ca0e94da20d3794bc5fab9127dc95b6404b1e27b4e28136fc27806f7be798444c33aca88ffd45b860eba0d5033839f5a092863954604f1952bd61dad23b11643fe14f3ade08116aa2c13eee701ccd13e506bd65a1060bf69579aea8c8143cd38c0891a3065f251eba0c20ab9c69ddf28e3bd6400cc203bac8de1882239ad4e1b97b0ae2f1abb7bac7c0d8ef82b97ebfb1f5577f06a3a1377b09ada4db87d342f20ab0eca4b9c206042471307511429cb57a578211f92d3647189861cad9145f5eb26ab696abe50a2a6c1b469df97da28aba4e79b586c348a430f5ea61c4be1032fa61d18581f05a07fb8707c8996e0fff1c3eda59b992687fa12483b9327e10224b20d42e8b3fc4670bf070ced602283273d6818acd1f6da567c44d3f5e1377065d43d87d889843ae48e7fa8ba1634815695b8c480ca271e6e833799c70da80fd79acc09b989667a2294de5da73f0363df9a33ad4dab8d27cf7bed0a06838672e3d07d52b6396e9b5576021d5e925abd533bf161c944795065fdd44e8462e3070c479f1c118276653488dd9b2f1a673f8cad3612ca1fab4388ec9c8f834a01a499adb7b3a9a977672f6d75b41bbdd7f91ceb7e7a88568d17bb432be9e4e96e115075bce197ef4754d2914c2c59e2d7f4c08f0dbe34d31f229428f211bf1d7e8f5c319ed4a8273cb6255eb318851ac4557b0278fac63107a54d407c42f300b843a12abd3b893b46c7efac2e388ab42b87aebe2543bd4c15f459bc50aad10ffe1c1196fb52c26e54bdaa7fbd52451f207ffb073ef4b3f71eedd7da40c89505019739e3fa733bcdc84ff4919e8fe2358129ef28291be1d6426b8bafe88463b1d3cd7273745381c7f65221898e6ad361e88b24c54ccc7ac9a830145b6dc096e2d71ef71ec4f03524cb870b724e08d223bdec2f6fdde6200217a13b5136004d455d66547f5a1793e0cad85677d49e5c558852107007c8136812cf021afaf6f7e8f59883371be46cda412dd9c6fcf187c31252ceb5758901d39cd5355ab386d9a7fe6ea46ebf277aaf809c3023211ea9aa189de4d422080ebb9fec50ffab6b95ba4ae5018accc497e79149ed6047ce561ccc10e9194cdccd5c9fb75175c8dbc9d0a916ad59288f010defbbb50d263041ab37aac0f93253bef6f898cd0825d99d27224f26181f9713b8979da64756c95e7505f25a2688960d6155c3613dcc31b6c337a6dbfc6b12cfde1db22b93bbd5e48534fb0bda8b212577a14dcf665c834b0bd24e5f624d2455fe048dbe930328d7cb632db3b0e244bb5d43390b420b15157a339487fc78976f867d3a361aafdd3f50a93c01882da7c220089a544381db22e2c86b228dc2be01820468460437588952a549d37498e529e62aa62bad1580546bcb1e9a6ed1870b7838d05d12f6e3a041e78b1bdb80894626f20889ccb3a468aa4fb24b9c87cbb28623ce59c6b3c6286db366d08004551a25fe4d8d194a2bb7c52e1c85a5fbe4cb15b171489da121bea1c469a6bb185d63213084e3a81ee54dc03a94dc5ecdda7bfaad1df68021aaf4627c9d529f13e5c81b5ee4dd228949ca16b9a61d186211d153294470907557e5e14ae665013f285fe4d3766e7b3d8ce5e2a14692072d4d8f79354bcc8db8a2a36c8bcd", 0x2000, &(0x7f00000069c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000066c0)={0x90, 0x0, 0x0, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000}}}, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0x0, 0x0}) sendmmsg(r2, &(0x7f0000008600)=[{{0x0, 0x7f}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0/../file0/file0\x00'}, 0x32, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) [ 1325.332317][ T2818] BFS-fs: bfs_fill_super(): Superblock is corrupted on loop5 [ 1325.362732][ T2822] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1325.406192][ T2826] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1325.421630][ T2827] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38247!=0) [ 1325.431515][ T2827] EXT4-fs (loop2): group descriptors corrupted! [ 1325.584300][ T2818] BFS-fs: bfs_fill_super(): Superblock is corrupted on loop5 [ 1325.596291][ T2826] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 16:27:11 executing program 3: r0 = socket$inet(0x2, 0x3, 0xa5) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e0000001ac1414aa01"], 0x10) [ 1325.816728][ T2817] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:11 executing program 2: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000400)=[{&(0x7f0000010000)="20000000000100000c000000d90000000f0000000100000000000000000000000020000000200000200000002cc4645f2cc4645f0100ffff53ef0100010000002cc4645f000000000000000001000000000000000b0000008000000038000000c20200006b0400000000000000000000000000000000000073797a6b616c6c6572000000000000002f746d702f73797a2d696d61676567656e3338363633343038350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000d9ca5cac99fd4329af4dde786c1a5d13010040000c000000000000002cc4645f", 0x10c, 0x400}, {&(0x7f0000010200)="0500000000000000000000000000000000000000040100002b", 0x19, 0x560}, {&(0x7f0000010300)="000000000000000000000000000000000000000000000000000000001481910a040000001400000024", 0x29, 0x7e0}], 0x0, &(0x7f0000000140)) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) renameat2(r0, &(0x7f00000004c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) 16:27:11 executing program 5: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './bus'}}]}) 16:27:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = openat$mice(0xffffff9c, &(0x7f0000001a80)='/dev/input/mice\x00', 0x101080) r4 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r4, 0x1) flock(r4, 0x1) flock(r4, 0x2) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r4, 0x6, 0x21, &(0x7f0000000400)="f27ca0ab8219e12b6a0ec3913bb8af5e", 0x10) sendmsg$NL80211_CMD_STOP_AP(r3, &(0x7f0000001b80)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b40)={&(0x7f0000001b00)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="00022dde7900fedbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0xc010}, 0x68081) r5 = openat$pfkey(0xffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r5, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x2c, r6, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {}, {0x10, 0x13, @udp='udp:syz2\x00'}}, [""]}, 0x2c}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4000008) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @broadcast, @from_mac=@device_b}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:27:11 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x25}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:12 executing program 4: r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$llc_int(r0, 0x10c, 0x3, &(0x7f0000000040)=0x59fe2749, 0x4) [ 1326.503443][ T2852] overlayfs: failed to resolve './file1': -2 16:27:12 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newlink={0x50, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x2}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x50}}, 0x0) [ 1326.633479][ T2853] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38247!=0) [ 1326.643156][ T2853] EXT4-fs (loop2): group descriptors corrupted! [ 1326.683007][ T2858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:12 executing program 5: clone(0x54041bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = gettid() tkill(r1, 0x14) ptrace(0x4206, r0) sched_setaffinity(r0, 0x8, &(0x7f0000000000)=0x101) ptrace$poke(0x9, r1, 0x0, 0x0) 16:27:12 executing program 2: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000400)=[{&(0x7f0000010000)="20000000000100000c000000d90000000f0000000100000000000000000000000020000000200000200000002cc4645f2cc4645f0100ffff53ef0100010000002cc4645f000000000000000001000000000000000b0000008000000038000000c20200006b0400000000000000000000000000000000000073797a6b616c6c6572000000000000002f746d702f73797a2d696d61676567656e3338363633343038350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000d9ca5cac99fd4329af4dde786c1a5d13010040000c000000000000002cc4645f", 0x10c, 0x400}, {&(0x7f0000010200)="0500000000000000000000000000000000000000040100002b", 0x19, 0x560}, {&(0x7f0000010300)="000000000000000000000000000000000000000000000000000000001481910a040000001400000024", 0x29, 0x7e0}], 0x0, &(0x7f0000000140)) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) renameat2(r0, &(0x7f00000004c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) [ 1327.081284][ T2858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:13 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000040000000000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x4c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa, 0x1, 'netem\x00'}, {0x1c}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9, 0x1, 'hfsc\x00'}, {0x14, 0x2, @TCA_HFSC_RSC={0x10}}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x408f}]}, 0x4c}}, 0x0) [ 1327.207268][ T2873] netlink: 'syz-executor.3': attribute type 5 has an invalid length. 16:27:13 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000002c0)={0x1, 0xb, 0x3}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r3, 0x0, 0x0, 0x0, &(0x7f0000000040)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000000)={'batadv0\x00'}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x100000, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1327.472438][ T2881] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38247!=0) [ 1327.482012][ T2881] EXT4-fs (loop2): group descriptors corrupted! 16:27:13 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000680)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000640), r1, 0x0, 0x2, 0x400000}}, 0x20) 16:27:14 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=',', 0x1}], 0x1}, 0xc100) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001480)="d0", 0x1}], 0x1}, 0x0) 16:27:14 executing program 3: r0 = syz_open_dev$video(&(0x7f0000000140)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000300)={0x0, 0x9, 0x0, 0xffffffffffffffff, 0x0, 0x0}) 16:27:14 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=',', 0x1}], 0x1}, 0xc100) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001480)="d0", 0x1}], 0x1}, 0x0) [ 1328.877831][ T2893] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1328.926301][ T2917] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1328.957784][ T9524] tipc: TX() has been purged, node left! 16:27:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x381100, 0x2) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0)='nl80211\x00') sendmsg$NL80211_CMD_REQ_SET_REG(r1, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0x144, r2, 0x300, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x5a}, @NL80211_ATTR_REG_RULES={0xfc, 0x22, 0x0, 0x1, [{0x44, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x200}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x1}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x80000000}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x6}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x1}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xffffff81}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x7fff}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x1}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x5}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xc00}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x4}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x1eb}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x4}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x956f}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x1}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x5}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x4}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x6}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x40}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xe0}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x8001}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xf94}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xffffff46}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x8}]}]}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0xd1}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x2a}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x9}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x56}]}, 0x144}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1332.768588][ T9524] device hsr_slave_0 left promiscuous mode [ 1332.804980][ T9524] device hsr_slave_1 left promiscuous mode [ 1332.817931][ T9524] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1332.826528][ T9524] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1332.846088][ T9524] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1332.853911][ T9524] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1332.908491][ T9524] device bridge_slave_1 left promiscuous mode [ 1332.917183][ T9524] bridge0: port 2(bridge_slave_1) entered disabled state [ 1332.946987][ T9524] device bridge_slave_0 left promiscuous mode [ 1332.954175][ T9524] bridge0: port 1(bridge_slave_0) entered disabled state [ 1332.988749][ T9524] device veth1_macvtap left promiscuous mode [ 1332.995805][ T9524] device veth0_macvtap left promiscuous mode [ 1333.002751][ T9524] device veth1_vlan left promiscuous mode [ 1333.008626][ T9524] device veth0_vlan left promiscuous mode [ 1335.336595][ T9524] team0 (unregistering): Port device team_slave_1 removed [ 1335.352732][ T9524] team0 (unregistering): Port device team_slave_0 removed [ 1335.370790][ T9524] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1335.411531][ T9524] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1335.488592][ T9524] bond0 (unregistering): Released all slaves [ 1335.544815][ T2978] IPVS: ftp: loaded support on port[0] = 21 [ 1335.777391][ T2978] chnl_net:caif_netlink_parms(): no params data found [ 1335.900599][ T2978] bridge0: port 1(bridge_slave_0) entered blocking state [ 1335.907974][ T2978] bridge0: port 1(bridge_slave_0) entered disabled state [ 1335.920073][ T2978] device bridge_slave_0 entered promiscuous mode [ 1335.949734][ T2978] bridge0: port 2(bridge_slave_1) entered blocking state [ 1335.957724][ T2978] bridge0: port 2(bridge_slave_1) entered disabled state [ 1335.967794][ T2978] device bridge_slave_1 entered promiscuous mode [ 1336.041404][ T2978] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1336.073849][ T2978] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1336.150978][ T2978] team0: Port device team_slave_0 added [ 1336.182841][ T2978] team0: Port device team_slave_1 added [ 1336.250767][ T2978] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1336.258463][ T2978] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1336.285020][ T2978] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1336.317678][ T2978] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1336.326454][ T2978] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1336.343534][ T3114] Bluetooth: hci4: command 0x0409 tx timeout [ 1336.353695][ T2978] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1336.448499][ T2978] device hsr_slave_0 entered promiscuous mode [ 1336.460681][ T2978] device hsr_slave_1 entered promiscuous mode [ 1336.475208][ T2978] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1336.483148][ T2978] Cannot create hsr debugfs directory [ 1336.907667][ T2978] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1336.935323][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1336.945365][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1336.967127][ T2978] 8021q: adding VLAN 0 to HW filter on device team0 [ 1336.991316][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1337.001239][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1337.011018][T10209] bridge0: port 1(bridge_slave_0) entered blocking state [ 1337.018535][T10209] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1337.031200][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1337.053616][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1337.065604][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1337.075255][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 1337.082833][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1337.125380][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1337.136630][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1337.150426][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1337.160253][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1337.174014][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1337.192766][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1337.203358][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1337.239576][ T2978] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1337.250694][ T2978] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1337.270544][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1337.280274][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1337.291456][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1337.301466][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1337.316738][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1337.360161][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1337.368234][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1337.407834][ T2978] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1337.527948][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1337.539133][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1337.589797][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1337.599130][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1337.621794][ T2978] device veth0_vlan entered promiscuous mode [ 1337.638134][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1337.647410][T10209] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1337.676766][ T2978] device veth1_vlan entered promiscuous mode [ 1337.748656][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1337.760183][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1337.780668][ T2978] device veth0_macvtap entered promiscuous mode [ 1337.805887][ T2978] device veth1_macvtap entered promiscuous mode [ 1337.848127][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1337.860115][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1337.871063][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1337.881800][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1337.892513][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1337.903413][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1337.914432][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1337.925258][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1337.935996][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1337.947049][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1337.960100][ T2978] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1337.972651][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1337.982564][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1337.992616][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1338.002416][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1338.025081][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1338.037298][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1338.047528][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1338.058409][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1338.068925][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1338.080275][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1338.090915][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1338.102503][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1338.113067][ T2978] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1338.124984][ T2978] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1338.140936][ T2978] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1338.155078][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1338.165744][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1338.424946][ T8823] Bluetooth: hci4: command 0x041b tx timeout [ 1338.552891][ T1345] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1338.561331][ T1345] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1338.572453][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1338.682855][ T1090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1338.691903][ T1090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1338.713740][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1338.854269][ T3221] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1338.874347][ T3221] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:25 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8, 0x1, 'drr\x00'}]}, 0x2c}}, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000900)=@newqdisc={0x6c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x40, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xf263}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x87d, 0x80000001}}, @TCA_TBF_PRATE64={0xc, 0x5, 0x4bd3dc329856ae3a}, @TCA_TBF_PBURST={0x8, 0x7, 0xe32}]}}]}, 0x6c}}, 0x0) 16:27:25 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x48}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:25 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc, 0x1, 'ingress\x00'}, @TCA_EGRESS_BLOCK={0x8}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1f}]}, 0x40}}, 0x0) 16:27:25 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=',', 0x1}], 0x1}, 0xc100) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001480)="d0", 0x1}], 0x1}, 0x0) 16:27:25 executing program 5: clone(0x54041bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = gettid() tkill(r1, 0x14) ptrace(0x4206, r0) sched_setaffinity(r0, 0x8, &(0x7f0000000000)=0x101) ptrace$poke(0x9, r1, 0x0, 0x0) 16:27:25 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000340)) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x20, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0x4}]}, 0x20}}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={0x0, @sco={0x1f, @fixed={[], 0x11}}, @llc={0x1a, 0x10f, 0x2, 0xfb, 0x9, 0x1, @remote}, @ipx={0x4, 0x5, 0x4, "699c7be1c501", 0xf9}, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x3, 0x3ff, 0x2}) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r7, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x20, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0x4}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0xb144, 0x2f}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x814}, 0xeac99493280dcf61) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1339.198154][ T3221] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1339.457919][ T3233] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1339.654508][ T3242] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 16:27:25 executing program 3: unshare(0x2040400) r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000300)='/dev/audio1\x00', 0x0, 0x0) poll(&(0x7f00000003c0)=[{r0}], 0x1, 0x2) 16:27:25 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=',', 0x1}], 0x1}, 0xc100) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001480)="d0", 0x1}], 0x1}, 0x0) [ 1339.885509][ T3249] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1339.944341][ T3252] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:25 executing program 4: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000013c0)='ramfs\x00', 0x0, 0x0) poll(&(0x7f0000000280)=[{r1}, {r1}], 0x2, 0x0) 16:27:26 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e008067c082cb0600000000000011ec000008021100000000000000000000000000640007000900261b6c09000040f50f006400007a08000d00000000000a0034000202020200350000000000040005012c8f21440f9e5bdae7f167bf2a46176dac5205f5499df50d38896e36e1f5a63b5ceae8ed15"], 0x74}}, 0x0) 16:27:26 executing program 5: clone(0x54041bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = gettid() tkill(r1, 0x14) ptrace(0x4206, r0) sched_setaffinity(r0, 0x8, &(0x7f0000000000)=0x101) ptrace$poke(0x9, r1, 0x0, 0x0) [ 1340.358487][ T3249] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1340.502013][T10209] Bluetooth: hci4: command 0x040f tx timeout 16:27:26 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x4c}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:26 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000140)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="14000000100001acd0000000000000000000000a20000000000a1fffffff0000000000000a0000000900010073797a300000000020000000020aa904ffffdd00000000000a0000000900010073797a300000000014000000110001"], 0x68}}, 0x0) [ 1340.867490][ T3271] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.0'. 16:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)={0x18, r1, 0x703, 0x0, 0x0, {0x1c}, [@ETHTOOL_A_STRSET_HEADER={0x4, 0x1, 0x0, 0x0}]}, 0x18}}, 0x0) 16:27:26 executing program 3: unshare(0x2040400) r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000300)='/dev/audio1\x00', 0x0, 0x0) poll(&(0x7f00000003c0)=[{r0}], 0x1, 0x2) [ 1341.172523][ T3278] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1341.390075][ T3282] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:27 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000040)=@newlink={0x4c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x2}, @IFLA_MACVLAN_FLAGS={0x6}, @IFLA_MACVLAN_MACADDR_MODE={0x8}]}}}]}, 0x4c}}, 0x0) 16:27:27 executing program 5: clone(0x54041bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = gettid() tkill(r1, 0x14) ptrace(0x4206, r0) sched_setaffinity(r0, 0x8, &(0x7f0000000000)=0x101) ptrace$poke(0x9, r1, 0x0, 0x0) [ 1341.491884][ T3285] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:27 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="97c2eb24c226314401040000372400002d", @ANYRES16=r1, @ANYBLOB="0500000000000000004965000000080003006cf222eb127cbcdae28e30ecce13e8842574d7774c55172976e32c02bf15645f7492bb0aa3ad2e5c47fc48e13d52a61a8ae1626b7e5143ec0fa4d685c1a83d8350e4fb997d498161339167bc941396b427162e963d42f125cf04a1c9d6c80ddc860631326e64ca5d784fac92eda4f4a9ea255647d87f259686e75e87898c8b7bb6d91716a7440d98d0a496af41588069a3253d804bbbd5a48a3cebd0d817ae2d2b4307000000000000007640f73bb7671a0a9b8a898374ea89c09f4ed12fd9a4a9c787", @ANYRES32=r2, @ANYBLOB="0800050003000000159af1d723be3b7cb2e081439af25247e59b516aca603f6947c64e550402eb21a9c613041f1d6691b6c7922341cae25f572e343611b7a80be3b6da48953488b0831092b455e8c7143f3d394507b6ff6d3a0ac0b38ed63801bcb965847cfaaab4aa1bfba2cb55fa652a1a5c5cb20b2585749cc811f14dc0a0156c417e5a9c70c83e4c82397de92c013c688bb54ae220ada2603cb90bd88d2a817830d03e9874871be84b82b5a113ab6a65962035ceaba104337580a6e703ecb55f86d0b6867d4f8bd8b93c6d919f3cda98"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:27:27 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000004140)={0xa, 0x4, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x21}]}, &(0x7f0000000080)='syzkaller\x00', 0x5, 0xad, &(0x7f00000000c0)=""/173, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74) 16:27:27 executing program 3: unshare(0x2040400) r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000300)='/dev/audio1\x00', 0x0, 0x0) poll(&(0x7f00000003c0)=[{r0}], 0x1, 0x2) [ 1341.904508][ T3282] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:28 executing program 2: perf_event_open(&(0x7f0000000440)={0x8, 0x70, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:27:28 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x60}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1342.582397][ T8823] Bluetooth: hci4: command 0x0419 tx timeout 16:27:28 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@can_delroute={0x34, 0x19, 0x1, 0x0, 0x0, {}, [@CGW_MOD_OR={0x15, 0x2, {{}, 0x5}}, @CGW_CS_XOR={0x8, 0x5, {0x0, 0x8}}]}, 0x34}}, 0x0) 16:27:28 executing program 5: mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80401, 0x0) dup2(r1, r0) 16:27:28 executing program 0: pwrite64(0xffffffffffffffff, &(0x7f00000002c0)="1481791daa8c54a50dadee5fe2f4326f5470b9fbed8baf1eb0bccedcb872b2e5169d55af372ddf6fa38378e522293cf56aaa4cefdd80b172235cdb54bd9f5cca3919404dd57093fb9f962058be115d88628d888a6f14c6c2dbeaff51baf520e9442f5a091ea837b44a1079080e7cadf3fd69c90f7a6f3487609d135976a375fbed63d81ab652f253b93ff2d8595023302132717cd0d31e7982aa4abdc9be46b29eb4c0381563d0396ecb6d739e00d4e0614a4f29c5d289e7d4811034c30e6fe1619845f9dc60a5fd2edb6cdbf50db8150d06db16536f1585a847812de9c708063cb6c96072fad7e7499e7bfae7c02fd392a171f5f4064c76d870fdfb1bbe64a4b16575a175949ca61302efacb6e6a9a14f98f663a76b2ca2773d869309a97b40718cd78e954ebee44856227e11473386c843998a15a6c0f1d9394ba5ad46e421153880eb2d79e148350e809e7aefe31e97efb678510aee94efe1876cab2007db6c4d5b08f12afd8c19b9adad6755e6f70c026ad6bcfe29771d92d6c85e137f9815a630dc139a8d9b181765a57cb76e575a45910d51c7099a5f9cf5cc21ef84ace1a543033026bce58dc2e78303d1744520d8bf80eba339093b2b84d2f81afa7f940c664bcb9027834dfe9c6cad751a9567d6350d0acead669d4348ad5a50a929dd4c535e50d1584286e4af0ce233aa28b3df16051a7dd26512cb17abca2558a45aad8abc78aaa85f2142d5931b518c1046b598eb221b7ca092c861767d6d6c26f0db70afa014fccbde51d556fa91f3fafc392f2ccfcd5604ded999bc70648e19221aad64ebbba6193fa729c5d033bca23ad84819119295a87f7aaa5cac92b5f89f110c6005a5b0fb41dd416960dd905c4c25484993a148ad49e795661f193afd9562b2a2049b6ecdfa9578f9f19b08e94361950e5dc40cb0f7f46b2345d882a8719b93677de5c2a9307ff5b4de7e77e73a692fb317f6e897cf8d13a27923bab9757ae2dd2823588319b433924ea50ef7e95e1be1ba001787216057130f227108f840f0eb60fd2266a68f1ca1fd7e80cb5b4ec823326e4adbecd1a279ca29e648dd74182b68eab741307f3fb6ac9f05baefaad64f8f01917ce1327798a28a33eea98caf754cc718ab7bffa4578335827a2cccf2c31fb699a512607ebe1e039830b1c59aa126a7b49fa359d4817da03820ba930fa26b37317e893ca2458434d86d07b07abdadae38a8aa6f276142553304909675b4cc31472738c7714a13dc1d02e923b4de97518591036b65a7ad539f03412eecc749c48d4706453b253fd6bc1e22c34cc3883f0c42be7793e61328f719972713e4716b79b28bb8eca0d4e65ae435957121dd148302507d3a7bf75f1bc7bbe0509edc529a7516f07d92a5ce3e239e1a3b2e7b489b309e8706d4ca7d7acb4d8a4e42b36a9881039b5c3d91822b61709e52f949ee53d89dd455a54a3f6f06219df504cfa2f3f36cb55137d1a61f99c655f5a2e0b684df7a7d9e240ebd209ac4de9aba44f92eb6eec4acffa72c5f60c7802b429577f8208ac16d61f2c82b4b0fc8cbb41ff90cc76abb059ea6d54492ce4450874c139753c05fd0be9611451e23a09c9cd9294ecb710ce5a4ceaf7b24e0004515c8c9fc26790e1e6cdb07d71a3b184f84abee56646b9c28d60b3b6cc11def93d883efddccef300b0b58fc78f7f76bdc5d551ee78cbc69d43f78c821972aa48818892167ba90cc224d7e6542a6097dde04c226c1cce9e6e35994325db02a6e83543a4a20950a8ee96e2daeb78184342898f288f892250aab4bad4d25ec66e0f1cb277514c900f9503abb086965cb9f516aef32862365b177cec804f8e480037a1e2727260da8a047a0dddf9e08f7e137b0a2f83ea640d290ad477fc518dbb5c9fab76660d4460b66aa7e28f7bbaf90a35db1e053e5f12c3a378bd81109c027f4339ed73b3c46a971b13eac90333da593df88de8f788538f77248c9ffeeaad216e864f2d4cacb166469da512aa8f1d3c464cc626e0e86f8cd3d6f733788dfd6ba762b608ef9be3f1ea576435c26552c91fe0fb46d670991758f40306980a871298a0c8ec791fbe3ca1694accdb12d9f585449d0489f82011736299b672bc9be5c765648b8c4384e8d90ad33369edf1736cc19c79226db45b32945eacdda45d1f7b1d8ffcab70ab9f0be74a466bc1379c46337a1289f81ed9a242016ed9efb3cc02f7f7234d7a09f2c6e2ee3ccb4c5d1a25770c29d3cfd2532ed6e1b023c22320fb2f83e28dd2d46a65b2bc24b13a329f77c644fe76470a348f72da98a68590189ec4b04b8f1ba46d18477fadf32a6b52cc3d692cba7f197e142585d465689334774960dbe0af5235c06306964c3cc458c5ae293a9c38e78160b953ab1f1281c165adcc582f8d0f359c0069abf4750ab8ada703827f8b5c3dec47bbad62a6ba6b4de11a6072ec6da4f0ca1854f8d21440e02b45a5a399ee18899c510d0aeb272b5201d45f6c2aea06df33d01b6a24419420765acac2361602498cc19f5538d72efb9bbf6938157e6510c25bee1c445222f4dcfc08b8721def96987953b90619c924e849e5bb86ca33a188963bcf61cd9418356403f1dbd83f9c1a18b94f6234826dca29058a7cae794609c269d87704bcb023bf1d04ee7d99153a850aeb1f394f51ff27918e85dc0dd0400960e5507ab6b781ed2271ea33114998970df5f3621d353ebfca073483937be22f7663d37c0e3ea6cd5b3fedc86d1a486f5824078963f44c14267efcff42294348df56081cb79c73a30aa73240b2be59917a4806f44de29b1ab756da227751d710bee14cffe863cbda11f8d66be4c98d6a073fa60372d72f58924254f024a63eaf0b9c18177d781838b547dba7bdedc6775899679fe8f6e68f3a66a6380069bdc28404b801f70fe6d295d9d13cc76913d8f3e8a366fac3bdb9652876bebf48e1554466830b9f0db1ecd3edeb983d964b4f08f85b4785098cb0f05776c4a14a6f5d72a730d59143fa334b733ed7e10d94a6900e25868fda40106a8da07d89706f70f0dc22bb8f82cc01b189ad5f8e5fe1aed350992c8dbeaeb53a9c7bed0a0437d5624a530d878441688389d987b27a5da253489704773dc2895b2e14482e2fc67d108256a7013a493a8a6d89217ec4f3dbef54f620bb8c5cbf32164baf590a3df784a4a359b08b5bc7d5367058469ce7ab762774716731c4a7bab15b0c3c47d023a64403fec920f069e4db39d660ee09d9be1e1de97d1b34605842471143be47727bcda4103d8ffa68fec5c2e42448156b352abf135fd82a57558247763d917168d1c5fcf4471619536d0f068f485ba9ee502f9dae5da0e20158fec7f277717656a93d39ff780b544783267d891e3e0c0ea2bb8e6fc12d03537b60e1a3e8a35982b2e460588b5cd648d8dc9b901411e9b32a06e5ebd077ccb1cd3853e10106f61d6e452e3d44b312b2b70664bb89141cf114c47ed56b51ad56f3003852cdbc4cb78aca5d53c49aecdf8e399bad6d58a4d1682fcba5f8f061dac900499701bece64c13fdfacd84d797f312c496cf8f1a13bfd8806c09eff4b15cf09ba03d438cc5e0f599382b01dff1fd79879b82684a72847bddd77f3153526e8e1ca8c0fa426e92fc63ad575e0be3f179a82f9df9d4fb1ba72c1f202c8aaa1bfd8f83a45fb58d44c721aa7772ba23c502bee2c4fcafb88a877c97fcb766ebba5b1ff2b3576faa57a78470b2675d9a74934a685d04de8cef000cd12e65e8a9ebe396e7de2cbf080036acd757fb80fa93d5cadb90cfc8c4d6b665b5b2c39164b614f9b5ae8f5673e29bd0284f99254a09fa8d081875c560f05c98cb346c174031a2ddb05f5f8619f9855aa00296584f8ca21d819506252dcc5b050dd2e04bb576d3eb7152dccd9a5bd9aeb5b28c4f21364766fc7f6e35da1c55a6c5d5b8702a40bbd09436120d7037640859e44d067deafa8916c8e31db1fa6965e0ab082974a4dfbe0a7d7ecf1b7ba9e54eea23c5fbf8462134940f380063e15e6f661c2afe0556339ebf40d94d4566ddc728d5e907fe820313ed73d96defbc0f381d94bc36cfdab382a741feea1dcbc669290cbe05396df8850093f50b8c39851b4166ad621e99045ea4417b0549ca4210aa2e0b78954712d82c6083725bac27e1d5d9a1f652b84c2eb5a8e655e13685aa271358c734a77ded3b682d3c76db75b6025dba3bd9f679b4802fda30f4c4fb904beab18f73997a6f943f1f7145b26b56b3d3cc90069bbc5b0cca9e515c13608dc39f45d842408decb37178ff3aca376cbc2e576bf5bb85770deed00cbe6f397a1107e49b9ba706892578e11ebc7f515f0fff2375aded7fb6f18caf965d9f3ea22a5ad522583d9995df08cce69e786344ddf141728cfde0914f81f6841460dc2cf33db41d10c9ec032ed9539825c6d2e6b71d8646f8992340567939ba6289f53a3afd86bab0577535ebf1b48265fba2459a7d5e2c935516b88042018807f0e7dd7a4c499edcc7c8a157793d97ad76ea623d34d9267624cab637e2eec83a7d569f5490fd66f9119a112a646071dd5dce82618eff132253993044aa1385e3fa4b281d5ff72ecf235ed7b85ebcca3101952af534939c730981599c534820a7f18ac25234cd6065d0774d2bd58f7507c1c812505403fbec3cf63b7b09e45a9a0bf28705e278606682c49eecd24fc168573a6de72848163e795865e8ac91dba4161f54f5684faf18cb6e15bc17ba7bf163ac1183750f4cf644afeb72ada228bf4d2e15d02d1377b9f3f95f00855b13daba26b2e46368f4d9e15e22153b4a8afc2e20b734bd9a704081b0eb23742a3324c76aa04264712a996f61f3b4bb0d302b4a498d695f785772b489aac8b943656a66604df9a44b4ff50f6688e230c683fd8a3e1237263cd7a97938b72a104fdd8549b5743410c7cd40ac934153284e7e3ca4c6f88e1f9338811bd99ac43ab6a0be69158c8ecbc216c8d4820218346406957311405800ad28e385e1aeb91fc6a4cccfd35f9cf42b1f18b2fe2cf5112b70ac8d6bf026a91c38a3692931a3a9455a3510c1f4e5bf1e5256df3744cec702438564e7865798b8bbafb8e8eca5071dd78d0f6dd327c2f8554bd5267be05b68168e52f06fb0c84d528d8331625deaadddf2f7b9ea44289808333f6a064dd0911a82143537bac9fe049cdf6a849af75a060a4e8e2fb65733485ec038a278d20b88d2626a95fa1886ca68330541fc80a1aca88f8f267fabd105545345d92cbf3e57c64692538baec25c18e112946235c9eb4acf71f52fbe6c3471ccba8e3063cbb1677a83f071baca7724b6e27e3307abb479dfe96175ec4b268e97d45addc6c2be91a54690d8d86a9edd9176da7c56cb127c7fd54f743127244dae3c1990a7e70021236e27f0995a2430b2c42990568208ce7a0fcd7e25bd3f8c3c9a6edcb72f29558038df54ddeeed76b5b7f0a38b9234441b8edcbaea342bc53112843fee28c4c818d2c008f4225e26c32352506fd16fd7576441c4b4c43a8e83bead6c414447e8e57ebfcdbd88ff8af7dd57d99d91fa71bc811c6002df3c7df44552302cd3fe1d29a3849805074c13ccd5f5b9324efceb7f74ed0a09647d0f171e77ee9fa960fad6a4605392228bf94eb2465e88d21812edf977b6f3a39b3d770428cfacc0c5196a86a6b3ca2fadb621b7de035b96ef79d11ac654e3e564e685aa963a4137d6fec26d53c1ee43beda17429c13202c2c24f1f3403424275fae431a580a42d9c99dbb910d76b109d09d8565662ae0856c4ad797", 0x1000, 0x7) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1342.886576][ T3314] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1342.949904][ T3316] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:28 executing program 3: unshare(0x2040400) r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000300)='/dev/audio1\x00', 0x0, 0x0) poll(&(0x7f00000003c0)=[{r0}], 0x1, 0x2) 16:27:28 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x40000000, 0x0) [ 1343.405220][ T3316] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:29 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200960000000000000000", @ANYRES32=r3, @ANYBLOB="00000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=@ipv6_newaddr={0x40, 0x14, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_CACHEINFO={0x14, 0x6, {0x0, 0xda7}}]}, 0x40}}, 0x0) 16:27:29 executing program 2: unshare(0x2a000400) r0 = socket(0x2, 0x3, 0x100000001) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x79) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) 16:27:29 executing program 5: mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80401, 0x0) dup2(r1, r0) 16:27:29 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x68}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:30 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r1, 0x0, 0x0, 0x0, &(0x7f0000000040)) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000180)={'syzkaller1\x00', {0x2, 0x0, @empty}}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="24000005", @ANYRES16=r2, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r3, @ANYBLOB="080005000300000006000000e0ea5a4e03610e8bfdca46905b53223a48b5502148dd4edcef24b5585bf2fe15a7ff629b7c9b57b4c1e888ec9a56ca63550016f0a2542c4824b341b5f83f7ba8fb9f202aa79a3dfee7128d6eeec430b00ee46852e366"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x7c, r2, 0x5, 0x70bd2a, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x37, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x3c, 0x4, {0x0, 0x0, 0x78, 0x1f}}, @void, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0xe7, 0x20}}, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x7c}}, 0x0) 16:27:30 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x36, 0xf11, 0x0, 0x0, {0x3}, [@typed={0x8, 0x68, 0x0, 0x0, @fd}]}, 0x1c}}, 0x0) 16:27:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x806, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23}, 0x1c) listen(r0, 0x3) r1 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r1, &(0x7f0000772000)={0x2, 0x4e23}, 0x10) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000001500), 0x588, 0x0) [ 1344.589334][ T3355] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1344.664260][ T3358] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:30 executing program 2: r0 = socket$inet(0x2, 0x840000000003, 0x2) setsockopt$inet_int(r0, 0x0, 0x200000000000c8, &(0x7f0000000000), 0x4) setsockopt$inet_int(r0, 0x0, 0xcb, 0x0, 0x0) 16:27:30 executing program 5: mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80401, 0x0) dup2(r1, r0) [ 1344.804352][ T3363] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'. 16:27:31 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x6, 0x1b, 0x0, &(0x7f00000002c0)) [ 1345.137703][ T3358] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:31 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000c0080000000ffffffffffff0802110000000802110000000000000000000000800064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000000004000501000000000000"], 0x74}}, 0x0) 16:27:31 executing program 2: r0 = socket$inet(0x2, 0x6, 0x0) r1 = epoll_create1(0x0) epoll_pwait(r1, &(0x7f0000000000)=[{}], 0x1, 0xffffff05, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)) 16:27:31 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x6c}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1345.881405][ T3386] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 1345.890144][ T3386] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 16:27:31 executing program 5: mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80401, 0x0) dup2(r1, r0) 16:27:31 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='4', 0x1}, {&(0x7f00000000c0)='-', 0x1}], 0x2) 16:27:31 executing program 2: r0 = socket(0x18, 0x0, 0x1) getsockname$packet(r0, 0x0, 0x0) 16:27:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x10, r0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newlink={0x60, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc088}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x30, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x7}, @IFLA_BR_MCAST_MLD_VERSION={0x5}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6, 0x27, 0x3}, @IFLA_BR_FORWARD_DELAY={0x8, 0x1, 0x16}, @IFLA_BR_MCAST_QUERY_RESPONSE_INTVL={0xc, 0x22, 0x8}]}}}]}, 0x60}}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x412080, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000080)) [ 1346.125770][ T3389] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1346.192568][ T3390] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1346.270308][ T3393] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 1346.279545][ T3393] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1346.542764][ T3389] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r3, 0x2) r4 = socket$packet(0x11, 0x3, 0x300) dup3(r4, r3, 0x0) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0xb8, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x55, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x40, 0x0, 0x0, 0x0, {0x9404, 0x20, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1}, 0x8, 0x3}}, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1, 0x2, 0xb4, 0x68}}, @val={0x76, 0x6, {0xd9, 0x0, 0x12, 0x101}}}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x1ff}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0x1e, 0x34, @random="2b6b00a8968a7e938e6fd87f225578ce6ef7c24baf3f16de25f4"}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0xb8}}, 0x0) 16:27:32 executing program 5: openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x0, 0x0) r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/renderD128\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0x40187542, &(0x7f00000000c0)) 16:27:32 executing program 2: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet6_int(r0, 0x29, 0x4c, 0x0, &(0x7f0000000040)) 16:27:32 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x74}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:32 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='4', 0x1}, {&(0x7f00000000c0)='-', 0x1}], 0x2) [ 1347.479014][ T3431] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1347.499461][ T3426] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:33 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000000)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "d64d4d", 0x30, 0x3a, 0x0, @initdev={0xfe, 0x88, [0x0, 0x2], 0x0, 0x0}, @mcast2, {[], @dest_unreach={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, '$\x00@', 0x0, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x16]}, @loopback={0xff02000000000016}}}}}}}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'wlan1\x00'}) ioctl(r0, 0x8b22, &(0x7f0000000040)) 16:27:33 executing program 5: syz_emit_ethernet(0x2e, &(0x7f0000000040)={@broadcast, @random="f17e4b367057", @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @multicast1}, "c3af5b6ff52afed7211fe2b1"}}}}, 0x0) 16:27:33 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x5, [@func_proto={0x0, 0x2, 0x0, 0x5, 0x0, [{0x0, 0x3}, {0x0, 0x2}]}, @func]}, {0x0, [0x0, 0x61, 0x5f]}}, &(0x7f00000012c0)=""/4074, 0x45, 0xfea, 0x1041}, 0x20) 16:27:33 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='4', 0x1}, {&(0x7f00000000c0)='-', 0x1}], 0x2) 16:27:33 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') write$P9_RMKDIR(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x49, 0x1, {0x1, 0x7a3, 0x2}}, 0x14) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1347.975557][ T3426] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:34 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x4c, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ipip={{0x9, 0x1, 'ipip\x00'}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}, @IFLA_IPTUN_ENCAP_FLAGS={0x6}, @IFLA_IPTUN_ENCAP_SPORT={0x6}]}}}]}, 0x4c}}, 0x0) 16:27:34 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x7a}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:34 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c64c9, &(0x7f0000000040)) 16:27:34 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:27:34 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='4', 0x1}, {&(0x7f00000000c0)='-', 0x1}], 0x2) [ 1348.881244][ T3457] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1348.944084][ T3460] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:34 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x78, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x30, 0xe, {@with_ht={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1}, {0xc0b}, @device_a, @device_b, @random="69dbe6a8cfc8", {0x8, 0x85}}, @ver_80211n={0x0, 0x7ffd, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1}}, 0x0, @default, 0x8411, @void, @void, @void, @void, @val={0x6, 0x2, 0x972}, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x3}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x78}}, 0x0) 16:27:34 executing program 2: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000380)='Q', 0x1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x14) [ 1349.325718][ T3457] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:35 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c64c9, &(0x7f0000000040)) 16:27:35 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003440)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) 16:27:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:36 executing program 2: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000380)='Q', 0x1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x14) 16:27:36 executing program 4: r0 = socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r0, 0x84, 0x10, &(0x7f0000000000), 0x8) 16:27:36 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r3, 0x2) r4 = socket$packet(0x11, 0x3, 0x300) dup3(r4, r3, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000000000)) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x308, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x37, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @val={0x6, 0x2, 0x8001}, @void, @void, @val={0x2a, 0x1}, @void, @void, @val={0x72, 0x6}, @void, @void}}], @NL80211_ATTR_TX_RATES={0x28c, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x74, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1e, 0x1, [0xc, 0x1b, 0x6, 0x18, 0xb, 0x60, 0x48, 0x16, 0x1b, 0x5, 0x48, 0xb, 0x3, 0x60, 0x1, 0x48, 0x60, 0x5, 0x4, 0x60, 0x16, 0x40, 0xc, 0x4, 0x36, 0x6]}, @NL80211_TXRATE_HT={0x33, 0x2, [{0x3, 0x8}, {0x1, 0x9}, {0x0, 0x5}, {0x7, 0x5}, {0x2, 0xa}, {0x7, 0x3}, {0x2, 0x4}, {0x6, 0xa}, {0x5, 0x3}, {0x0, 0xa}, {0x1, 0xa}, {0x6, 0x1}, {0x5, 0xa}, {0x1, 0x2}, {0x7, 0x5}, {0x6, 0x4}, {0x0, 0x5}, {0x5}, {0x4, 0x2}, {0x0, 0x4}, {0x0, 0x6}, {0x1, 0x7}, {0x0, 0x4}, {0x6, 0x1}, {0x4, 0xa}, {0x6, 0x5}, {0x6, 0x6}, {}, {0x6, 0x2}, {0x5, 0x1}, {0x0, 0x8}, {0x7}, {0x2, 0x7}, {0x0, 0x1}, {0x0, 0x4}, {0x0, 0x4}, {0x0, 0xa}, {0x2, 0x6}, {0x6, 0x9}, {0x4, 0x9}, {0x6, 0x2}, {0x0, 0x5}, {0x7, 0x8}, {0x4, 0x6}, {0x1, 0x9}, {0x5, 0x3}, {0x5}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x18, 0x1b, 0x1, 0x9, 0x4, 0x48, 0x5, 0x2, 0x23, 0x16, 0x1b, 0x48, 0x66]}]}, @NL80211_BAND_6GHZ={0xa8, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xc, 0x1, [0x3, 0x48, 0xc, 0x48, 0x5, 0x9, 0x4, 0x9]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x7, 0x7, 0xf9a, 0xd80, 0x6, 0x9, 0x7]}}, @NL80211_TXRATE_LEGACY={0x14, 0x1, [0xc, 0x60, 0x4, 0x3, 0x2, 0x6c, 0x30, 0x24, 0x36, 0x3, 0x18, 0x60, 0x2, 0x12, 0x6, 0x60]}, @NL80211_TXRATE_HT={0x15, 0x2, [{0x0, 0x8}, {0x0, 0x6}, {0x1, 0x3}, {0x6, 0x1}, {0x6, 0x2}, {0x3, 0x5}, {0x7, 0xa}, {0x0, 0x4}, {0x7, 0x3}, {0x3, 0x2}, {0x5, 0xa}, {0x2, 0x5}, {0x6, 0x7}, {0x7, 0x9}, {0x0, 0x1}, {0x0, 0x6}, {0x5, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x6915, 0x9, 0x8, 0x9, 0x17, 0x80, 0x8]}}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x6c, 0x2, 0x17, 0x0, 0x12, 0xc, 0x1a, 0x1b, 0x1b, 0x1, 0x1, 0x24, 0x6, 0x36, 0x9, 0x9, 0x3, 0xc, 0xc, 0x12, 0x6c, 0x5, 0x48, 0x32, 0x48, 0x30, 0x4, 0xc, 0x16]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x3}]}, @NL80211_BAND_2GHZ={0x5c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x13, 0x2, [{0x7, 0x7}, {0x5, 0x2}, {0x0, 0x4}, {0x5, 0xa}, {0x5, 0x3}, {0x3, 0x8}, {0x1, 0x4}, {0x3, 0x3}, {0x1, 0x7}, {0x1, 0x2}, {0x7, 0x1}, {0x1, 0xa}, {0x7, 0x3}, {0x5, 0xa}, {0x0, 0x7}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x6, 0x5, 0x36, 0x2, 0x11, 0x4, 0x30, 0x18, 0x1b, 0xc, 0x60, 0x9, 0x6c, 0x30, 0xc, 0xc, 0x60, 0xc, 0x24, 0x2, 0x9, 0x12]}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0x5, 0x36, 0x6, 0x24, 0x1b, 0x24, 0x30, 0x36, 0x60, 0xc, 0x60, 0x6, 0x4, 0x5, 0x6, 0x48, 0x3, 0x1b, 0x15, 0x24, 0x5, 0x0, 0x6, 0x30, 0x1b, 0x30, 0x12, 0x12]}]}, @NL80211_BAND_2GHZ={0x24, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1f, 0x1, [0x4, 0xc, 0x2, 0x24, 0x5, 0x1, 0x2, 0x9, 0x9, 0x1b, 0x16, 0x1, 0x6, 0x48, 0x12, 0xb, 0x1, 0x9, 0x6, 0x3, 0x36, 0x6, 0x1b, 0x36, 0x0, 0x1b, 0xb]}]}, @NL80211_BAND_60GHZ={0xec, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x48, 0x2, [{0x3, 0x4}, {0x3}, {0x2, 0x3}, {0x6, 0x9}, {0x1, 0xa}, {0x2, 0x8}, {0x0, 0x8}, {0x0, 0x6}, {0x1, 0xa}, {0x1, 0x1}, {0x4, 0x3}, {0x6, 0x4}, {0x6, 0x3}, {0x3, 0x5}, {0x0, 0x3}, {0x2, 0x2}, {0x4, 0x2}, {0x1, 0x1}, {0x6, 0x5}, {0x0, 0x2}, {0x5, 0x4}, {0x0, 0x8}, {0x7, 0x3}, {0x6, 0x6}, {0x3, 0x5}, {0x6, 0x1}, {0x4}, {0x4, 0x8}, {0x2, 0x7}, {0x7, 0x6}, {0x6, 0x1}, {0x1, 0x7}, {0x4}, {0x4, 0x1}, {0x7, 0x1}, {0x4, 0x9}, {0x5, 0x5}, {0x5, 0x2}, {0x6, 0x2}, {0x0, 0x8}, {0x2, 0x6}, {0x6, 0x9}, {0x6, 0x7}, {0x3, 0x2}, {0x2, 0x4}, {0x1, 0x8}, {0x3, 0x3}, {0x5, 0x5}, {0x2, 0x1}, {0x6, 0x2}, {0x3, 0x3}, {0x4, 0x2}, {0x0, 0x7}, {0x0, 0x5}, {0x0, 0x1}, {0x1, 0x7}, {0x3, 0x6}, {0x7, 0x5}, {0x4, 0x9}, {0x1, 0x1}, {0x0, 0x9}, {0x4, 0x8}, {0x6, 0xa}, {0x0, 0x4}, {0x0, 0x8}, {0x2, 0x2}, {0x5, 0x5}, {0x0, 0x1}]}, @NL80211_TXRATE_HT={0x4e, 0x2, [{0x6, 0xa}, {0x3}, {0x1, 0x8}, {0x7, 0x8}, {0x0, 0x1}, {0x0, 0x3}, {0x0, 0x6}, {0x6, 0x3}, {0x1}, {0x4, 0x8}, {0x6, 0x7}, {0x1, 0x7}, {0x0, 0x2}, {0x3}, {0x6, 0xa}, {}, {0x1, 0x4}, {0x1, 0x8}, {0x2, 0x5}, {0x2, 0x1}, {0x7, 0x9}, {0x1, 0x9}, {0x0, 0x3}, {0x2, 0x2}, {0x6}, {0x7, 0x3}, {0x2, 0x1}, {0x7, 0x9}, {0x3, 0x5}, {0x4}, {0x3, 0x3}, {0x6, 0x8}, {0x1, 0x4}, {0x0, 0x6}, {0x5, 0xa}, {0x6, 0x4}, {}, {0x2, 0x8}, {0x1, 0x2}, {0x6, 0x2}, {0x1, 0x3}, {0x1, 0x4}, {0x3, 0xa}, {0x5, 0x6}, {0x0, 0xa}, {0x3, 0x6}, {0x3, 0x5}, {0x2, 0x9}, {0x0, 0xa}, {0x0, 0x7}, {0x3, 0x1}, {0x6, 0x2}, {0x2, 0x4}, {0x4, 0x3}, {0x0, 0x4}, {0x2, 0x2}, {0x0, 0xa}, {0x6, 0x7}, {0x7, 0x9}, {0x5, 0x6}, {0x0, 0x3}, {0x0, 0x8}, {0x7, 0x7}, {0x4, 0x7}, {0x7, 0x1}, {0x4, 0x8}, {0x3, 0xa}, {0x7}, {0x2}, {0x5, 0x3}, {0x2, 0x5}, {0x0, 0x5}, {0x3, 0x2}, {0x3, 0x5}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x4}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0x13, 0x1, [0x60, 0x20, 0x6c, 0x5, 0x1, 0x0, 0x1, 0x6, 0x6c, 0x2, 0x60, 0x48, 0x1, 0x24, 0x6c]}, @NL80211_TXRATE_HT={0x2b, 0x2, [{0x2, 0x1}, {0x6}, {0x2, 0x5}, {0x5, 0x1}, {0x7, 0x9}, {0x5, 0x6}, {0x3, 0xa}, {0x7, 0x3}, {0x2, 0x2}, {0x0, 0x8}, {0x3, 0x7}, {0x5}, {0x1, 0x8}, {0x2, 0x3}, {0x0, 0x4}, {0x2, 0x7}, {0x3, 0x1}, {0x0, 0x3}, {0x6, 0x9}, {0x1, 0x2}, {0x1}, {0x2, 0x5}, {0x1, 0x6}, {0x1, 0x3}, {0x5, 0x5}, {0x3}, {0x0, 0x6}, {0x3}, {0x5, 0x9}, {0x2, 0x3}, {0x0, 0x1}, {0x7, 0x6}, {0x1, 0x5}, {0x5, 0x6}, {0x5}, {0x4, 0xa}, {0x4, 0x5}, {0x6, 0x3}, {0x4, 0x5}]}]}]}, @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x7d92}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x308}}, 0x0) 16:27:36 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c64c9, &(0x7f0000000040)) [ 1350.775536][ T3562] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:36 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000024000705000000000000340086059509", @ANYRES32=r1, @ANYBLOB="00000000ffffffff00000000090001007072696f00000000180002000d00000003030000000020"], 0x48}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r2, &(0x7f0000000180)=[{0x3, 0x1000000000000, &(0x7f0000000080), 0xe, &(0x7f0000000100)}], 0x492492492492642, 0x0) [ 1350.836302][ T3562] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1351.034997][ T3567] sctp: [Deprecated]: syz-executor.4 (pid 3567) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1351.034997][ T3567] Use struct sctp_sack_info instead [ 1351.224648][ T3562] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:37 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c64c9, &(0x7f0000000040)) 16:27:37 executing program 2: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000380)='Q', 0x1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x14) 16:27:37 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000040)={@remote}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/115, 0x73}], 0x1, 0x3c, 0x0) 16:27:37 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x2}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:37 executing program 3: unshare(0x400) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) 16:27:37 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r2, 0x2) r3 = socket$packet(0x11, 0x3, 0x300) dup3(r3, r2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f00000002c0)={0x7fffffff, {{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1352.202854][ T3597] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1352.276113][ T3599] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:38 executing program 2: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000380)='Q', 0x1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x14) 16:27:38 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000040)={@remote}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/115, 0x73}], 0x1, 0x3c, 0x0) 16:27:38 executing program 5: sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x1) r0 = eventfd2(0x0, 0x0) io_setup(0x9, &(0x7f0000000340)=0x0) readv(r0, &(0x7f0000000040)=[{&(0x7f0000002540)=""/4108, 0x100c}], 0x1) r2 = socket(0x10, 0x80002, 0x0) io_submit(r1, 0x1, &(0x7f0000329fd8)=[&(0x7f00002a8000)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r0}]) 16:27:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9, 0x1, 'ipip\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_TOS={0x5}, @IFLA_IPTUN_TTL={0x5}]}}}]}, 0x44}}, 0x0) [ 1352.686732][ T3599] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:38 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x3}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:39 executing program 0: fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000000)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8}]}, 0x24}}, 0x0) ioctl$SNDRV_PCM_IOCTL_USER_PVERSION(0xffffffffffffffff, 0x40044104, &(0x7f0000000280)=0xfffffe00) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e0080000100ffffff4ece68e10211d80000000000000000bb817bfb9200f9d101c72a12360000000000000000000064000100630026006c09000008000c006400000008000d00000000000a0034000211b0753f286011721b19b717650202020202000008003500000000970c0c13ad63fa7841e09e55da585dc4e70e52650439d476ff9b524469948682ef99432eebcc524081542a2a6defe8846bae40f5defae0d7527ac3cef79919000000004315397c86a1d6bf004d8631e49cd108e64e72eb40cff2cc1fc2724bcb639bc4944bd680ff1ccf1edab6138014fcc44b90313bd35de45ce66bb3f06779bbb3e774249a5ce35ccc0ecfe8456604c5895ab4a1af165d22c97c0059d6f638171e5a1ed2bd1422d725e4163352cd462171063cc1c4ca8966774188a159e872dc4b6e7ccac3e2166f4fa54e956bf383540ce4513c85245bbae70ee76c379091a22e256299356d14fd31415763f066b2e29423db730a802a7893c154ab3b589c6ab4544419f5bc7c6bd7ee22973416743bce9232791ae0bb448db0a87b6d973696b0ff7011fc54756d4499b14753b5e368fec3e7188b98957423657d8e9b0b15d8a095918f9bbf"], 0x74}}, 0x0) r4 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r4, 0x2) r5 = socket$packet(0x11, 0x3, 0x300) dup3(r5, r4, 0x0) r6 = openat$ocfs2_control(0xffffff9c, &(0x7f0000000300)='/dev/ocfs2_control\x00', 0x40, 0x0) sendmsg$NFULNL_MSG_CONFIG(r6, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x1, 0x4, 0x301, 0x0, 0x0, {0xc, 0x0, 0x7}, [@NFULA_CFG_MODE={0xa, 0x2, {0x2}}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x1ff}, @NFULA_CFG_TIMEOUT={0x8}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_MODE={0xa, 0x2, {0xfffffffe, 0x1}}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x7}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x20004040) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f00000002c0)=0x8) 16:27:39 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000040)={@remote}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/115, 0x73}], 0x1, 0x3c, 0x0) 16:27:39 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0) read$char_raw(r0, 0x0, 0xf600) close(r0) 16:27:39 executing program 5: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000001000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000440)='sys_exit\x00', r0}, 0x10) futex$FUTEX_WAIT_MULTIPLE(0x0, 0x5, 0x0, 0x0, 0x0, 0x0) 16:27:39 executing program 3: bind$inet6(0xffffffffffffffff, &(0x7f0000f67fe4)={0xa, 0x0, 0x0, @empty}, 0x1c) mremap(&(0x7f0000038000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) mremap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000038000/0x2000)=nil) [ 1353.509210][ T3623] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1353.556878][ T3623] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1353.729856][ T3634] netlink: 48 bytes leftover after parsing attributes in process `syz-executor.0'. 16:27:39 executing program 2: r0 = memfd_create(&(0x7f0000000640)='\xbb\x02\t=\xa0\x9dY\xba-\xcf\x8e\xb1\x91^\x00\x00\x01\x06\x00\x00\x00\x00\x00\xfa\xe3\xa0\xf9=\xfa\xe8HB\xf7\x92\x00'/50, 0x0) pwritev(r0, &(0x7f0000000440)=[{&(0x7f0000000740)="359c8accd35e5da563d2e284fa49d6c4171511ac23bcad7105e7f508350a5f7070f463c663557f1cbb8ac4782fe9f89f71a8ad44701c093ad8a9162fc2fbddef39c8ab54b50793a90b65eb8e07640ba7e68e68ff1455b19a02de37d6b781aac3c5143b556e5942f23ce17c4070aae68ecdcb6ee9f25abdc55eebedadafdc95b0e6439a4d2f8fa32bcd89c937b546b6cddad6012bb1b2dcbcd3f48c3b14cbffc947177f56ee489f954a17b8f0ee2fd227eb0cdff307224cf3eb7fb6659c8197e2da83aea5e4c9003541884fcdd71baf4082d4f7a317ac4aecb68d290e385f8afe070122836726a2fc44d27b0d79b82b45631a091e715c271d5c201e8b7c1e632d4d0bd6d7a58265378d07e72c0aa982b20611a8651bd21de469bd3c30f52ad28bdb3207eb89f637b9d0d7a1b0b77ae1621042eb0378ff8323e6995221e5036aee2e311058cb5177f86ee30adcbc8d7f813201c0cf2bc2e43aa3b10e76c2b96953af67870ad6c4dc0cf1fbf4ef96efae69780ec5b952d3fdd495f101969aad38c55fe49723320aed47a2f0e6b9ae076eb0a92a1d8a6ef508a1bf90685ead290470669eccebc028233f6679f1a2055d7154ee4e631aed96d21d08016693910d90048655dff299cb6fe78bd3349781503d14c8e171e31c4317b938c481f5f320b9a1f2aa645ba9e7f5b969f106416f458679629e34aed6b5ca23505157c9154e2f20d9c376daae09847c65e968a0b41a57a84d50e0e4a74844dfc04397a2a8cd2afa0312ab1837fb92ad13a3cccd34cd32a8bf5e532cb8f76837ada19e6e7564789f54a68643aa43916cb7695695d1e38daef961d69daa52160b09b277002be2beb41ebdcd942d8967470c853509bf997e8169c014abc78436e1f4e60429faf6601e5edcd5280fd1f0b85f5a693080934da96d0c2807403c44c6f0b91fa8b58bf7a779547ed392029f1306aa1f6fc3b8d0eaffcf9de14171c2251d9d50a924b021376829a4d17430890ffe8441d63d789b5dd0f43fd14c5791ced27881e37416002357622fa173bf6fe54302fc363ba9ed9377f3d6160d86a4c8adf52c1b0d6f0ece90e1f522f7764b143b084145f9e8761b2cb8b77dfdfbfc6ffc1b4f04214bfc322bfcf6c5ada87d85680f106ebd570daccefbb6c3c582e7493b3db2042dbecb3aa9e1e2ba525af3ac0929ae1826a0aadbb95ec4f7a0d160ed8cd5f5d3b33511dab9d0397b1f108aa313f1de81aaad94c4c5c622e9664b6ed10449b62b33922459b471ac9da2fe3d06b89697bca4dc5870604ae04d2893f5d652b17c4f34eb817bdb7d65f459b734b2aafb96db36350d2aa83924a995763c42c51520e1292c0c7f5286da74a51d7db421118de698d21999452ee3f7a471051e00001bdc84763efb41671871db3a9e33beb93230ebe2c7a94d75ed9d967c612e75ab60a95f3f1a543144df963e30c60a429f9832787ec3fd1df3fce3b9c9945416a19bd35389ecfc700baa51496ce2874330b2d1545f5fc4139de01309c561b549e904038e77f9ff57335660abbb3b513a427e224ab4372dd8de90b8701d7e43fd60f2c36756c0839e2f397300244ec5d7f475a9ed0bdd5f2a9ab4e0c363ef4be7aa93864ed4a898d771df5ae4f8f98174d117eaf8663ae3b7079d65940a35eba757040c201c7bad17e68d8a91baffac40a9474d33c1997bddb11a104670c33e6421fbc1bef4e92be776cd5133fdbd49c8fa1ee07aa8ae75406632a1f8dbff719b263b88ddf8f077761a56f2c99429647969319c6fd120ac086a6f59ad1f008fecde61e8bbe28a40fecc487f9f359067d8951b2361302a1924cf2520070156e3a89348bce299b52b27c2c5711342d892d95777d94beee6bcf1b0dcf7a9da3ab500c51427e75582b727423e53d378aaa5b7451f40ad7b0a71f32d4a64e64f84e946675d8b915982c80fce01872fbb32b94c3ea6ebabdd71ed3c56ad366ffd944be127f897f5e93d095b2160628840e8575bf71850de5c8177938d34a4dccc4235bf27d644a8c4a0e4c59ac2f0c088b63f14556f2aadcbf7340bdbde2e5cf1a88b81357cfa83449b534b162d3a20d113d62f42a2a56f53b9aff20a5f349da1cec2927e2552729f0162e7ed03d4a036e2b70732e2df64356951c156687f85be6b7c15f5b96687f04cfb296e5ec910e2d2aa8a82ba981dc90c327a2276ddf5dc78557cf97645506db07ca0fe43cb3e85b578f5367ae18efc33fb5a0ab969e21861d993f433fc4f89ea28240a22b831470ef96f33f5ff09afffd02c14e0d5d034a7205018ef7f80c7d03cb5d2c38895ac5ac689df99d50a54569fbc0cb1ba51c30f485be711f97598dae2f8e6a8f7a35185d77b94f84df655ae51a63b346928eaf632415ffba7c7d75cd8abeaede060181d7c773e4920f8e0f279c25653320d3fccb49f0719d6816e4e9664444ede52aab78080f7df6a0661a3c6ee00f7f19d0f1cfb81c2c9f17a17eb9021d164442d96234393a9691eb8ac83b969855398dfd521890e0c3f03fbdfe380384fe0f939846bab255c43ec28206c2aad447ea539d42136cc8544788c07f4f4a94874a9dbb32540509bdaf0edfee3f1e2d2a03ba73df7519e30be57da7f73a915b0fd82fe0c7dda43c590a2cd7035f3939463d0d832d7fbd7d01bb0e293f0fd9c7593800a609b80b56b3b51b0aae1f40cdbf3cb8aeb900259d29c7c6fc0807e61817dc4fc2a56e89fd2c05de85c55cb92d5dd51d2de07859c90bbe0a2790cd594e58f08e2d28fad7860a0a923d2484f05f54ed42fe40264e4d4cada797ba80147c3dd82ed3ff818f346f3c5b3f35b8aed127bbedbe7f598a7798ed453436affe84e638031866777f39a13a74efb8e7f1e567640106fcce26a69ee11e2599148532c751321961536df7e37eccef314ee5c167d3ceae110ede1a157c630c474b740da7f9e774daa50796f2bb3cc46b6e7fe087c114aa975b8bf75ed4c8fee61cadee6a7407289f5ff838110228d44d035007e308341698893d0fc2c18931a6b5f61f15d74b2aadd617e9269397aefc66a201353895d82b518792bb08cbe602781f24fa631503f648639d4b42b78a2bbda891beb60dd5e03eaddd3cf10e6d2847ad6b48d0e99e1d776b9918fc48fa14939e975ba5f3c89f3dfc567e02171f30ffe22", 0x8c1}, {0x0}, {&(0x7f00000004c0)="d4", 0x1}], 0x3, 0x0, 0x0) [ 1353.963768][ T3636] netlink: 48 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1354.018977][ T3623] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:39 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000040)={@remote}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/115, 0x73}], 0x1, 0x3c, 0x0) 16:27:40 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f00000002c0)={[{0x8, 0x1, 0x81, 0x9, 0x96, 0x8, 0x75, 0x1f, 0x7f, 0x1a, 0xc0, 0x3, 0x400}, {0x4e, 0x5, 0x7, 0x33, 0x1, 0x20, 0xe, 0xda, 0x81, 0x7, 0x5, 0x80, 0x9}, {0x5, 0x5, 0x1, 0xff, 0x7f, 0x1f, 0x9, 0x3, 0x3, 0xe0, 0x9, 0x85, 0xff}], 0xbc0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:27:40 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x4}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:40 executing program 3: futex(&(0x7f00000000c0), 0x8c, 0x1, 0x0, 0x0, 0x0) 16:27:40 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="340000001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000009000000000014001a8008000400000000800800000002"], 0x34}}, 0x0) 16:27:40 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x40, 0x0) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000040)={0x800, 0x0, "e8ad59dcd610369271d94542efcf83e49394cad6fc83e7f8"}) [ 1354.896893][ T3658] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1354.988969][ T3661] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:40 executing program 4: syslog(0x4, 0x0, 0x0) 16:27:41 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0xf, 0x4, &(0x7f00000000c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x19}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74) 16:27:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x7c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2d, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @val={0x25, 0x3, {0x0, 0x99, 0x5}}, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x7c}}, 0x0) 16:27:41 executing program 2: creat(&(0x7f00000001c0)='./file0\x00', 0x0) clone(0x3a3dd4008400af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) 16:27:41 executing program 5: syz_read_part_table(0x0, 0x1bf, &(0x7f0000000080)=[{&(0x7f0000000000)="02010f00000001000000ff07000000fffffffd000800000000000000004000ffffff8500000000000000887700720030b5829237c300000000000080000055aa", 0x40, 0x1c0}]) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) [ 1355.415167][ T3658] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:41 executing program 4: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x10}, 0x10}}, 0x0) 16:27:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x5}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1355.854644][ T3676] NFS: mount program didn't pass remote address 16:27:41 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x1000}, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0)='nl80211\x00') [ 1355.908885][ T3679] NFS: mount program didn't pass remote address 16:27:41 executing program 3: r0 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x3, 0x2) ioctl$VIDIOC_ENUMOUTPUT(r0, 0xc0485630, &(0x7f0000000100)={0x1, "9b5d3807f8f503227adbfb0427e9ea077293eaf716aed1711e281bc9d0fd2abb"}) [ 1356.095315][ T3683] loop5: p1 < > p2 p3 < p5 p6 > p4 [ 1356.102754][ T3683] loop5: partition table partially beyond EOD, truncated [ 1356.112003][ T3683] loop5: p1 start 1 is beyond EOD, truncated [ 1356.118692][ T3683] loop5: p2 size 1073741824 extends beyond EOD, truncated [ 1356.185241][ T3693] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1356.229318][ T3690] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1356.327337][ T3683] loop5: p3 size 2 extends beyond EOD, truncated 16:27:42 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180)='nl80211\x00') sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, r3, 0x10, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x45f}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0x4c010}, 0x4840) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r2, @ANYBLOB="08000200001000"/19], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', 0x701c00, 0xb4) r5 = openat$null(0xffffff9c, &(0x7f00000003c0)='/dev/null\x00', 0x145102, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r4, 0x400443c8, &(0x7f0000000400)={r5, 0xffffffff}) socket$alg(0x26, 0x5, 0x0) [ 1356.397749][ T3683] loop5: p4 size 32768 extends beyond EOD, truncated 16:27:42 executing program 4: syz_emit_ethernet(0x76, &(0x7f0000000080)={@broadcast=[0xff, 0xff, 0xff, 0x0], @random="f674049167a6", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "35f1fa", 0x40, 0x3a, 0x0, @empty={[0x3, 0x3c]}, @mcast2, {[], @pkt_toobig={0x3, 0x2, 0x0, 0x0, {0x0, 0x6, "0004e6", 0x0, 0x0, 0x0, @remote, @local, [@routing={0x2f}], "000022ebffff0200"}}}}}}}, 0x0) [ 1356.470677][ T3683] loop5: p5 size 1073741824 extends beyond EOD, truncated [ 1356.536560][ T3683] loop5: p6 size 32768 extends beyond EOD, truncated [ 1356.634649][ T3690] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:42 executing program 3: syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000a94bf240c80a02c03784000000010902120001000000000904"], 0x0) 16:27:42 executing program 2: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8919, &(0x7f0000000000)={'team0\x00'}) 16:27:42 executing program 5: perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpgrp(0x0) setpriority(0x0, r0, 0x10ffff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001f000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000280)="3e650f0d8c4c070f20c06635000001000f22c02e0f00100f143dba4100edba2100b001eeba4300b80f00ef0fc732b8bf0f8ee866b86e0000000f23c00f21f86635020006000f23f8", 0x48}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$RAW_CHAR_CTRL_GETBIND(0xffffffffffffffff, 0xac01, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) 16:27:42 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x6}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:43 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='stack\x00') read$char_usb(r0, 0x0, 0x0) 16:27:43 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="05000000000000000000060000000886d8b8ce846449350e1a86172a2a2955d52bb79db71abed3ef2f9c753aa602b27ae5f9250abf75ff5e30733c2845d3220b4caa1c0400c442fc897e84fe", @ANYRES32=r2, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x3, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000040)) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYRES64, @ANYRES16=r1, @ANYRES16, @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) [ 1357.498188][ T3731] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1357.550801][ T3731] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:43 executing program 2: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8919, &(0x7f0000000000)={'team0\x00'}) [ 1357.682430][T10209] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1357.805859][ T3741] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 16:27:43 executing program 4: setrlimit(0x7, &(0x7f0000000200)) socket$inet_mptcp(0x2, 0x1, 0x106) [ 1357.914392][ T3731] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1357.939612][ T3738] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1358.055503][T10209] usb 4-1: New USB device found, idVendor=0ac8, idProduct=c002, bcdDevice=84.37 [ 1358.070560][T10209] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1358.218970][T10209] usb 4-1: config 0 descriptor?? 16:27:44 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r2, @ANYBLOB="4826f73e2510f38f0aedb971b62b2ce264fc258e0edf0095fd22b58cf072b35222c3f00f2d7fe929d06cd50f4638af592de5afba8ff7836739db00"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) r3 = syz_io_uring_complete(0x0) ioctl$IOCTL_VMCI_VERSION(r3, 0x79f, &(0x7f0000000000)=0xb0000) socket$tipc(0x1e, 0x5, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000040)={0xb7, 0x7, 0x3, 0x5, 0x2}, 0x14) 16:27:44 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x7}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1358.321387][T10209] gspca_main: vc032x-2.14.0 probing 0ac8:c002 16:27:44 executing program 2: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8919, &(0x7f0000000000)={'team0\x00'}) [ 1358.482156][T10209] gspca_vc032x: reg_r err -71 [ 1358.487443][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.493278][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.498834][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.505682][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.511486][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.517749][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.523624][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.529176][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.536128][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.542686][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.548790][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.554844][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.561470][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.567924][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.574327][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.582761][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.591887][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.597829][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1358.604154][T10209] gspca_vc032x: Unknown sensor... [ 1358.610029][T10209] vc032x: probe of 4-1:0.0 failed with error -22 [ 1358.727336][ T3761] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1358.776914][ T3761] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1358.844375][ T3766] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:27:44 executing program 2: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8919, &(0x7f0000000000)={'team0\x00'}) [ 1358.937657][ T3763] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1359.005480][T10209] usb 4-1: USB disconnect, device number 15 [ 1359.161051][ T3761] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1359.457076][T10209] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1359.822302][T10209] usb 4-1: New USB device found, idVendor=0ac8, idProduct=c002, bcdDevice=84.37 [ 1359.834169][T10209] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1359.865163][T10209] usb 4-1: config 0 descriptor?? [ 1359.908090][T10209] gspca_main: vc032x-2.14.0 probing 0ac8:c002 [ 1360.112204][T10209] gspca_vc032x: reg_r err -71 [ 1360.116965][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.122611][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.128746][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.134386][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.140135][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.145719][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.151631][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.157159][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.162902][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.168269][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.173850][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.179451][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.184978][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.190586][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.196116][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.201466][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.206991][T10209] gspca_vc032x: I2c Bus Busy Wait 00 16:27:46 executing program 3: syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000a94bf240c80a02c03784000000010902120001000000000904"], 0x0) 16:27:46 executing program 4: r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x2a, 0x2, 0x0) getsockname(r1, &(0x7f0000016d40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000016dc0)=0x80) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_ECN={0x8}]}}]}, 0x3c}}, 0x0) 16:27:46 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(0xffffffffffffffff, 0x111, 0x1, 0x81, 0x4) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x20, r1, 0x400, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x9, 0x35}}}}}, 0x20}}, 0x0) 16:27:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x8}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:46 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'veth1_macvtap\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r2}, 0x10) 16:27:46 executing program 5: r0 = socket$kcm(0x11, 0x8000000000000003, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000001640), 0xff5f) sendmsg(r0, &(0x7f0000000440)={&(0x7f00000006c0)=@nfc={0x104, 0x8}, 0x60, &(0x7f0000000140)=[{&(0x7f00000027c0)="11840200900d08233e496d5671dc71ff04291b2c1501772502bb867063f70647862a15257781bcf1d1e498104d082833914ee68afc14ac7cb85975751b8c31271948ee303aa2a34be964b8c1b95638607b2e7ec7fda28fea4caada028a39bf259538214e80b9b5c9b58b1cb36a933d64a25324566f7733ea93fc91c98fec268cb1e2148198e2ccf2463d2ae56c61ac436c336b2d421c6b512a600955c6ede3e5820165eabf2dda9e2294300485327a6d28f7913f19d79e5f478626bb6a607c2f5085c68749edc417da6cc4db8c605215575067836f62b0b3e0b49e8c321240c1b1b54babad07a7000c4eb99200b9d016f1554683b7b3323ab37f066b973d584345792feba5b719ec0413d1c37689ce927de538b4ac16687f6595120220e5205f79227e43a8eaa610c8c232bcb811b4a63eab1b87da214700408e830774dcd6318bec9ef28b9171b0492bddb09009a8d26f797713d81548e0c547b8aa7bcd844c2cfa69560deaa6188b576792cccdc09a1f94da4e4c4f05e4d053d6a2fcdb253dce696d6cd85a1aee740c2a84e3d63aa558d3db42531e2303c6e8cfc0b6e31950fcbf3021f708d47c05edcf3fcdd66226d99f1f132d73f698e0820c395f343e0d69042b6b06bf40b45ea6a8f52a32255f3c40d4e9fb93084421a6235116be29125e5afe2d8c418cedb2548db2fcade80c118af8a6be1e650517519721a5920f842662aad37473f2ba60f7ee8466f8dba829c3e17d3e618ef5768b1b0a8991c64f2e592e726bb4636d13fbd04ed71b031e1c1a27fe30325e521a9845ef1abae620cefb216c47a1e3b4db8cb1287006b9fed827fa5a944b8045a3397ba4208c5cb67117393b2f836e4e79196e05ebd7488fa76619ea0521982b9cb76a63bed4f0ffe48ceb4b2bbe4e590dec80eca4740027f855dad06313a2a0188932a2069fc70b8af0e4294a7b51b552ad72ccd5625fd2a971354bad2930eec5f41e0ae271224b8a9160d96965d372c65e4a0adcee1e8bb84406b6a5c5e4d6ed7ff529afdffcdbea58f43e7c39f8aa9845fc92c84aa8bc0eef238d19b2cd3dd0c6d52694c99f2f493b7064076b62d139837eda3d11e43ae52fb771c1585974bcc6e2adb24096fd3d5ac867afb9cfb6ed07cb34e227f00ed5541499d2e7e3b4f3da831a3b9c32de8be0f5b45e8248b5a2811bb452ca6dc7d56d87531347ad316e6e8c6bf887f70f455cdeae8dcfff004b0ed1b8fd63d1d5e55cbdf1541b87821f3c90f7d47e542ec75b132f5285862d3e9fd84f841e4d137e2735d5f23c87108bcaa591a14ab2ab43802ffb176453312420fe0e79af7236850104bc3e925b16fd0a57ee9959ae8ccc13c843365442bb462d86ead8a20c41e064e0ad286f4aa4c69d0046e5012cecf425b0df11c0b458e31804d8ffe98554afc69b475ca03cbe926806b276e19aa47b3e101b95ee2fd32b9f06a3fcf6f078ce694f9ed8fe03425446bcdd0e7c1f4d3e109bbe30020cb81b64bb0cdfd8a0d33e1143c4fbb7fef15d1059e1f20b394f69d482a1da5fd49508808c80c824a843698386b4d3c3885f063aa3c047624f93298040fbc706020d295cf3f363d42f21d327d91d101cc4758c67195a49c3b3002e14cf28a5b8899b7ef08b6713d89c7049ef594361b1d8a0c5838ff30a6a3f1b0f9f947c76d5f1629d3df215975b498bd33ddbc44798a9f76ba0c41e9ad565e44ebf3c333fade1d4306b1042c5e2e855f3e5fdcd64ce7fdf73b09044bec8a2f0cecbb00c6c76c85891478aa4bae6282541cff613f2b461cce115ba0b78c6f50f4593efe5c2ae558f6c0534db14d5b44416b08abe45c6ddf5c749aae8141e427a0a2f42b903ac71caa09e5098cc2c07d79145c7408415d8f937108d6becdbb38a2b3250c0fdf36297375aa3212c9bc8483e8d629c54a79ca55cdda720496753f27fd9e88e203594c1e28514e0d22b9c34c3e1f10253217abed40b09a533fad16c7b9b8e89d7dfd3b27d579bfc813ad2895543ada10f886c7c75010bc70345b727513fa3b7c6aa677a22e037e2bd7731148996f3a8c424075fd12aa8eb9d8f6a8fe7b2eb68934799f5063c58c1816caa4b400bb0914fc7300111c063e5c01910b0b01803a1a348f387542236d82bef6d926ba571ca0e7745e586eddf2334baeafd7b1149502e781ec45299c3f3cd34c3628057def3c012878123224e33828b216022dfebdc6a284e503868a1e4369af819fcfd4124d801386dbb123ce88d54712f6351c77aad6039b2f5ff3d0d1903c74043864fa9f801847ac8446280a31739e0215bce77c08c2477e9079f62225cf179da445e9f220560d995238f17e87dd4ce0f7ebe5f8941d5d130c2d6398e08bb893b5dd8e58701e41e75fd0182d3ebac8920aad7f4777b4e096eb5c5a17e440c0a5b95ca92bbaec63130bbc41d0cbfccb03eb6c1cffc8558bd255c2096a285346dd9600f33554acf62aef19d2776bd5d8a5a9f0a4976022b8ac1400e3f0a7fa227ebc0ad80187939562492154c708739f865a9803512a6213d5026b1febd0a20ce4b3a4d7d90dc5af3f5beaa06b8af1d19556655ac578f9266f5d3b393f24a2d112eee90f749e1f0a6e27ff2469f1cc21d5bcbf355168c62044fd1cc4861544a8175f640ad3c5bb6c81efa331822efb70b57f4110deebe68794211ee4a95c259b4eb519d887b6cfdee178758382f4f63c80b1f0b9f2337dd5a11a5b1fb04c3315ff942cf7f5d7da36c088a65f86529d003c8c9bf74392f9d897b53a422cb3b3f9e09f9936514ac100fecf3c9a573aae041ce3c86cce6dc2884053bc56a510791392bda454aa7dc580a3a7cf71c18dd57bec21c0eb143deb654d8b0fc642bbc7484dc9943c2102169a6aca278f0fd81b1b6b082b355443c8198284e3b01e9fff1c8df1895e9c9593f16438c7f737f2ab56c0f57eadfcd570c5b04b5218fc7d2c0cdca5c7ba5ff428b4fe541d4c8f6fe274d2a3290343f3d6944c918571e350caf2ec3cc9601cd5b71e8f22ff401024c51c592bf476f255b200962e2ed014ce551376235e8d220763f8c9c904570d6b6227c94d62e08b0c9bd3557b96c8ed227685fc54d43e4a05ca5996c4d8e3e5076f394b0c0bc7cdf972f996c45987ffb2d6a138a1772b7ffbeaa66ceddd34839051c61f9d87153f23823f9178b56eb016524ba862cdca9d147b5bda79553ade825d5a1b8ea3acf8c7cad88cd11b68625d367931b9a0296b228fd2c52da32d050d746942fb38dbb3d5e2ad75b7243f7340a8c0d4c7b156e030b6eb154ec6c47c1b6af307ea0e8916e21166572632321f8b4978ecd1f8b4029a6baba4da2dd984d245d1b6dd4a6f2a72acc4d90f480de489826130dd7b2a9ad79938ed6de65c7a56e0515d84302a8a8ee98c20ea32db20b231b9d00e03dd74b804e15c70ce8a6b169ffa79db7e24062b2dd3560502337bb03c8506a25ce77eaa06f9fb54aff0bab9545c32bb9a35a700361f46a3995ef929af7698bf16df9d8965f4d939f5dba6eb238c1089c25617568b29760ecbfef273b8070c3853a652d30da91cb00e0afa1c663589158711984cfe38869974c30e9b51333091cb0f5d72f5ddb0f3bc550b2787ff6fdfe0b90764f8ec319a2674d6e16ca2417b7a2144b5a4ad248fc4b2b8f74ed1957bd4f52f0db0ac4eb8f6dc62c51e16a803bff507359abdbd0ce1ee0fb936a4a060954c1a939b4b197b61311d079ef09e57e60f94fd796c12cf7e62e11bbdc11e04fc79736e42d6d2dcb02e705dc4e8e17addcc0902af4ebbf0a2f57db53cbe99bb0797137c903195de282ed02c37634181936e351f383fb590eb453e539b80c6935185ac40890c1ba70b5e2eb53235f3a983ce4608929d2609354f89fc22f80a0aa9fc0ea9af7f06e46d8b5f5d47dbd2efe1f2d0f4edee09f11b57c257ff5ecfe96ada3c5f37e1d766c5c85490d14f297e1ce65ae34909f04492e7cc955faabb205491a096147d0930ffa70b68055523e360328f26f28ff160cdb8b4785a22110191c9ecfd187267c1a4300e9370a41c73fe224f3a9c54493780b1a4ff96398f0a60f66e48ef4ad7183f71c0c4d6d9d1a57e19a56d9ed426cd4143de82ceb33011988ed079b52ab30300255e066a84959a10676c7b58515ff9bed194c784072af1062734f5d497f2be9b0ea1228f5a981e8d5d78da49da90b040d4e3a93b7f71360b25cf75fca36a4068748e1bc171dd40fa31d6f9c4c926a635f4ea4faf7511146bc5782606966aaab13a30d67cf182751149f678852da30d0f9b6ea5524a1f5ea01e77d7a74ac588ab2251cdbc9f4f8aa2cf367f0ad2178e66fbd7ab447aae12a7bc6cf3925fe99dcdf8ec95cf4576520b781dc12fe6d310978315d2e3d7dbc49c9be2fa40788ebd5fc02c6c7f566a64b7f4af7a96353265dc9e4c74c909b9a385966f4d7312fdcdfa8f5d0632c6db4a19ce696416a04e937d4a994e757eae59c07e5d3228254b35003eba32ed448516e9aa77b5b92c9ce7fff06a8f4f652d27971a46c621a6b2ee3c1adaf60d5cdfb381a4e4ac9ab7d7d72fcb2d6aa7e104255345f1e15dec8299c9c75735a01338d20f72d8b359803becef76d9ca6da029d0a795e6d4a652bf3880efeee074c81774b2971da03eff6d9516ac8a0c34b686aa1afbcb2befc79618a3dbb2bcd53da0075cdba0ddd975fd4e833291005f0fbf7b167922dc85b109e1381431e0fdc50f80b8592edd57f50f9dd950205e1a21cd3026cb30abe6d06dbec6c7cdb76d90c0e85a69aa1522281bcb3f4fc54ee443e76c7d9bf82e313f2dc3e277c699e079a847635780a5b724aca0ede72febba648de12fd14e3a78b29e9df82a19f4ed9c712e5b313c05e6908f6d4601d076afda5cf77eab4ea7c44c9d40f463fe8cde79f18170de9b087b113cfc7d467bd164564c2a8a99e4566d6f9eb1a8d5393700158fe84c109735cfe0ab45d9eb6fe61619d8538512730e015ffac07279973126e9087b209144c8797dd6b65381e616256a9cbf7771222c41618eb82d3539e7750ef0614acb4c901f88f31589d9d6d87c4b2a5361ad44155bf5476f2bc42cd2e758d478a1bcaf27c6c5607f025c8ff75913cb95eb631a690e3e6201204e616a4482a6eae323dadc0a9c22a7de1567ec3f45380bbde304cc76efd4bb0ac9f28475534eb973fc02f3f5dc73a862052f82f6d40c0821012589925ce3f2274ff2a8097b8464b44068c1505b967679bcc6b5d7e7ece9bd1880fc32531fe5d7bac9c5262a709239e477ecf44915a70aa7f984ec1bed047f3ec92a55714403c7c7503a3ac87cec792e072eefa623c56b6b33beb5ae7f5066a952cf6b0b25ab74841e5d2a9b20b1fe0cd83c3aae37eac0dd08d6a65410af956767766f2c6c12d13e87f363052e1e645c2dccd42948be835a9fe1c8892453b73cbcaa7c9222ccece11f86fba52d29d64a609da597e226e5f59e9a8301297c1e9881557a860df15ee14cf4bf70988e2cf90359587bc378adba5aa610db3cc1d6ae5fba9390b4c", 0x5}, {&(0x7f0000000840)='`', 0x49ed}], 0x2, 0x0, 0x0, 0x1a0}, 0xe869) [ 1360.212514][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.217845][T10209] gspca_vc032x: Unknown sensor... [ 1360.223332][T10209] vc032x: probe of 4-1:0.0 failed with error -22 [ 1360.422721][ T3796] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1360.472765][ T3796] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1360.664605][T10209] usb 4-1: USB disconnect, device number 16 [ 1360.858195][ T3796] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:46 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x12, 0xa, 0x4, 0x3}, 0x40) bpf$BPF_GET_MAP_INFO(0x4, &(0x7f0000000000)={r0, 0x33, &(0x7f0000000040)}, 0x10) 16:27:46 executing program 5: sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, 0x0, 0x10, 0x0, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_TSID={0x5}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x4}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x2}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_USER_PRIO={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x4840) r0 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000240)={{0x3, @null}, [@default, @remote, @default, @default, @null, @default]}, 0x0, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x0, 0x0) r2 = dup2(r1, r1) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000000)=""/246) poll(&(0x7f0000000300)=[{r0, 0x4040}, {0xffffffffffffffff, 0x3188}, {r2, 0x8000}, {0xffffffffffffffff, 0x4000}, {0xffffffffffffffff, 0x882}], 0x5, 0x1ff) 16:27:46 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f00000001c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) recvfrom$inet6(r0, &(0x7f0000000000)=""/114, 0xfffffffffffffd1b, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="9000000020001f", 0x7, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="58ad000010", 0xffffffffffffffdb, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x80, 0x0}, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 16:27:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000f000000880003006c33ff6b89f781f29cd5452fc8e3c8c9124ac6008261885ca7979ea1740f4a0373000100000000000000000000000000009da0a42e6faf216466c9126532b82ee766a88d789ce099e4618caf41849f59b27f87b0299be790680508c3af9ab104905da1480e1967e340294877d4f060e31c649728aa42cb86c7ae0d9b72d3393b50c8b57c2b893cd2022484ea46d196c5636b2611392f89c3d48d727a383a0b3e8937c685f91885525e61a89e5c1f863fb75000b3afdf29b520c34b304fb1253bd69fae1254a7d970194422c2404f2beb2638b80644f0318d641570e0976c1313c4f91c4b66c8e21302440f6b06b595271a797b6b1fc26f2f05f52c15bd74ec205dadcefa8c2b5e1265b32d7ec742b3f601b471ccb22686bfd000e56f6658cda9a08fd74d8ba40377468d21af67f11b4e75c783c46dd40db60699b8d518a28bd906f43ca5e8181cd4b95a01ddbe72706caff79bc20e3f70fa637bbeaa80783388acd86a1dd99fa3d9f767474c93fbb83ffb3b293be45266cf50f97a5e958ae34294a3b8d2", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) 16:27:47 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x9}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1361.212469][T10209] usb 4-1: new high-speed USB device number 17 using dummy_hcd 16:27:47 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBSENT(r0, 0x4b47, &(0x7f0000000000)={0x0, "2ca0ed6c22cdcb42acd7ba0449f98945968ea2132c2946057df404c9e6a781d5fb3ad02da95d9aa443c2d2a2873d7f1507492a45cd744de34933f6251b592c44871d6f6a49a80fe06b7711f853342b47ea06c2c27846b33f9c395024c89054dc353e168e9c7b82db04428d2366d5502f6bf529a8ac324a68057ab657ccd7d0a68ab375266e491011cd367bad595d96b69cf1884e5fadc3121170a6476f1e69f1039b70ce9d13363f3195e4a20cd02a4d070f8c105abf6284a10618eac50f33a1220c9cfe36a096a8367907798cc7d64dadc93423a98a1d6ecaf3b75ec69883cb9b74a804fa3bc2d4af2be357879bf68eb31759579ced1f8951c42098bbbb223f4f5b5f5bf6925d90c3066f7523ee8c0deb70583b832fc31c871a6a028d8c4474e1a0de4cfa6eedd02ffd030a0816bc264c0114ae2d0127a07a6ba345cd608591fa9f98b7423b39a2a513f40cf04b77a22dbaf13bab4f6933ceb7c83354d1dd148117b70bd92306e3e9dc9ae0112d83b75a3da6945a83eafbf46864111c0a426286dc2a96f7ae38e8a8e64516755ee303d020d47f01f5a92f540448919a1fc409cf0cac12d81d934098bba75fc0e7c4e591c0523684e95d6a8df975182c9fbb24022a24c8cb37f74e9b00ae2e1ae30b6847e598cce867301867904ec3716993d74649abee1ee0904dec33b6ef671f4b7d7588a9c064e77a1ed79ac647832cfb0a"}) [ 1361.508253][ T3830] netlink: 41435 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1361.519346][ T3830] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 1361.528260][ T3830] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1361.594502][T10209] usb 4-1: New USB device found, idVendor=0ac8, idProduct=c002, bcdDevice=84.37 [ 1361.603896][T10209] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1361.633969][ T3838] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1361.660385][ T3837] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1361.690790][T10209] usb 4-1: config 0 descriptor?? [ 1361.739968][T10209] gspca_main: vc032x-2.14.0 probing 0ac8:c002 [ 1361.749183][ T3837] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1361.882159][ T3847] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1361.943398][T10209] gspca_vc032x: reg_r err -71 [ 1361.948318][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.953839][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.959184][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.964964][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.970404][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.975883][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.981356][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.986837][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.992389][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.997847][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.003316][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.008657][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.014153][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.019883][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.025354][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.030696][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.036165][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.041591][T10209] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.047056][T10209] gspca_vc032x: Unknown sensor... [ 1362.052429][T10209] vc032x: probe of 4-1:0.0 failed with error -22 [ 1362.119247][T10209] usb 4-1: USB disconnect, device number 17 [ 1362.149427][ T3837] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:48 executing program 3: syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000a94bf240c80a02c03784000000010902120001000000000904"], 0x0) 16:27:48 executing program 4: r0 = socket(0x2a, 0x2, 0x0) sendto$isdn(r0, 0x0, 0xd0010100, 0x0, &(0x7f0000000080), 0x6) 16:27:48 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBSENT(r0, 0x4b47, &(0x7f0000000000)={0x0, "2ca0ed6c22cdcb42acd7ba0449f98945968ea2132c2946057df404c9e6a781d5fb3ad02da95d9aa443c2d2a2873d7f1507492a45cd744de34933f6251b592c44871d6f6a49a80fe06b7711f853342b47ea06c2c27846b33f9c395024c89054dc353e168e9c7b82db04428d2366d5502f6bf529a8ac324a68057ab657ccd7d0a68ab375266e491011cd367bad595d96b69cf1884e5fadc3121170a6476f1e69f1039b70ce9d13363f3195e4a20cd02a4d070f8c105abf6284a10618eac50f33a1220c9cfe36a096a8367907798cc7d64dadc93423a98a1d6ecaf3b75ec69883cb9b74a804fa3bc2d4af2be357879bf68eb31759579ced1f8951c42098bbbb223f4f5b5f5bf6925d90c3066f7523ee8c0deb70583b832fc31c871a6a028d8c4474e1a0de4cfa6eedd02ffd030a0816bc264c0114ae2d0127a07a6ba345cd608591fa9f98b7423b39a2a513f40cf04b77a22dbaf13bab4f6933ceb7c83354d1dd148117b70bd92306e3e9dc9ae0112d83b75a3da6945a83eafbf46864111c0a426286dc2a96f7ae38e8a8e64516755ee303d020d47f01f5a92f540448919a1fc409cf0cac12d81d934098bba75fc0e7c4e591c0523684e95d6a8df975182c9fbb24022a24c8cb37f74e9b00ae2e1ae30b6847e598cce867301867904ec3716993d74649abee1ee0904dec33b6ef671f4b7d7588a9c064e77a1ed79ac647832cfb0a"}) 16:27:48 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050064f17d30b85c14420f000000080091950000b3cdf98c21157a8feeacc79a03ed5013357ee7424e56d4659ef20c4fd0c5e8d6b2bbd5ee9c06a83ac93d0298fba797ab9980011117c5efc95dc6deca", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) 16:27:48 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0xa}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:27:48 executing program 5: unshare(0x40680) r0 = eventfd(0x0) poll(&(0x7f0000000240)=[{r0}], 0x1, 0x0) [ 1362.825033][ T3871] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1362.850358][ T3876] netlink: 88 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1362.884232][ T3877] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:48 executing program 5: unshare(0x40680) r0 = eventfd(0x0) poll(&(0x7f0000000240)=[{r0}], 0x1, 0x0) 16:27:48 executing program 4: r0 = syz_open_dev$video4linux(&(0x7f0000000040)='/dev/v4l-subdev#\x00', 0x0, 0x0) ioctl$VIDIOC_QBUF(r0, 0xc040564a, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "bd8d329e"}, 0x0, 0x0, @planes=0x0}) 16:27:48 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBSENT(r0, 0x4b47, &(0x7f0000000000)={0x0, "2ca0ed6c22cdcb42acd7ba0449f98945968ea2132c2946057df404c9e6a781d5fb3ad02da95d9aa443c2d2a2873d7f1507492a45cd744de34933f6251b592c44871d6f6a49a80fe06b7711f853342b47ea06c2c27846b33f9c395024c89054dc353e168e9c7b82db04428d2366d5502f6bf529a8ac324a68057ab657ccd7d0a68ab375266e491011cd367bad595d96b69cf1884e5fadc3121170a6476f1e69f1039b70ce9d13363f3195e4a20cd02a4d070f8c105abf6284a10618eac50f33a1220c9cfe36a096a8367907798cc7d64dadc93423a98a1d6ecaf3b75ec69883cb9b74a804fa3bc2d4af2be357879bf68eb31759579ced1f8951c42098bbbb223f4f5b5f5bf6925d90c3066f7523ee8c0deb70583b832fc31c871a6a028d8c4474e1a0de4cfa6eedd02ffd030a0816bc264c0114ae2d0127a07a6ba345cd608591fa9f98b7423b39a2a513f40cf04b77a22dbaf13bab4f6933ceb7c83354d1dd148117b70bd92306e3e9dc9ae0112d83b75a3da6945a83eafbf46864111c0a426286dc2a96f7ae38e8a8e64516755ee303d020d47f01f5a92f540448919a1fc409cf0cac12d81d934098bba75fc0e7c4e591c0523684e95d6a8df975182c9fbb24022a24c8cb37f74e9b00ae2e1ae30b6847e598cce867301867904ec3716993d74649abee1ee0904dec33b6ef671f4b7d7588a9c064e77a1ed79ac647832cfb0a"}) [ 1363.179978][ T3883] netlink: 88 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1363.268226][ T3877] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1363.312321][T10207] usb 4-1: new high-speed USB device number 18 using dummy_hcd 16:27:49 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0xb}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1363.703846][T10207] usb 4-1: New USB device found, idVendor=0ac8, idProduct=c002, bcdDevice=84.37 [ 1363.713440][T10207] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 16:27:49 executing program 5: unshare(0x40680) r0 = eventfd(0x0) poll(&(0x7f0000000240)=[{r0}], 0x1, 0x0) 16:27:49 executing program 0: r0 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r0, 0x1) flock(r0, 0x1) flock(r0, 0x2) bpf$LINK_DETACH(0x22, &(0x7f0000000240)=r0, 0x4) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100)='fuse\x00', 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x0, 0xfff8}}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = getpid() r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) sendmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@cred={{0x18, 0x1, 0x2, {r4, 0xee01, r6}}}], 0x18}, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000380)={0xa0, 0x0, r2, {{0x2, 0x2, 0x844, 0x4, 0x6, 0x6, {0x0, 0x4, 0x4, 0x6, 0xa5f7, 0x7, 0x1f, 0x4c, 0xfffffff8, 0x8000, 0x6, 0xffffffffffffffff, r6, 0x800, 0x100}}, {0x0, 0x8}}}, 0xa0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r8, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x90, r8, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x44, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x80, 0x1, 0x1, 0x0, {0x8, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x3, 0x1}, 0x300, 0x1, 0x3}}, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x90}}, 0x0) [ 1363.813424][T10207] usb 4-1: config 0 descriptor?? [ 1363.879550][T10207] gspca_main: vc032x-2.14.0 probing 0ac8:c002 [ 1364.078053][ T3900] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1364.095809][T10207] gspca_vc032x: reg_r err -71 [ 1364.100713][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.106456][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.112026][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.117370][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.122915][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.128258][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.133704][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.138515][ T3905] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1364.139180][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.154578][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.159927][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.165437][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.170779][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.178256][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.184163][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.189512][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.194953][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.200386][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.206957][T10207] gspca_vc032x: I2c Bus Busy Wait 00 [ 1364.212398][T10207] gspca_vc032x: Unknown sensor... [ 1364.217675][T10207] vc032x: probe of 4-1:0.0 failed with error -22 [ 1364.295243][T10207] usb 4-1: USB disconnect, device number 18 [ 1364.526663][ T3900] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:27:50 executing program 3: syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000a94bf240c80a02c03784000000010902120001000000000904"], 0x0) 16:27:50 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f000001dc00)={0x1b, 0x0, 0x0, 0x2000}, 0x40) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000200)={r0, 0x0, &(0x7f0000000400)=""/211}, 0x1c) 16:27:50 executing program 0: r0 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r0, 0x1) flock(r0, 0x1) flock(r0, 0x2) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000000)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000fcdbdf250f00000008000300", @ANYRES32=r3, @ANYBLOB="28004e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008b818006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) 16:27:50 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBSENT(r0, 0x4b47, &(0x7f0000000000)={0x0, "2ca0ed6c22cdcb42acd7ba0449f98945968ea2132c2946057df404c9e6a781d5fb3ad02da95d9aa443c2d2a2873d7f1507492a45cd744de34933f6251b592c44871d6f6a49a80fe06b7711f853342b47ea06c2c27846b33f9c395024c89054dc353e168e9c7b82db04428d2366d5502f6bf529a8ac324a68057ab657ccd7d0a68ab375266e491011cd367bad595d96b69cf1884e5fadc3121170a6476f1e69f1039b70ce9d13363f3195e4a20cd02a4d070f8c105abf6284a10618eac50f33a1220c9cfe36a096a8367907798cc7d64dadc93423a98a1d6ecaf3b75ec69883cb9b74a804fa3bc2d4af2be357879bf68eb31759579ced1f8951c42098bbbb223f4f5b5f5bf6925d90c3066f7523ee8c0deb70583b832fc31c871a6a028d8c4474e1a0de4cfa6eedd02ffd030a0816bc264c0114ae2d0127a07a6ba345cd608591fa9f98b7423b39a2a513f40cf04b77a22dbaf13bab4f6933ceb7c83354d1dd148117b70bd92306e3e9dc9ae0112d83b75a3da6945a83eafbf46864111c0a426286dc2a96f7ae38e8a8e64516755ee303d020d47f01f5a92f540448919a1fc409cf0cac12d81d934098bba75fc0e7c4e591c0523684e95d6a8df975182c9fbb24022a24c8cb37f74e9b00ae2e1ae30b6847e598cce867301867904ec3716993d74649abee1ee0904dec33b6ef671f4b7d7588a9c064e77a1ed79ac647832cfb0a"}) 16:27:50 executing program 5: unshare(0x40680) r0 = eventfd(0x0) poll(&(0x7f0000000240)=[{r0}], 0x1, 0x0) 16:27:50 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0xc}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1365.117748][ T3938] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.0'. 16:27:51 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x8}]}, 0x20}}, 0x0) 16:27:51 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x3, &(0x7f0000000040)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=@newtaction={0x68, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb, 0x1, 'mirred\x00'}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{}, 0x3, r3}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) 16:27:51 executing program 5: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000fc0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000080000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001040)=ANY=[@ANYBLOB="900000002c00250d000080000000000400000040", @ANYRES32=r3, @ANYBLOB="00001c000000000004000c000a0001006261736963000000600002005c000300580001000b0001"], 0x90}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) r4 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 1365.331028][ T3925] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1365.501974][ T8467] usb 4-1: new high-speed USB device number 19 using dummy_hcd 16:27:51 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="240000009be6c3f051c6517062b43ebce35f3297f3c2fe588a2f029185893c7719a40e0d31bba6cd0c687d79f6400c6934002708fbf589e6b4588bfd9e715432d93ddf4c95dfbcfb6735c53ac68cc848bbceab8a09666b49ad8dc387c9142be1e8a3ee327454f080285ae43a4edcce17a72d49966a1109e411e8a47bf2f11d3b630e98bdea8ac0db8a213242a2befa1614a95f95f0bc718d9c4d7d5a560d1369d8184eb50f7cba3ac84e3730bc53d679c5b60b760f441be8675d4ead1bf39a95418aaac93ce0523c9965ba", @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r2, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) getsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="cc57b0255b34784455a1010001009c5968e8b6dd008426e97d3a7a50d0669a62b6972c0a43a7e6bdfe9b7b42b7530d87e61d4339c977d6e0c48889e041751904e1981e40112c857ed2c97cbf52f3fc4dbc35462a087c44946468a99030517ae5dc643fb7b3c388c6f7daf2258031e05b7211a1cab47de39019bace5d72cd3db3d75cdd8c60bb845fcbf17c88c3f59e09c414d07d0c6e40b0e61987f7894e54f968af2d49a295a74d8f5a1c15b5b45740c28059daff48e2841fcc09bd83d32bfb", @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) ioctl$SIOCX25SCALLUSERDATA(0xffffffffffffffff, 0x89e5, &(0x7f0000000500)={0x19, "2e058ea9f912f0fb1136cbaf848919975aabe28669005d05f234a21d4bbe4dfed5369ee08ba1378bbc44557461a8ee136cfc94706c5e5454f59367afb05b7cc2d80a6f931d90c191cc31eaf624c21c38e1d83bf8fa009f926e52b1bcddfb321d13d2b231aef57b8349a96cf621321070150df3473ba8b2af41dd675e6f89e82c"}) [ 1365.867281][ T8467] usb 4-1: New USB device found, idVendor=0ac8, idProduct=c002, bcdDevice=84.37 [ 1365.876810][ T8467] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1365.987356][ T8467] usb 4-1: config 0 descriptor?? [ 1366.079116][ T8467] gspca_main: vc032x-2.14.0 probing 0ac8:c002 [ 1366.264497][ T8467] gspca_vc032x: reg_r err -71 [ 1366.269282][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.275042][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.280606][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.286108][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.291453][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.296971][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.302440][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.307781][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.313288][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.318627][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.324106][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.330360][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.336106][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.341481][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.347228][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.352756][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.358107][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.363765][ T8467] gspca_vc032x: I2c Bus Busy Wait 00 [ 1366.369103][ T8467] gspca_vc032x: Unknown sensor... [ 1366.374501][ T8467] vc032x: probe of 4-1:0.0 failed with error -22 16:27:52 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') alarm(0x5a) sendmsg$NL80211_CMD_DISCONNECT(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x34, r3, 0x100, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x2a}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x11}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3b}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) [ 1366.632292][ T8467] usb 4-1: USB disconnect, device number 19 [ 1366.975332][ T3956] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1367.044621][ T3977] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1367.085389][ T3511] tipc: TX() has been purged, node left! 16:27:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket(0x200000000000011, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bind$packet(r3, &(0x7f0000000240)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="e5d9000600f5"}, 0x14) getsockname$packet(r3, &(0x7f0000000500)={0x11, 0x0, 0x0}, &(0x7f0000000040)=0x10eef0f1) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_MASTER={0x8, 0x4, r2}]}, 0x28}}, 0x0) 16:27:53 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) r1 = socket(0x18, 0x0, 0x0) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x1d, &(0x7f0000000080)=0x6, 0x4) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x1d, &(0x7f0000000000), 0x20a154cc) 16:27:53 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) recvmmsg(r0, &(0x7f000000b180)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2001, 0x0) 16:27:53 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x12, 0x1fe, 0x4, 0x8}, 0x40) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000080)={r0, 0xffffffffffffff6c, &(0x7f0000000040)}, 0x10) 16:27:54 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)={0x4c, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7f}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}]}, 0x4c}}, 0x0) 16:27:54 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f00000002c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x2}, 0x10, 0x0}, 0x0) dup2(r1, r0) [ 1371.048001][ T3511] device hsr_slave_0 left promiscuous mode [ 1371.057142][ T3511] device hsr_slave_1 left promiscuous mode [ 1371.066697][ T3511] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1371.074745][ T3511] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1371.087671][ T3511] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1371.095547][ T3511] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1371.107220][ T3511] device bridge_slave_1 left promiscuous mode [ 1371.114281][ T3511] bridge0: port 2(bridge_slave_1) entered disabled state [ 1371.126677][ T3511] device bridge_slave_0 left promiscuous mode [ 1371.133636][ T3511] bridge0: port 1(bridge_slave_0) entered disabled state [ 1371.159665][ T3511] device veth1_macvtap left promiscuous mode [ 1371.166035][ T3511] device veth0_macvtap left promiscuous mode [ 1371.172381][ T3511] device veth1_vlan left promiscuous mode [ 1371.178417][ T3511] device veth0_vlan left promiscuous mode [ 1375.222108][ T8823] Bluetooth: hci4: command 0x0409 tx timeout [ 1376.262355][ T3511] team0 (unregistering): Port device team_slave_1 removed [ 1376.283372][ T3511] team0 (unregistering): Port device team_slave_0 removed [ 1376.306035][ T3511] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1376.326657][ T3511] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1376.411146][ T3511] bond0 (unregistering): Released all slaves [ 1376.476434][ T4071] IPVS: ftp: loaded support on port[0] = 21 [ 1376.699494][ T4071] chnl_net:caif_netlink_parms(): no params data found [ 1376.812790][ T4071] bridge0: port 1(bridge_slave_0) entered blocking state [ 1376.820555][ T4071] bridge0: port 1(bridge_slave_0) entered disabled state [ 1376.830707][ T4071] device bridge_slave_0 entered promiscuous mode [ 1376.845682][ T4071] bridge0: port 2(bridge_slave_1) entered blocking state [ 1376.853234][ T4071] bridge0: port 2(bridge_slave_1) entered disabled state [ 1376.863247][ T4071] device bridge_slave_1 entered promiscuous mode [ 1376.923508][ T4071] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1376.943257][ T4071] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1377.005474][ T4071] team0: Port device team_slave_0 added [ 1377.026040][ T4071] team0: Port device team_slave_1 added [ 1377.081103][ T4071] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1377.088464][ T4071] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1377.115464][ T4071] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1377.179339][ T4071] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1377.187367][ T4071] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1377.213942][ T4071] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1377.302122][ T8823] Bluetooth: hci4: command 0x041b tx timeout [ 1377.353649][ T4071] device hsr_slave_0 entered promiscuous mode [ 1377.363901][ T4071] device hsr_slave_1 entered promiscuous mode [ 1377.381879][ T4071] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1377.391507][ T4071] Cannot create hsr debugfs directory [ 1377.813243][ T4071] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1377.842537][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1377.850920][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1377.874599][ T4071] 8021q: adding VLAN 0 to HW filter on device team0 [ 1377.893935][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1377.903774][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1377.913330][T10207] bridge0: port 1(bridge_slave_0) entered blocking state [ 1377.920569][T10207] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1377.933713][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1377.955878][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1377.966452][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1377.976181][ T8823] bridge0: port 2(bridge_slave_1) entered blocking state [ 1377.983648][ T8823] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1378.033988][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1378.045035][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1378.056287][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1378.067077][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1378.077856][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1378.088474][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1378.106977][ T8823] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1378.124336][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1378.134250][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1378.161447][ T4071] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1378.174108][ T4071] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1378.184250][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1378.197027][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1378.245484][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1378.256871][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1378.284996][ T4071] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1378.410038][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1378.421350][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1378.483127][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1378.493273][T10207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1378.507977][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1378.521131][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1378.538472][ T4071] device veth0_vlan entered promiscuous mode [ 1378.569118][ T4071] device veth1_vlan entered promiscuous mode [ 1378.631562][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1378.641252][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1378.664256][ T4071] device veth0_macvtap entered promiscuous mode [ 1378.688333][ T4071] device veth1_macvtap entered promiscuous mode [ 1378.807301][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1378.819286][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1378.830093][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1378.840901][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1378.850974][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1378.861780][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1378.872014][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1378.882857][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1378.892962][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1378.903733][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1378.918030][ T4071] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1378.926444][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1378.936515][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1378.946242][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1378.956629][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1379.001270][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1379.013856][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1379.025210][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1379.036074][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1379.046664][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1379.057514][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1379.067974][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1379.078845][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1379.089164][ T4071] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1379.099871][ T4071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1379.113614][ T4071] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1379.124438][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1379.135109][ T3114] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1379.408236][ T16] Bluetooth: hci4: command 0x040f tx timeout [ 1379.455097][ T3532] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1379.463640][ T3532] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1379.471328][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1379.751554][ T3545] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1379.759670][ T3545] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1379.768076][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1379.964695][ T4344] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1379.984972][ T4344] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:06 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0xd}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:06 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x9, 0x4, 0x40, 0x1}, 0x40) unshare(0x2a000400) bpf$MAP_UPDATE_BATCH(0x19, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x4}, 0x38) 16:28:06 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0xa, [@var={0x6, 0x0, 0x0, 0xe, 0x2}, @fwd={0x8}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2e, 0x0, 0x61]}}, &(0x7f00000006c0)=""/4096, 0x3e, 0x1000, 0x1}, 0x20) 16:28:06 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}, 0x1, 0x0, 0x0, 0x48044}, 0x0) 16:28:06 executing program 4: r0 = add_key$user(&(0x7f0000000640)='user\x00', &(0x7f0000000540)={'syz'}, &(0x7f0000000140)='y', 0x1, 0xfffffffffffffffd) r1 = add_key$user(&(0x7f0000000640)='user\x00', &(0x7f0000000540)={'syz'}, &(0x7f00000000c0), 0xc6, 0xfffffffffffffffd) r2 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f00000002c0)='X', 0x1, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r2, r0, r1}, &(0x7f0000000400)=""/139, 0x8b, &(0x7f0000000180)={&(0x7f0000000080)={'rmd128\x00'}}) 16:28:06 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)={0x4c, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7f}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}]}, 0x4c}}, 0x0) [ 1380.304712][ T4344] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:06 executing program 5: syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000280)=[{&(0x7f00000003c0)="eb3c906d6b66732e66617400028001000240000004f801", 0x17}, {0x0, 0x0, 0x600}], 0x0, &(0x7f0000000180)={[{@numtail='nonumtail=0'}]}) 16:28:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) clone(0x7fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x0, 0x3}) 16:28:06 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)={0x4c, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7f}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}]}, 0x4c}}, 0x0) 16:28:06 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000001c80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2, 0x2}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x1}]}]}}, &(0x7f0000000340)=""/142, 0x5a, 0x8e, 0x8}, 0x20) [ 1380.956483][ T4365] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1381.025684][ T4368] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:07 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r3, 0x2) r4 = socket$packet(0x11, 0x3, 0x300) dup3(r4, r3, 0x0) sendmsg$NL80211_CMD_SET_BEACON(r3, &(0x7f0000000a80)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000040)={&(0x7f00000002c0)={0x78c, r1, 0x10, 0x70bd2d, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x4, 0x61}}}}, [@NL80211_ATTR_PROBE_RESP={0x675, 0x91, "9a203e045048c6021ef4041f7542ac5ef75cdbd7d827b9a6fe8d383c63850a5b7c8542bac5c0a14425d1f62f787a315e155b840775350122be55f0dc9761b4c7e2720d0125734d0f2e253ad6ede6939ca2634b6297ea74ed562c3c68ddec6863997e959cd9d3ce2dd0ca546310c06ae92749f15332fadec6613c0769cb5f818d2c3b83c55600a5df60289945307b70b9e947fc647e5689264c03b81b9a02775abd46ed79f3f87da6d5c51d90edb4cd762c1fd3b8c25f8d38ae22c4f1ca15c9a50ea33f47c6fd5a614825f8428a031f6d2b03d5ef69510e740817ecf184ef78506138a2d86228c92db0415873eb1c2170d96eb930716d03c9c9979630ee8c9edd25b14bff17b101561452e6a1809e42bb0a22b4689faeb669f55bc66c3e3d6ba6779a521dab625e737af0f058f1c437973893c346d6063b75e4d444adfaef1ffad2d67dda7f16416ecbbd40808d48bb0f53f09cd48b33ea50558424b461f0d11e9fe587599e9ae8db0ae8656e972911d5b6bf3502b4a6ba89b078f23059213b730cb38f7f10161430bd274fdb59f85e4750638967f4ad3a7893d69fb609803267196d500643dac4d2d397eb28be7d926d4f42e4c7d8ec2edd7434045f9d68590fb5b9a69b8a7f7c2f546584e7e4a65d91794e1057a70b033b08e51aabc07d6b26bb0597effd5c1766049a37acc0cc3ef867d97228ba2df382e1f088f530806c94ee83a3d23cf0d0edcb39fe5de3369bca1c02148065c761eeb9d6e1ddff915440120e5d2197f45a4ef45e56bce503671aa464e03acb168437ee78ab36fc458f1a2e1ef0d9dafbc2ed8b77824d7c4ef4883f8b450f6bf1420f22d45f5ecb3b01562f92f4ec1d523608445aa39af70d4ec97b7bbd60805740e7694325c9f4a1858e5af979fac355eadf5aa6a86aaa8b8050cf90ba04b51238d386ae04e73c0dc040ba5d64afdb42bd689dcdac8c9c9c1cd4cb64cfe7f0b7c71aff0f00c91427e12bece5dfbd9ba719ffa7c898152008518158a70dd9966946dd6b5cce4f4665348acdfd1366584dea6364a12a4a273137546db86a164687836369bdb6d1ae3726fb3f5552652038d3c847fe8075aafdf698b3c13b6632c9297f0f8f2bc972acdca96e5c4ada7ebf29a914b2196be11efe7f43e7fdc773a5696265e04fdaab5d53c853463d42639444357846ec96521eb66988e84f6246ddc48c8521a771d91b2b1a398b8a5cc16d4757620876e0fd0ef60c78e4fa939bd3bc2c640ac6e2d762b4c564ce9969c3decabbd8599b168d2b39be211e405001fecbcfb49f54a35aca8553274d6b391bf6800490c72e912ff71d14315632f0e2c59212edc2820d7d6ebbbcb952bd6d81d993d203647e97f326fc98eb21e793635530ca789af9f2375b7c5e35e8261defaa990305bb372748a5ad84ed5665081392c67e39035733ca599850c2bdbeadf00b5956fa55e5744f40a5763e231d2b514f1548fd4c5e1ede030dac525a5dc6e6aff87ee49376106fd03d55f87eb4f2e681fa318e2e5ed9e94c44ba85dbd7fb248a0c6dfd9c8d0fa7ea56bba2c56ff86f56162525013c1c17bfb2a4ec2cba8c5316cb90c6837e8aa774e6481c4d0bf024225b012e43e57571514f091ad5059288f621b08abac7ace53f7d5929440964804816b933838f975c1d4567dc12f71a4bc4ec564637ecd1f14e52c4de6c5cd72b5d06a2d9f025facc304d4ca626434f4219cdd66d915c791bcb38373877b33ec4c2c1fd15282e723979b55691641cabe94e358b712004a37db7ac4cefefecdb2f287e1fb109a2743508e667e25105414ad1fb644be690f4d0e72e64b491a5ae65b7255866fa1ffa9b316c915b1ee1b8d26a4fbd1196627f262f8466536033f32f2c8c64dab3e2bd75a35a0a530be40c3fd1e45fd2b978850b20a1b272eff11e82a7ee762bb36e3b47cee69510f42a9030431f5e24a677e61a0d5866662893ed557c95da20f14cf136831d54a5672889b04dcb6fb347afc7946fd193f1179d7937f2598691da95730a3808d1a066876cf9c47d8e001f1ae2b61286ce4f2c753df810507177eda8c5ec1d688c4f69c91e4572b468ab50d02209c33cc631a1bade22fe4531e1337334dcd0919c05d1e1761d8f7d9956b03fbb9d7237d774d2b41ea9b41ee92bc5c45f6d020ad3995b2908d2b02d0ee7e09ad16b521c17be1441e806dde4e827cdf40d638ca4e8b772ff2788f88a28bde492122098c957b343b2450e0334c7570a8899dba28eb94e7a7d239ec930921f12da2a6223284861b914f89f064f1e622aec43dfa4716370309de129dbfde9cb1028be7cec4425b9"}, @NL80211_ATTR_PROBE_RESP={0x64, 0x91, "ab83c455e927b9aac0c4ee799c4efb7a6e9601bcc174d915d359590f0aab7f5a9d12209914d82a566ec813c103436056231eea3c5d60f4aa960f5ef7c310eaa2903c3c31a169b773fb0ab8c854c4a116f5f5784f3ad36685da5a5aed40a074e3"}, @NL80211_ATTR_IE_PROBE_RESP={0x8e, 0x7f, [@ssid={0x0, 0x6, @default_ibss_ssid}, @erp={0x2a, 0x1, {0x0, 0x1}}, @channel_switch={0x25, 0x3, {0x1, 0x74, 0x1}}, @random={0x80, 0x62, "1796b6adc0c7e93ff6325565d85307ff0cda6702b99fc33d01638402d4b45179844710d99bc3dc5f6ab0c4ea49f59f51eb56cc8cd5ee5bbcd0ee9c94438ea5e85cad055187ee7da93a56ad4c1ce9e29cc1861033488a0a9a66fa5fca9a6a9b04f31e"}, @sec_chan_ofs={0x3e, 0x1, 0x1}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81, 0x9}}, @supported_rates={0x1, 0x8, [{0x12}, {0x18}, {0x36}, {0x6}, {0x3}, {0x60, 0x1}, {0x12}, {0x5}]}]}]}, 0x78c}, 0x1, 0x0, 0x0, 0x84840}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1381.235706][ T4371] FAT-fs (loop5): Directory bread(block 6) failed [ 1381.270785][ T4374] binder: 4369:4374 ioctl c018620c 20000080 returned -22 16:28:07 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4000000000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2) clone(0x4412c580, 0x0, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x20, 0x0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x0) [ 1381.315302][ T4379] BPF: (anon) type_id=1 bits_offset=0 [ 1381.320828][ T4379] BPF: [ 1381.322276][ T4377] binder: 4375:4377 ioctl c018620c 20000080 returned -22 [ 1381.323913][ T4379] BPF:Member exceeds struct_size [ 1381.336232][ T4379] BPF: [ 1381.336232][ T4379] [ 1381.423639][ T4365] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1381.462285][ T8823] Bluetooth: hci4: command 0x0419 tx timeout 16:28:07 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0xe}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:07 executing program 2: utimensat(0xffffffffffffffff, 0x0, 0x0, 0x116c34c6a2a5d75e) 16:28:07 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r0, &(0x7f0000000040)={{0x1b, 0x5b, 0x7, 0x7, 0x3f, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 16:28:07 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)={0x4c, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7f}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}]}, 0x4c}}, 0x0) [ 1381.854264][ T4392] IPVS: ftp: loaded support on port[0] = 21 16:28:08 executing program 5: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000240)='/dev/cuse\x00', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000002540)={0x30}, 0x30) 16:28:08 executing program 2: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r0 = creat(&(0x7f0000000080)='./file0/file0\x00', 0x0) fcntl$lock(r0, 0x7, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x20000}) 16:28:08 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x14, r1, 0x5, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x4005}, 0x0) [ 1382.464773][ T4425] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:08 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="94000000320003050000000000000000000000000800040020000000780001000c00010008000100696665"], 0x94}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) [ 1382.528621][ T4427] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1382.714919][ T4395] IPVS: ftp: loaded support on port[0] = 21 [ 1383.015805][ T4425] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1383.098700][ T4461] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.3'. 16:28:09 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4000000000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2) clone(0x4412c580, 0x0, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x20, 0x0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x0) 16:28:09 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0xf}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1383.470076][ T3511] tipc: TX() has been purged, node left! 16:28:09 executing program 2: r0 = socket(0x2, 0x5, 0x0) getsockopt$MISDN_TIME_STAMP(r0, 0x84, 0x22, 0x0, &(0x7f0000000b40)=0x1f00) 16:28:09 executing program 5: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280)='nl80211\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000004f80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)={0x2c, r0, 0x129, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_EXT_CAPABILITY={0x4}]}, 0x2c}}, 0x0) 16:28:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r2 = openat$ocfs2_control(0xffffff9c, &(0x7f0000000000)='/dev/ocfs2_control\x00', 0x400, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0)='nl80211\x00') r4 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r4, 0x2) r5 = socket$packet(0x11, 0x3, 0x300) dup3(r5, r4, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(r4, &(0x7f00000004c0)={&(0x7f00000003c0), 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x1, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x8, 0x2d}}}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x404004c}, 0x4800) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x3c, r3, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0x0, 0x62}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'tunl0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000084}, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000006000009acf0eb00", @ANYRES32=r7, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1383.673006][ T4467] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1384.028330][ T4472] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1384.096846][ T4477] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:10 executing program 3: syz_emit_ethernet(0xba, &(0x7f0000000280)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x12, 0xac, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, {0x24, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x771, @empty, @local, {[@ra={0x94, 0x4}, @rr={0x7, 0xb, 0x0, [@empty, @remote]}, @cipso={0x86, 0x2d, 0x0, [{0x0, 0x2}, {0x0, 0x2}, {0x0, 0xb, "ae0dc5f2009a607c2d"}, {0x0, 0x2}, {0x0, 0xe, "1eeec88ddc184f60902976b6"}, {0x0, 0x8, "1e916a2891e6"}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@empty}, {@loopback}, {@private}, {@local}, {@remote}, {@empty}, {@multicast1}]}, @rr={0x7, 0x3}]}}}}}}}, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x1, 0x0, 0x0, 0x6, 0x0, 0x0, 0x100000000}, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000003c0)={@remote, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @ipv4={[], [], @empty}, 0x8, 0x0, 0xff22, 0x480}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000440)={0x0, 0x2, 0x8000, 0x0, [], [], [], 0x0, 0x4, 0x0, 0x0, "352ef2069a980be142a0215ff76bc52f"}) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0xc, &(0x7f0000000100), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffbffffffff, 0xffffffffffffffff, 0x1) unshare(0x40000000) write$sequencer(0xffffffffffffffff, &(0x7f0000000100)=[@t={0x81, 0x5, 0x0, 0x0, @TMR_WAIT_ABS=0xbf}], 0x8) ioctl$F2FS_IOC_START_VOLATILE_WRITE(0xffffffffffffffff, 0xf503, 0x0) [ 1384.229725][ T4470] IPVS: ftp: loaded support on port[0] = 21 16:28:10 executing program 2: mknod(&(0x7f00000000c0)='./file0\x00', 0x1124, 0x0) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x27e, 0x0) fcntl$setstatus(r0, 0x4, 0x46c00) r1 = creat(&(0x7f0000001300)='./file0\x00', 0x0) write$P9_RREADDIR(r1, 0x0, 0x1) readv(r0, &(0x7f0000001240)=[{&(0x7f0000000100)=""/217, 0xd9}], 0x1) [ 1384.440215][ T4483] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1384.516491][ T4472] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:10 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_x_policy={0x8, 0x12, 0x2, 0x2, 0x0, 0x0, 0x0, {0x30, 0x33, 0xffffff03, 0x3, 0x0, 0x2, 0x0, @in6=@loopback, @in=@remote}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x80}}, 0x0) 16:28:10 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4000000000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2) clone(0x4412c580, 0x0, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x20, 0x0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x0) [ 1384.999686][ T4484] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 16:28:11 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x10}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1385.312463][ T4515] IPVS: ftp: loaded support on port[0] = 21 [ 1385.585738][ T4542] IPVS: ftp: loaded support on port[0] = 21 [ 1385.598639][ T4516] IPVS: ftp: loaded support on port[0] = 21 16:28:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_PORTS(r0, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, 0x0, 0x300, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x40090) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') r4 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r3, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r4}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000880)={0x1c, r3, 0x1, 0x0, 0x0, {0x5}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48880}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x20, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0x4}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x14, r5, 0x10, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r3, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e23}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}, @L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r8, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r10 = creat(&(0x7f0000000000)='./file0\x00', 0x1ba) getsockopt$bt_BT_FLUSHABLE(r10, 0x112, 0x8, &(0x7f0000000040)=0x6, &(0x7f00000002c0)=0x4) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="65001000", @ANYRES16=0x0, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r9, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) 16:28:11 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4000000000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2) clone(0x4412c580, 0x0, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x20, 0x0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x0) 16:28:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}, @IFLA_GSO_MAX_SEGS={0x8}]}, 0x3c}}, 0x0) [ 1386.226069][ T4591] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1386.302355][ T4593] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:12 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000002c0)=0x210, 0x4) connect$inet(r0, &(0x7f0000000780)={0x2, 0x4e23}, 0x10) sendto$inet(r1, &(0x7f0000000200)="96", 0x1, 0x0, 0x0, 0x0) recvfrom(r0, 0x0, 0x0, 0x2000, 0x0, 0x0) 16:28:12 executing program 3: syz_emit_ethernet(0xba, &(0x7f0000000280)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x12, 0xac, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, {0x24, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x771, @empty, @local, {[@ra={0x94, 0x4}, @rr={0x7, 0xb, 0x0, [@empty, @remote]}, @cipso={0x86, 0x2d, 0x0, [{0x0, 0x2}, {0x0, 0x2}, {0x0, 0xb, "ae0dc5f2009a607c2d"}, {0x0, 0x2}, {0x0, 0xe, "1eeec88ddc184f60902976b6"}, {0x0, 0x8, "1e916a2891e6"}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@empty}, {@loopback}, {@private}, {@local}, {@remote}, {@empty}, {@multicast1}]}, @rr={0x7, 0x3}]}}}}}}}, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x1, 0x0, 0x0, 0x6, 0x0, 0x0, 0x100000000}, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000003c0)={@remote, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @ipv4={[], [], @empty}, 0x8, 0x0, 0xff22, 0x480}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000440)={0x0, 0x2, 0x8000, 0x0, [], [], [], 0x0, 0x4, 0x0, 0x0, "352ef2069a980be142a0215ff76bc52f"}) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0xc, &(0x7f0000000100), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffbffffffff, 0xffffffffffffffff, 0x1) unshare(0x40000000) write$sequencer(0xffffffffffffffff, &(0x7f0000000100)=[@t={0x81, 0x5, 0x0, 0x0, @TMR_WAIT_ABS=0xbf}], 0x8) ioctl$F2FS_IOC_START_VOLATILE_WRITE(0xffffffffffffffff, 0xf503, 0x0) [ 1386.680102][ T4591] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1386.855290][ T4604] IPVS: ftp: loaded support on port[0] = 21 [ 1387.105696][ T4614] IPVS: ftp: loaded support on port[0] = 21 16:28:13 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r3, 0x1) flock(r3, 0x1) flock(r3, 0x2) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000002c0)={0xc4, r1, 0x4, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x1000, 0x63}}}}, [@NL80211_ATTR_REKEY_DATA={0xa4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="620102d7383cc3b758d3ac25d0eea86c"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0eb93582330444e0ecc27336fccaaf69d3961ef7a7de46b8"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="e171b2f6dfb5c38cbd0d8dd4bfffc4c60780561dc614765dd1ebe6f1480b75f0"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="88ae40e23cbf22415cf3337003066687"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="295a43798280910cdfc74a33f3b8cf1438946a52e0dcb9ad7ef2cd9ab2da0da4"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="deb5d8d5a1030ecb0cce526f50af2e51"}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20048050}, 0x4000000) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, &(0x7f0000000400)=0xffffffffffffffff) 16:28:13 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x11}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:13 executing program 5: fanotify_init(0x224, 0x0) 16:28:13 executing program 3: syz_emit_ethernet(0xba, &(0x7f0000000280)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x12, 0xac, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, {0x24, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x771, @empty, @local, {[@ra={0x94, 0x4}, @rr={0x7, 0xb, 0x0, [@empty, @remote]}, @cipso={0x86, 0x2d, 0x0, [{0x0, 0x2}, {0x0, 0x2}, {0x0, 0xb, "ae0dc5f2009a607c2d"}, {0x0, 0x2}, {0x0, 0xe, "1eeec88ddc184f60902976b6"}, {0x0, 0x8, "1e916a2891e6"}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@empty}, {@loopback}, {@private}, {@local}, {@remote}, {@empty}, {@multicast1}]}, @rr={0x7, 0x3}]}}}}}}}, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x1, 0x0, 0x0, 0x6, 0x0, 0x0, 0x100000000}, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000003c0)={@remote, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @ipv4={[], [], @empty}, 0x8, 0x0, 0xff22, 0x480}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000440)={0x0, 0x2, 0x8000, 0x0, [], [], [], 0x0, 0x4, 0x0, 0x0, "352ef2069a980be142a0215ff76bc52f"}) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0xc, &(0x7f0000000100), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffbffffffff, 0xffffffffffffffff, 0x1) unshare(0x40000000) write$sequencer(0xffffffffffffffff, &(0x7f0000000100)=[@t={0x81, 0x5, 0x0, 0x0, @TMR_WAIT_ABS=0xbf}], 0x8) ioctl$F2FS_IOC_START_VOLATILE_WRITE(0xffffffffffffffff, 0xf503, 0x0) 16:28:13 executing program 2: unshare(0x2000400) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x1, 0x7, 0x9}, 0x40) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000015c0)={&(0x7f0000000380)='v', 0x0, 0x0, 0x0, 0x28000, r0}, 0x38) [ 1388.062995][ T4672] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1388.126669][ T4677] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:14 executing program 5: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, 0x0, 0x37cb1133) socket$inet(0x2, 0x3, 0x100) bind$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x19404, 0x0) [ 1388.462660][ T4686] IPVS: ftp: loaded support on port[0] = 21 [ 1388.725475][ T4672] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:14 executing program 2: syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="597d766800000000000000000000000000000000000000000000000000000000fcb2096bad154c2da9a086564f36bcc3000001000000000001000000000000005f42485266535f4d07000000000000000000500000000000001010000000000000000000000000000000000000000000000000010000000000d000000000000006000000000000000100000000000000001000000010000000100000001000006100000004000000000000000000000000000000000000000000000045010000000000000000000000010000000000000000000001000000000000720000000000001000000010000000100000000000000000000000000000000000000000000000000000000000000000122badb145de474f84c86b8fd41337fdfcb2096bad154c2da9a086564f36bcc3", 0x12b, 0x10000}, {&(0x7f0000010200)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\a', 0x14, 0x10220}, {&(0x7f0000010300)="00000000000000000000000001000000000000e4000010000000000000004000000000000200000000000000000001000000000002000000000000000010000000100000001000000100000001000000000000000000100000000000122badb145de474f84c86b8fd41337fd", 0x6c, 0x10320}, {&(0x7f0000010400)="000000000000000000000000105000000000000500000000000000001010000000000004000000000000000020500000000000050000000000000000005000000000000400000000000000007050000000000004000000000000000080500000000000040000000000000000000001000000000080000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f050000000000006000000000000000010100000000000040000000000000000b0500000000000060000000000000000d050000000000006000000000000000000510000000000060000000000000000605000000000000600000000000000000000010000000000d0000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000005000000000000700000000000000001010000000000004000000000000000010500000000000070000000000000000d050000000000006000000000000000000510000000000060000000000000000605000000000000600000000000000000000010000000000d000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000050500000000000040000000000000000101000000000000400000000000000006050000000000004000000000000000000500000000000040000000000000000705000000000000400000000000000008050000000000004000000000000000000000100000000008000000000000001", 0x274, 0x10b20}], 0x0, &(0x7f0000000080)={[{@commit={'commit'}}]}) 16:28:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000300"/18, @ANYRES32=r2, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) r3 = openat$cachefiles(0xffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x2980, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000500)=0x1, 0x4) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) io_setup(0x20000000002, &(0x7f0000000440)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) io_submit(r7, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r8, &(0x7f0000000080)='\x00', 0x1}]) io_pgetevents(r7, 0x2, 0x4, &(0x7f0000000400)=[{}, {}, {}, {}], 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={[0x180, 0x2]}, 0x8}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x20, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0x4}]}, 0x20}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r3, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x58, r4, 0x20, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2f}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}, @NL80211_ATTR_MCAST_RATE={0xfffffffffffffd85, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x6e}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xa}]}, 0x58}}, 0x20000004) eventfd(0x6) 16:28:14 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x12}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:15 executing program 3: syz_emit_ethernet(0xba, &(0x7f0000000280)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x12, 0xac, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, {0x24, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x771, @empty, @local, {[@ra={0x94, 0x4}, @rr={0x7, 0xb, 0x0, [@empty, @remote]}, @cipso={0x86, 0x2d, 0x0, [{0x0, 0x2}, {0x0, 0x2}, {0x0, 0xb, "ae0dc5f2009a607c2d"}, {0x0, 0x2}, {0x0, 0xe, "1eeec88ddc184f60902976b6"}, {0x0, 0x8, "1e916a2891e6"}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@empty}, {@loopback}, {@private}, {@local}, {@remote}, {@empty}, {@multicast1}]}, @rr={0x7, 0x3}]}}}}}}}, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x1, 0x0, 0x0, 0x6, 0x0, 0x0, 0x100000000}, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000003c0)={@remote, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @ipv4={[], [], @empty}, 0x8, 0x0, 0xff22, 0x480}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000440)={0x0, 0x2, 0x8000, 0x0, [], [], [], 0x0, 0x4, 0x0, 0x0, "352ef2069a980be142a0215ff76bc52f"}) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0xc, &(0x7f0000000100), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffbffffffff, 0xffffffffffffffff, 0x1) unshare(0x40000000) write$sequencer(0xffffffffffffffff, &(0x7f0000000100)=[@t={0x81, 0x5, 0x0, 0x0, @TMR_WAIT_ABS=0xbf}], 0x8) ioctl$F2FS_IOC_START_VOLATILE_WRITE(0xffffffffffffffff, 0xf503, 0x0) 16:28:15 executing program 5: r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x5, 0x0, 0x0) 16:28:15 executing program 4: mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080)='/dev/fuse\x00', 0x42, 0x0) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002100)='fuse\x00', 0x0, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000004200)={0x50, 0x0, r1}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000000000)="9eda438838743bd4e9720bee57093515dc189a5ea685e9556c1c2c3cfc4df50d66d31a48aa312663b68d18c5826b5b55fb738208863dac0f10f423aee7a5d8ddc45ebdfeb7424bae859d7c37ecfc4b63914d5a56d91017dd22bc84f759a15969951aef9d5c88c96560896988fa18cd946cfcc3a0f1c993348377904eac32c980bdf7976ebca2b499cab63c4e841514277fc71d4620e29a92523402485de0e82896484c0ae497a4d686df23ca7b68c3fd5e624d3510d7f94838e54af877ca58a00c5a672bba11f5aa1ed1980dfef47b9973d0bf456ded5e72f1702b3dc5197fce39cba53a038d8dc0ec783ce70577107dc5e8b299e64a0b7f1191f0926bd25762370191710bab2f44e9069f55f8a3f87e4cb488a2fb3348c0bf3b3874291f83e4776b160ea73aafa3919c7c069c73c0052173a63158db8b65541d161f9c964926ad7f06bdd6cb6a32135b04e35701c2e13c49c1f75dc7a25d623378860692d172ec3f1e1f2d9dc77c015c13721efcb101c2390abb847e871132f472a37cc0163b39b1d575a5444e246a08a1afb1a696cabab29498a314429a3b9f44c43ba29f71fac1fbe0d01c3c16d22730932704bcfb0c1b7a432bc51dd3f5dd5afc3b342cbe6a6ff899039e28f9a51881b1d46fdcf31767cb6f5c5c69ab3c80615d77c4d1664fc4ec831b8cea2e752bbb7a9ce79df875b29f1e232751daf32a1a0c4ff8bd0688e2b8e2d668b8a77e20a9eb6ec2e2c23b94e507baeacbcfa31fb6e1ca3343668f43e3aa6d85e7c29bf0bb4dbdabddc92be7f4a6f5d21b19e6da17bfb6cc926e3847532fae29c7b62fb909130ec372d3c16cfe6aaf3ce2af0fe7610fde7aad61bc80d2f96b999c8ccf6d22cf903ca8ae8b879ec4a416f334982e9810c0140a18d4dc81b5edaae23e9f4abaf40ed71512aebbba5bb251545e188db789558a845a2877b14bdaeec3c738b7d730c0860531bf5517d4f0e8f95ed3571f8a35816d5116fcb8d7cbf42b7d5d5e65541508c898bb2e0fe96297d2ab7135662de39df099ebaed5871111f5346278cee5728cec512e6c0a0d65b51e3d627873195b84103341c2bc83b6c8fdd8ba17f5957413f61c69d618c9b9d0b1f08dc81921b6c662ee1da3bfa019b095e9a03c2db4d645ccb7364e895098cbf7d932c72d80663c7a1694d122f7348393079223c11d36c64a5856eae0397ab9a9d948204b74e56525a9d552dd0916de81cbb5af3c59b3d7f8f9154423ce2cb45a5bc808e24bef13212019a19545fe54ba84d01534358380192b8c7b0eda907810375bb66a578a58fec392b47991271c8367b91d710e8a176bc1a4e96f0e137d4c25fbb03eddc392f9f170dd744472b864fbbae7c93d86e682308b21b73c5652065d72cf02e1152b44024a90a3b52eb0bb3cb412e518d37a68aa4c7f46789c54ab30d3a73d0a8712fde612294cda2aa1ccf164930b9b1d17801d4fbb06e849d39bf2b5141330caa0d2618b616f1c67e1ca57080e79ed9092ba7a55e8121cfc825cd26a0199a479a7ab1b7b23d2a4dd82fa6d04ee41ca680435efc934f0451e865e8632ac2f1115f4cdd33b0fccb7a2326127faf20cba37c828613dba5a98f4e1ad25eb6b91078cf73d873df9ef91531476f64b83559ff7ccdc4c070d478b18196ea05fe8d4ea0216ee5273dfabbd04582f40f064c9781afd2cbf30901f28cd09cc934f1b2d50883778274177e3dba8af0a1b931d80ce1a6c4085780ea2195b65ecfd2953f78a5290fe560d0cd6a5e73890a5a82dc410b92a3ef2be05ec5607820fd4ca6b9c3aa258d59022fdcb21665f1ce4e8aad8fd918c43bd3c2afe3dc223ff9f48831d401c8b6996190793d1dd7551f8511b69283992398d8f9b4bd2b3398d3b8c6f3c5d8b802ca5282b70242df2b7be4b38e70c3065f8da888631375afcc05ce578089c4f783776b286b7a60d1b5e189e2742a3240c1036a953d886885422eef01413c38099b64505fd5a73488acb4e611820674c58ae74d6c64a885d4beda9bd7903bcdc71e3711e2a057c0eab2100c321050ab14c6e453c53182577ad3178603cd9afde40a701120e9a36074fd582428c74e02781318e6c65450f8f020bd22475696fe13b8c59260e53a06d16eabd135e887a0a6bbc8ad21be7661df76fec5b13844f68b8eed1a7379713738beac9f23c7a26520e19797a910cde9fb285179526889b908b7eb49bb06f70f6271fba8712c1a4269ebcf4b7d043e924e3d2c4c753fd7e547d95841e335179836f76424e728810d7f32b78256ea30c79d9238a6588426e1f2d4c0b03d5605bd826ed24f0f11326b4cf958632b86e017aa80e142db1580c44f76d9c98196f3f6852ab2bfc6a01a3553a130c2d171957f5a45c3550fbbc990ef8742a98a86b280a57b9f198ff436bc01161ada50e6f23026c3254adf2321bff7e20aa54080bbb57d8d52c6a6df6107706a2e5bc6da68f17b474c0edd39401d765086e885cf7992405f856557915603cbe8894676e996bbadbb649a5e7498b91f9bd2f697dd9ebbe4d386050258b9f4c94781e61c660651c3f1e3ae51f8c035eca365bf15d6db48ea9ce183515f4a208d010f7c23dcacbd6e225490d7e9c133525f5c9018d752b21b4897bf18b64b6a9936f538a0a8958fc934440aeeaad2b68ac844d76f0900a6c95bd0b353d85d4fb62eb88360112237fd8c636a80e3130b21d66ae8ec58a4b76cba0602f96da919f7e84fd37e3ec2379f58e389a39c78d2482e03c379e3c4649ad63a76e3707ecff07d2fcb0c9dfc524cab49e69a09c92e4f88714335cb57d3f6184d07bef9657280fb5c9fd2d8f940f7ac6c5407e3077aa2e4ba8e217e0ee19e302d6d90e3be05a86dade35d2e454e511afb5cf5936f1d11f2fa6be6ceaa817dbdc7a6aabf2fad8ff3efa8382a25099f0c5989d2ad56ae0f4968b2cfcfc67b4f1c161c75900b4848f59a3c0376dfcb7997bf28e9e85d6dd942a360516de38e1c1a038a796f9a77ff2b0c7e5e8f4932391a0e58e76dacc6f9764178a211dfde3e75d367d2911ff398126ffdf83cf2fbdf1ad5232bed9155f7a168638a572094a9e934d4969b358cf6e121d7fd2aeae2f499068b42c152f0e3403a230885d6f92f038ddaa23499f804ffb06abdbabb51f6c38c92fb1a6271a4b13d6d11125b8ec12efa5907dc65062797fb9cca15e2f254e76b182d3fcdb4e96ac4de36d6df7e7bba5c32f422286b1be3b79bffb6fd693761952d195a84ad9ceb07287a0fbefab9e0347b513c5f60233ccd4b52d90ec144a2f896d9dc7f279f8aa93038f3efa286e1c3006933a4d7183d952f8d28b141b28b2af355b5bd8198dfde1ffb8d09202aff0d16ca3fec194662892a49f829813970a4520f1228aa03d211a45bed3b2e05bf1f10b1a152761e7b6c6ddea863a3c02224256092c70ca70dc185c4c385dd98b09e2682661e1e66f71d9c4037048eb70e8a1cbe57de87ec43713abf5fdcf63b9c482f318e3bec37e878dadbae15a02d731e6c8574eb14c059d72f73be5174add786d06b585a28a06d349d8e434a491b34897b3c1ad786ec8280d7f57edd4fbc6aea5485d659b59d393e331cf91e6ed76f340fcf7cf460892fa7318fc42b883f61d888ad982a751accb613c66661fba5f3d6de751a6a9ef8a4700316aaad04e991aab7903f4ef012ec2a8c092234e74ef335daf360ae47bbd2bbc6ad8c1a4f81efe8bbd703cb55ef36b32b4e30cb5a3b165c02ba295d0e1c40ce6ff8f479a74f01275f113ebfa8ade37a59ce70e6ca2a6f48f1be085f61bf772e2c2da523a2cfe63e99c57bdb1ff23139d4fca49eff7547e9880eefd3f7511a677efa23b52098ba89037c48dfcda2e8c1cfb9f892161049e53f8cee55256279512aecab8c441600dae0fd957883273047cf5c66ba209f830aa2ce0cbe41ca08c0cef4aed7f4324009200661a7ce680e5a8df2d051c1d8b2f63d25d8d74d05c75c46c8f3f24d625539e63459650960498a54ec3b16225bbbf4d3930009df265839d72611f5332a904cdebada108236e4414a2909ad01ec44b9d7f75de4385ad7ca5152e890a0919b3639fd1bcbca3b737ebb8d9ae541b1271cf2166ba15830e66f3d3afd3b754a7f81ad4f0999704ae99c114907c5be4a4797f13b80564f234723a34dbe137dabfd7fa23562df679f54a6ab54def6d63deae9844f72fd73efd0413551f5c4b9ee826eb3b7faf92a59ea34a16723b4fea14d1c8815a4e2d39fc48d1dbce526a7c53f5a96d0ef6463a0cee73fd3505f5c764a264b83c4a21f80e8b61c82d24442d13da99d18dc1b2538e7a510f6093d9ef2bc5cc777d4f98411e93919eddfd69d6e20d227cb61c50f358ea227f4de941fb080c1cf6b1f6e25533768fe133dbfc3f9d29c603bed38aa3c5af5b81a706b0067b40b88f992610d04c7cc36b8f649697cd6a93fae51138161891ae75a7147780fc59af5a6e18c54f9d2a4fe7fa92314b399afba9a40d0cc24f70a2593acf8d179215e06b7a9a88224bafcb2cbf60caf5fe4ff38208a70793b5dc33cd572956260e1c86312d3ba9b3a4b2b44376f2e78c616a6c0880ac8dcbaa30b9f761d500fd03a8518dd0509157b184a2d95e0caf3ffc8ac2db6c54d80c71a1e5b9ea3bf51071e2118af204123daceeb04e4f6f31f32a4d3fbb76ee49440cabda2c121c1b99acab5b87cecc37c3f9066af34ab29d6598bbfd91047a2ac7ce3a8f3027ff5e6d743506f161087278896a98ed37122ba208b61cf54d3929555ab06b564cd5e4f46f4755a6cfa2ef2b30d29ea66f2749d4060d411fa9160c91b6f55cf071ac8222c6313df18759e2958cddfe3db4cbeb9cd39abcf5f0beaecae8437813995cb7ed0b87d42ca942ff7245ece204798d01361c5f008e0d82bdf76660515bc78f7f8f409ccf68614b2cb50f5af2615661326fd971bc57eeeade60ea906b8df1cb0dfafd318cd2c396309c329d0469ca192aa8f51d7c4227685440f073983255baf054b97b9d7be1d1470d7eabd5c09b2116b4e86b0567b7e97e088717a4fe3dbdd310a1c39136ea4d2c47492001f9885dba03bf97e7da376171d666441cdc2f999db137603d57df32b4260fa0165e82917bb1631ea314e7a7437e66fc68cef22cda8f456d6e583f6e3237e0bc79987a9103f7cf0918e26881f67ea582e1ff3a49177599d385bf6e42572a2547933aeddb826530e9adf30dd84c3a7fae5c4c26f6c6f3a9f0906decd314e2407825abef959c5416d18a92ff34e6c521a16e8a0a29937c77d4ee99b41d530a732acbe0bf5d274df9d496b47a9a624546bdcf9976cde12ec989cb2a70b33a7c8a3a77652023164695f9db30dfcf587f0cd4f73e385730bcbdd688f6dcb08ba0efbb9f579220afefa4acfea522e864fce9b1782ce9f14824d16e9d33a2609c23ba3c5a1af02549357a0dcc12e37819d778021762cf895abeac1125b744c8b8225a091e7be9ded9993cfa3ca9abb83e25c8f559009977a2ed9374a89619fae5ef6d164bb73d242004dc8428e44689b33ee3bbe88bb4962ab0a32a90e7aea044f08410752cb2d7aeaf3196648a3a99092665b478bb394b48f79b36db0efc7f50d6a5179c945f5298cfaac5e5dea715296f92abce7281d48a0c9c6b785a35ef5f1697c047ddb254fe9a8ab9f498b0c1ae09ffd01a3d8d427fee7e36c51e0e5c2fee2245fb8464626ab5c9857ebce91f7d22bf024d10c2d71021cd69268472de419e6cefd970cc3a8e4d1bbe6496799aa7f100411766e712aff08b731460f14f9d7356db12cf8e1c6121968dc68b1d81c086b325ca4ce6fe1f476707e08fa913144b757c6be17cf93150db29544d207f09a896f33b7335d9339215da751e7af2c6bdd19db6f521af2c8a5998dc607f97026d07111488741134c1c86eba123273d1fd5ee4b471e86f9ae9478a04c7482076ab34a1eca5c64f89e5106eed44bceec019c67c12fb4db4fdac153f4ac3b63ffeb6d30de58ec039e2dd3c181e254cd94d0a2b0b44490384cc5915b54ee1db2b6d059879bf8126c9ca976d0f7862da07ecd350930a081810a7afd72b2ad3f65b96ae9c7f91227a2b5513a559f36b90fe01be9ae5ad3ca65e2c26f358fc26b858a3633fda7ae49a5fb705220a5819b3cca41b1ccc21d7c40f5fa9c422288efa5394e4312675899d704a2aab62b8363f58fd4bc12a8bea6ffc45b4414237bf5f019321206dbba439acb5ef26641f30fdac20f964354bce94e4c9d73e137f9806deefaf6f4acaa0e76ad4fef9f6cb7fc01bbabda9612c05adbe46afcf94819e8a4b4b49ff764784fa432d47fb6d4230900043d1b4521cd6839fe8c5df4d1899fdfb13880e207cac73f0a29020bdd563bd9c2f6bcd1ec523b3e03ebf6164fc65af001830c51396f9df2d346f83a59cfc82201cf1150ea57259d579fc2ed199b3fbe42d5188c84e4354610743e5b23a265246313cc63913f17412fa00d98b379b80b96d936969572e11316bc8926cb23115186f3b2387b82c3898fa41bf16a308da62d5a3eb3609af1943fddde08a4036eb2a41b7292caad9eb082614b02a1fa255bc7abd4d0e3b4ec1801e131e68c7aa9da1a0ff10f9de87dec8fad1ad8bfa99caa49e203a7b9c33e044d4544a537471e7a452468b821959bc488c6b8cbf81e90081a26de273ad1203cc06adb6af242ab19f96c1c66b58c37e2c9309704fba63af99a8d9c5efc651afb631fe9f546b938cc3b8e526c4159e5c9f7afb29fd1d55fabf09367ce2a63a35e7a2062d1c772ed981fd77157a847f687a177cf9886ce41df8cc509302b46bc1e2ba896b1c1656a1bbfdf4cd9ac39cf8510d1c823075f16550fd044aacc8d42a56f03718f7b18475cdc3999faeb25ab3dd8a807ee04d8e5d831d08b4e309dff50330685138797e10c6362636f53f22bfc1f3d5090a5d369282d9de36bb4e2505411ccc6ea395afa1567b15a2fb4be2adeea7126b1a8e80034105e0d98bdd78e796ce1cdc06a4ae666fc0baec5c52614340ed997673e26ec47c88846c000bb7c9077337cd44f5c041fdcc64986e5e1c0f488148f0ee6f842c44c0b72e82109270341bba6e9080b70fcf930d0f10be5a36798e70111fed72727b72282ff164fc08319d74f1f57cde71b57cb397a9e753f87b97729bafba017a24cbfdee5dfe7fc296c112e93bb8fce560ca80a3afd8370baaa79ad783b51352b5440b144a47378c9ae22eda5794328e95bcca220fd07bb56915529b155c61858efe89ad36a79288e74c0e251addcfaf797432175a5562b46eff5e3aebeb74623e18beef85389383c604d8884431b07dc4bea0174aadc337ff41f558a63f16690feae47efa2a5d1318b7397e1e4ba398727d286791b71610e1d78d32800e7e113c12abf0f60b6ca4401ecd23b7aacd990633b2b017daf6bfef1b2361ece74b7dbcbb1a73d4bc1f9d2e5c9fb0b7980d25cc44d1b10c09ef5a6a05c84669294a5cadf0cd88ab449f9f0bcdd8c48590d416c5c1feaa494a2145949c2a3373df7c6014225f2745bbeb20ff294d22c0d96ca111e6926946207cab56a03162a49e68968e398f70690188ee3ca847ef421742d60b9a6ad029e8a3d607950b2bf8ad8ff297cb39acc94905635770436e134435e28205140331b5100d9f64469792fffac87bca0835cbc617446ff86a7b50418c305f32e658b32130e491e38709fd3697017ac8084cdf1ed81a28375aed092ab4e32ca88a933154dd3a9e99351acbada926b67b310c7070ac1a414a28c5abfe1f45476249a12f18ca2d981528d881ed3c5072e46a6eff3cdf37dcbc89c7f79c88a1f8d15d15beb66a0e4440c7b93e379c4e2bac1d5c8e85f1852887e2cfeb178fba1c67dc2adb0c87df8ca4444ca7f455509f492effb5001328b8cc696e2933207a2d78bbce8562ca34a248193c914406b161c8141479d891b0c6110ec1e25cad38299b489f2ec437017cadba67dcb58abd4933c95b3526f1d4747b8701a7d71e446e4b62e2941d4281faca0cf22914be5aad80f47100000000ceb24e82508fe55a92fb6db70d03d1c1ec09cfee31639341756a4630a0eaaecac7bfbddf9d30c42cbd45eb181d5bd341307ad26f496bb042e2b655c03ac3dcc587acbf50f79b5c239be9938b62d3251b199f8413b020605d5d0552cfd9c39c9132719d6d0a326b000e12fcb51bc274df79d11430060d05978cdd50583f1bca82c57dbee605e2d00fcb5414af13a596d35cb5ba62de6a28cbccc857d23547b1c7fd5ac8fbf6758d5b8451fa46d9acc00344dc2e565674b1dd3547eb8f8aa5fff99042f8d1d59e6ad2f53379211e6832fcb68f5777eb2db85b28f724f4e4ce6342cf55713ff7b0cb4f7f47dd12a6566b86709eaefae024373267ce72a89e7f3e42ab48edcccc96b5d0403fe93a927e5ccf470014f220b8257393226cd7b996f20e6a34f81206733a9fdce03b701943c1b560d3eab68c2c225cf7f7f2b56123be2bb173e9e5b37f4d3348f6b987764ad07c2acd44514ff264d7eda31e5e517a179414841ad4553d51c08f435e05f10aa82d74b97a9ba3a133e6c9175fdcd4f3dc9c16d3be1d5bbaf13240177081ac1d56681bfa988a93af09868afd608520c0bfd71d857a6661fdaf6f2e166987eb007449dd26334ae932c5003fefc0f983b9e49cbfcea325f2de16a9ae935caa46f5b3433957fb370971ed957f138f08a60fed5b84995e428e7ae7d5c22021ff016baef0e713a118344c016a99ad469313ba7f2452da0dd82e019f64aa229cf80a69b3e08ac5847f10d247179855546313232f23e055c2f74ecef14e0fdcc29a9bf0976fbb249bd5c7903183d2a53c70960a183630e7d4928daa7091a85ad987d2a4a5b8f6be6612fa72d9fbb33c67bb38eff19f2e784f94e0354cf6d35a5b2c62233c039de3734b38e97ec72bd673fef09fd56fec329818cc68cdf12cb52f7d37a8350c16e94208880bfcd3e895d7aa4489e3dd15db4a9026f0d2a46f1e89c35845dbd976a1992b87c15a0c7580e6424b8792a7bb7b933d7c5433d4133ba4dbbcf7995d6ed3feaa32f876a287feeb9cc6107778c1f83e0119d980b9e994c2a3ae3de24a103efb3cacb746b49d1ad85746b233ab4aaf0e988ec2a786bc93f32040d3bdc3008031634cdfded5ac95b2279e096243228296591e7ba53c4a127772cc4620e6b238ccad250629194533d0a669ff3366c52d64928693e0b0cbb0b8e2c6029089d4dfe2b4b6c5dcd85f1a02770611e65001e48a32a8b0431a3b9d77fa3a95be38a0436a704c05a8e0183f3214c25531a63796f679bf72885aa766468d42b2543542d7e82544efc5c5e81e6a91a0f5d4e68000cff687d63e45c9a11d4ef515050daa592c9a828ac7c0488e7cdb3d6fdaef5e9176ee68d981ea50d386d74df3b40660351736deb03bfceb721878cf9894b0302df15964242ab6b9f77f98ba1c7993735983d2b022600ab74a19e3636e1400d08ba45d3a5c2774cb06a1c358bbfc11d27efaf7ca53c2e7757c8c76da24707d91a4a5244262898d68083ff91c514d9b9b1ebaa0cb0b10254fda1b1e82b9a1a47f117b5b280ddbec1f6732d11117ef1a7a674699df87fe795d1243cb9c4527e364e2b711b6562a87fafc130ce0baf1701686639b05f0c8dc708f008b1e6ab89e8d623bb83f3d54b7bcdbdacd055ac4eccbd36bbe0af0f65a00e3d6dd985ae8851d176976cfb5816d1fc2a63d3546aecaa4e712ca6961d1f181315d553de6b53485faed0dcfcf819a1ba3badffe797377d3d1ddaed8e7a0acc0c3d277762262a139f94de49faca167b11bf04f2104a5ab9a73367a6461f7124c91a2c4229ef98e6ebde9aac283c7d029400d71293f488ba169b62c1e94689cf5b248ed4aea62b88d65bb764cfe27d5231a58486e7381df518f4ed81cb905108c54a5050a94ca0e94da20d3794bc5fab9127dc95b6404b1e27b4e28136fc27806f7be798444c33aca88ffd45b860eba0d5033839f5a092863954604f1952bd61dad23b11643fe14f3ade08116aa2c13eee701ccd13e506bd65a1060bf69579aea8c8143cd38c0891a3065f251eba0c20ab9c69ddf28e3bd6400cc203bac8de1882239ad4e1b97b0ae2f1abb7bac7c0d8ef82b97ebfb1f5577f06a3a1377b09ada4db87d342f20ab0eca4b9c206042471307511429cb57a578211f92d3647189861cad9145f5eb26ab696abe50a2a6c1b469df97da28aba4e79b586c348a430f5ea61c4be1032fa61d18581f05a07fb8707c8996e0fff1c3eda59b992687fa12483b9327e10224b20d42e8b3fc4670bf070ced602283273d6818acd1f6da567c44d3f5e1377065d43d87d889843ae48e7fa8ba1634815695b8c480ca271e6e833799c70da80fd79acc09b989667a2294de5da73f0363df9a33ad4dab8d27cf7bed0a06838672e3d07d52b6396e9b5576021d5e925abd533bf161c944795065fdd44e8462e3070c479f1c118276653488dd9b2f1a673f8cad3612ca1fab4388ec9c8f834a01a499adb7b3a9a977672f6d75b41bbdd7f91ceb7e7a88568d17bb432be9e4e96e115075bce197ef4754d2914c2c59e2d7f4c08f0dbe34d31f229428f211bf1d7e8f5c319ed4a8273cb6255eb318851ac4557b0278fac63107a54d407c42f300b843a12abd3b893b46c7efac2e388ab42b87aebe2543bd4c15f459bc50aad10ffe1c1196fb52c26e54bdaa7fbd52451f207ffb073ef4b3f71eedd7da40c89505019739e3fa733bcdc84ff4919e8fe2358129ef28291be1d6426b8bafe88463b1d3cd7273745381c7f65221898e6ad361e88b24c54ccc7ac9a830145b6dc096e2d71ef71ec4f03524cb870b724e08d223bdec2f6fdde6200217a13b5136004d455d66547f5a1793e0cad85677d49e5c558852107007c8136812cf021afaf6f7e8f59883371be46cda412dd9c6fcf187c31252ceb5758901d39cd5355ab386d9a7fe6ea46ebf277aaf809c3023211ea9aa189de4d422080ebb9fec50ffab6b95ba4ae5018accc497e79149ed6047ce561ccc10e9194cdccd5c9fb75175c8dbc9d0a916ad59288f010defbbb50d263041ab37aac0f93253bef6f898cd0825d99d27224f26181f9713b8979da64756c95e7505f25a2688960d6155c3613dcc31b6c337a6dbfc6b12cfde1db22b93bbd5e48534fb0bda8b212577a14dcf665c834b0bd24e5f624d2455fe048dbe930328d7cb632db3b0e244bb5d43390b420b15157a339487fc78976f867d3a361aafdd3f50a93c01882da7c220089a544381db22e2c86b228dc2be01820468460437588952a549d37498e529e62aa62bad1580546bcb1e9a6ed1870b7838d05d12f6e3a041e78b1bdb80894626f20889ccb3a468aa4fb24b9c87cbb28623ce59c6b3c6286db366d08004551a25fe4d8d194a2bb7c52e1c85a5fbe4cb15b171489da121bea1c469a6bb185d63213084e3a81ee54dc03a94dc5ecdda7bfaad1df68021aaf4627c9d529f13e5c81b5ee4dd228949ca16b9a61d186211d153294470907557e5e14ae665013f285fe4d3766e7b3d8ce5e2a14692072d4d8f79354bcc8db8a2a36c8bcd", 0x2000, &(0x7f00000069c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000066c0)={0x90, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x801}}}, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f00000020c0)='./file0/file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f00000046c0)={0x53, 0x0, 0x0, 0x0, @scatter={0x1, 0x0, &(0x7f0000004280)=[{&(0x7f0000002000)=""/98, 0x62}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1389.461182][ T4718] BTRFS: device fsid fcb2096b-ad15-4c2d-a9a0-86564f36bcc3 devid 1 transid 7 /dev/loop2 scanned by syz-executor.2 (4718) [ 1389.613672][ T3511] tipc: TX() has been purged, node left! [ 1389.680655][ T3511] tipc: TX() has been purged, node left! [ 1389.689082][ T4718] BTRFS info (device loop2): using default commit interval 30s [ 1389.697466][ T4718] BTRFS info (device loop2): disk space caching is enabled [ 1389.705355][ T4718] BTRFS info (device loop2): has skinny extents [ 1389.718184][ T4725] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1389.745016][ T3511] tipc: TX() has been purged, node left! [ 1389.789010][ T4731] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1389.817144][ T3511] tipc: TX() has been purged, node left! [ 1390.117322][ T4754] IPVS: ftp: loaded support on port[0] = 21 [ 1390.150101][ T4718] attempt to access beyond end of device [ 1390.156084][ T4718] loop2: rw=4096, want=2064, limit=267 16:28:16 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x8, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000001000000000000000000000073013300000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x3e2, &(0x7f00001a7f05)=""/251}, 0x34) [ 1390.253655][ T4725] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1390.310539][ T4718] BTRFS error (device loop2): failed to read chunk root [ 1390.455057][ T4718] BTRFS error (device loop2): open_ctree failed 16:28:16 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00') sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000fc0)={0x2c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0x4, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}]}]}, 0x2c}}, 0x0) 16:28:16 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x13}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:16 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) rt_sigreturn() [ 1391.575293][ T4798] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1391.639534][ T4800] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:17 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@ipv6_delroute={0x28, 0x19, 0x1, 0x0, 0x0, {}, [@RTA_MULTIPATH={0xc, 0x9, {0x8}}]}, 0x28}}, 0x0) 16:28:17 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000005740)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000140)={0x3, 0xffffffffffffffad, 0xfa00, {{0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, {0xa, 0x0, 0x0, @empty}}}, 0x48) [ 1392.019698][ T4800] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:18 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = openat$autofs(0xffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r3, 0x0, 0x40, &(0x7f00000002c0)={'security\x00'}, &(0x7f0000000040)=0x54) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:28:18 executing program 3: mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080)='/dev/fuse\x00', 0x42, 0x0) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002100)='fuse\x00', 0x0, &(0x7f0000004300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000004200)={0x50, 0x0, r1}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000000000)="9eda438838743bd4e9720bee57093515dc189a5ea685e9556c1c2c3cfc4df50d66d31a48aa312663b68d18c5826b5b55fb738208863dac0f10f423aee7a5d8ddc45ebdfeb7424bae859d7c37ecfc4b63914d5a56d91017dd22bc84f759a15969951aef9d5c88c96560896988fa18cd946cfcc3a0f1c993348377904eac32c980bdf7976ebca2b499cab63c4e841514277fc71d4620e29a92523402485de0e82896484c0ae497a4d686df23ca7b68c3fd5e624d3510d7f94838e54af877ca58a00c5a672bba11f5aa1ed1980dfef47b9973d0bf456ded5e72f1702b3dc5197fce39cba53a038d8dc0ec783ce70577107dc5e8b299e64a0b7f1191f0926bd25762370191710bab2f44e9069f55f8a3f87e4cb488a2fb3348c0bf3b3874291f83e4776b160ea73aafa3919c7c069c73c0052173a63158db8b65541d161f9c964926ad7f06bdd6cb6a32135b04e35701c2e13c49c1f75dc7a25d623378860692d172ec3f1e1f2d9dc77c015c13721efcb101c2390abb847e871132f472a37cc0163b39b1d575a5444e246a08a1afb1a696cabab29498a314429a3b9f44c43ba29f71fac1fbe0d01c3c16d22730932704bcfb0c1b7a432bc51dd3f5dd5afc3b342cbe6a6ff899039e28f9a51881b1d46fdcf31767cb6f5c5c69ab3c80615d77c4d1664fc4ec831b8cea2e752bbb7a9ce79df875b29f1e232751daf32a1a0c4ff8bd0688e2b8e2d668b8a77e20a9eb6ec2e2c23b94e507baeacbcfa31fb6e1ca3343668f43e3aa6d85e7c29bf0bb4dbdabddc92be7f4a6f5d21b19e6da17bfb6cc926e3847532fae29c7b62fb909130ec372d3c16cfe6aaf3ce2af0fe7610fde7aad61bc80d2f96b999c8ccf6d22cf903ca8ae8b879ec4a416f334982e9810c0140a18d4dc81b5edaae23e9f4abaf40ed71512aebbba5bb251545e188db789558a845a2877b14bdaeec3c738b7d730c0860531bf5517d4f0e8f95ed3571f8a35816d5116fcb8d7cbf42b7d5d5e65541508c898bb2e0fe96297d2ab7135662de39df099ebaed5871111f5346278cee5728cec512e6c0a0d65b51e3d627873195b84103341c2bc83b6c8fdd8ba17f5957413f61c69d618c9b9d0b1f08dc81921b6c662ee1da3bfa019b095e9a03c2db4d645ccb7364e895098cbf7d932c72d80663c7a1694d122f7348393079223c11d36c64a5856eae0397ab9a9d948204b74e56525a9d552dd0916de81cbb5af3c59b3d7f8f9154423ce2cb45a5bc808e24bef13212019a19545fe54ba84d01534358380192b8c7b0eda907810375bb66a578a58fec392b47991271c8367b91d710e8a176bc1a4e96f0e137d4c25fbb03eddc392f9f170dd744472b864fbbae7c93d86e682308b21b73c5652065d72cf02e1152b44024a90a3b52eb0bb3cb412e518d37a68aa4c7f46789c54ab30d3a73d0a8712fde612294cda2aa1ccf164930b9b1d17801d4fbb06e849d39bf2b5141330caa0d2618b616f1c67e1ca57080e79ed9092ba7a55e8121cfc825cd26a0199a479a7ab1b7b23d2a4dd82fa6d04ee41ca680435efc934f0451e865e8632ac2f1115f4cdd33b0fccb7a2326127faf20cba37c828613dba5a98f4e1ad25eb6b91078cf73d873df9ef91531476f64b83559ff7ccdc4c070d478b18196ea05fe8d4ea0216ee5273dfabbd04582f40f064c9781afd2cbf30901f28cd09cc934f1b2d50883778274177e3dba8af0a1b931d80ce1a6c4085780ea2195b65ecfd2953f78a5290fe560d0cd6a5e73890a5a82dc410b92a3ef2be05ec5607820fd4ca6b9c3aa258d59022fdcb21665f1ce4e8aad8fd918c43bd3c2afe3dc223ff9f48831d401c8b6996190793d1dd7551f8511b69283992398d8f9b4bd2b3398d3b8c6f3c5d8b802ca5282b70242df2b7be4b38e70c3065f8da888631375afcc05ce578089c4f783776b286b7a60d1b5e189e2742a3240c1036a953d886885422eef01413c38099b64505fd5a73488acb4e611820674c58ae74d6c64a885d4beda9bd7903bcdc71e3711e2a057c0eab2100c321050ab14c6e453c53182577ad3178603cd9afde40a701120e9a36074fd582428c74e02781318e6c65450f8f020bd22475696fe13b8c59260e53a06d16eabd135e887a0a6bbc8ad21be7661df76fec5b13844f68b8eed1a7379713738beac9f23c7a26520e19797a910cde9fb285179526889b908b7eb49bb06f70f6271fba8712c1a4269ebcf4b7d043e924e3d2c4c753fd7e547d95841e335179836f76424e728810d7f32b78256ea30c79d9238a6588426e1f2d4c0b03d5605bd826ed24f0f11326b4cf958632b86e017aa80e142db1580c44f76d9c98196f3f6852ab2bfc6a01a3553a130c2d171957f5a45c3550fbbc990ef8742a98a86b280a57b9f198ff436bc01161ada50e6f23026c3254adf2321bff7e20aa54080bbb57d8d52c6a6df6107706a2e5bc6da68f17b474c0edd39401d765086e885cf7992405f856557915603cbe8894676e996bbadbb649a5e7498b91f9bd2f697dd9ebbe4d386050258b9f4c94781e61c660651c3f1e3ae51f8c035eca365bf15d6db48ea9ce183515f4a208d010f7c23dcacbd6e225490d7e9c133525f5c9018d752b21b4897bf18b64b6a9936f538a0a8958fc934440aeeaad2b68ac844d76f0900a6c95bd0b353d85d4fb62eb88360112237fd8c636a80e3130b21d66ae8ec58a4b76cba0602f96da919f7e84fd37e3ec2379f58e389a39c78d2482e03c379e3c4649ad63a76e3707ecff07d2fcb0c9dfc524cab49e69a09c92e4f88714335cb57d3f6184d07bef9657280fb5c9fd2d8f940f7ac6c5407e3077aa2e4ba8e217e0ee19e302d6d90e3be05a86dade35d2e454e511afb5cf5936f1d11f2fa6be6ceaa817dbdc7a6aabf2fad8ff3efa8382a25099f0c5989d2ad56ae0f4968b2cfcfc67b4f1c161c75900b4848f59a3c0376dfcb7997bf28e9e85d6dd942a360516de38e1c1a038a796f9a77ff2b0c7e5e8f4932391a0e58e76dacc6f9764178a211dfde3e75d367d2911ff398126ffdf83cf2fbdf1ad5232bed9155f7a168638a572094a9e934d4969b358cf6e121d7fd2aeae2f499068b42c152f0e3403a230885d6f92f038ddaa23499f804ffb06abdbabb51f6c38c92fb1a6271a4b13d6d11125b8ec12efa5907dc65062797fb9cca15e2f254e76b182d3fcdb4e96ac4de36d6df7e7bba5c32f422286b1be3b79bffb6fd693761952d195a84ad9ceb07287a0fbefab9e0347b513c5f60233ccd4b52d90ec144a2f896d9dc7f279f8aa93038f3efa286e1c3006933a4d7183d952f8d28b141b28b2af355b5bd8198dfde1ffb8d09202aff0d16ca3fec194662892a49f829813970a4520f1228aa03d211a45bed3b2e05bf1f10b1a152761e7b6c6ddea863a3c02224256092c70ca70dc185c4c385dd98b09e2682661e1e66f71d9c4037048eb70e8a1cbe57de87ec43713abf5fdcf63b9c482f318e3bec37e878dadbae15a02d731e6c8574eb14c059d72f73be5174add786d06b585a28a06d349d8e434a491b34897b3c1ad786ec8280d7f57edd4fbc6aea5485d659b59d393e331cf91e6ed76f340fcf7cf460892fa7318fc42b883f61d888ad982a751accb613c66661fba5f3d6de751a6a9ef8a4700316aaad04e991aab7903f4ef012ec2a8c092234e74ef335daf360ae47bbd2bbc6ad8c1a4f81efe8bbd703cb55ef36b32b4e30cb5a3b165c02ba295d0e1c40ce6ff8f479a74f01275f113ebfa8ade37a59ce70e6ca2a6f48f1be085f61bf772e2c2da523a2cfe63e99c57bdb1ff23139d4fca49eff7547e9880eefd3f7511a677efa23b52098ba89037c48dfcda2e8c1cfb9f892161049e53f8cee55256279512aecab8c441600dae0fd957883273047cf5c66ba209f830aa2ce0cbe41ca08c0cef4aed7f4324009200661a7ce680e5a8df2d051c1d8b2f63d25d8d74d05c75c46c8f3f24d625539e63459650960498a54ec3b16225bbbf4d3930009df265839d72611f5332a904cdebada108236e4414a2909ad01ec44b9d7f75de4385ad7ca5152e890a0919b3639fd1bcbca3b737ebb8d9ae541b1271cf2166ba15830e66f3d3afd3b754a7f81ad4f0999704ae99c114907c5be4a4797f13b80564f234723a34dbe137dabfd7fa23562df679f54a6ab54def6d63deae9844f72fd73efd0413551f5c4b9ee826eb3b7faf92a59ea34a16723b4fea14d1c8815a4e2d39fc48d1dbce526a7c53f5a96d0ef6463a0cee73fd3505f5c764a264b83c4a21f80e8b61c82d24442d13da99d18dc1b2538e7a510f6093d9ef2bc5cc777d4f98411e93919eddfd69d6e20d227cb61c50f358ea227f4de941fb080c1cf6b1f6e25533768fe133dbfc3f9d29c603bed38aa3c5af5b81a706b0067b40b88f992610d04c7cc36b8f649697cd6a93fae51138161891ae75a7147780fc59af5a6e18c54f9d2a4fe7fa92314b399afba9a40d0cc24f70a2593acf8d179215e06b7a9a88224bafcb2cbf60caf5fe4ff38208a70793b5dc33cd572956260e1c86312d3ba9b3a4b2b44376f2e78c616a6c0880ac8dcbaa30b9f761d500fd03a8518dd0509157b184a2d95e0caf3ffc8ac2db6c54d80c71a1e5b9ea3bf51071e2118af204123daceeb04e4f6f31f32a4d3fbb76ee49440cabda2c121c1b99acab5b87cecc37c3f9066af34ab29d6598bbfd91047a2ac7ce3a8f3027ff5e6d743506f161087278896a98ed37122ba208b61cf54d3929555ab06b564cd5e4f46f4755a6cfa2ef2b30d29ea66f2749d4060d411fa9160c91b6f55cf071ac8222c6313df18759e2958cddfe3db4cbeb9cd39abcf5f0beaecae8437813995cb7ed0b87d42ca942ff7245ece204798d01361c5f008e0d82bdf76660515bc78f7f8f409ccf68614b2cb50f5af2615661326fd971bc57eeeade60ea906b8df1cb0dfafd318cd2c396309c329d0469ca192aa8f51d7c4227685440f073983255baf054b97b9d7be1d1470d7eabd5c09b2116b4e86b0567b7e97e088717a4fe3dbdd310a1c39136ea4d2c47492001f9885dba03bf97e7da376171d666441cdc2f999db137603d57df32b4260fa0165e82917bb1631ea314e7a7437e66fc68cef22cda8f456d6e583f6e3237e0bc79987a9103f7cf0918e26881f67ea582e1ff3a49177599d385bf6e42572a2547933aeddb826530e9adf30dd84c3a7fae5c4c26f6c6f3a9f0906decd314e2407825abef959c5416d18a92ff34e6c521a16e8a0a29937c77d4ee99b41d530a732acbe0bf5d274df9d496b47a9a624546bdcf9976cde12ec989cb2a70b33a7c8a3a77652023164695f9db30dfcf587f0cd4f73e385730bcbdd688f6dcb08ba0efbb9f579220afefa4acfea522e864fce9b1782ce9f14824d16e9d33a2609c23ba3c5a1af02549357a0dcc12e37819d778021762cf895abeac1125b744c8b8225a091e7be9ded9993cfa3ca9abb83e25c8f559009977a2ed9374a89619fae5ef6d164bb73d242004dc8428e44689b33ee3bbe88bb4962ab0a32a90e7aea044f08410752cb2d7aeaf3196648a3a99092665b478bb394b48f79b36db0efc7f50d6a5179c945f5298cfaac5e5dea715296f92abce7281d48a0c9c6b785a35ef5f1697c047ddb254fe9a8ab9f498b0c1ae09ffd01a3d8d427fee7e36c51e0e5c2fee2245fb8464626ab5c9857ebce91f7d22bf024d10c2d71021cd69268472de419e6cefd970cc3a8e4d1bbe6496799aa7f100411766e712aff08b731460f14f9d7356db12cf8e1c6121968dc68b1d81c086b325ca4ce6fe1f476707e08fa913144b757c6be17cf93150db29544d207f09a896f33b7335d9339215da751e7af2c6bdd19db6f521af2c8a5998dc607f97026d07111488741134c1c86eba123273d1fd5ee4b471e86f9ae9478a04c7482076ab34a1eca5c64f89e5106eed44bceec019c67c12fb4db4fdac153f4ac3b63ffeb6d30de58ec039e2dd3c181e254cd94d0a2b0b44490384cc5915b54ee1db2b6d059879bf8126c9ca976d0f7862da07ecd350930a081810a7afd72b2ad3f65b96ae9c7f91227a2b5513a559f36b90fe01be9ae5ad3ca65e2c26f358fc26b858a3633fda7ae49a5fb705220a5819b3cca41b1ccc21d7c40f5fa9c422288efa5394e4312675899d704a2aab62b8363f58fd4bc12a8bea6ffc45b4414237bf5f019321206dbba439acb5ef26641f30fdac20f964354bce94e4c9d73e137f9806deefaf6f4acaa0e76ad4fef9f6cb7fc01bbabda9612c05adbe46afcf94819e8a4b4b49ff764784fa432d47fb6d4230900043d1b4521cd6839fe8c5df4d1899fdfb13880e207cac73f0a29020bdd563bd9c2f6bcd1ec523b3e03ebf6164fc65af001830c51396f9df2d346f83a59cfc82201cf1150ea57259d579fc2ed199b3fbe42d5188c84e4354610743e5b23a265246313cc63913f17412fa00d98b379b80b96d936969572e11316bc8926cb23115186f3b2387b82c3898fa41bf16a308da62d5a3eb3609af1943fddde08a4036eb2a41b7292caad9eb082614b02a1fa255bc7abd4d0e3b4ec1801e131e68c7aa9da1a0ff10f9de87dec8fad1ad8bfa99caa49e203a7b9c33e044d4544a537471e7a452468b821959bc488c6b8cbf81e90081a26de273ad1203cc06adb6af242ab19f96c1c66b58c37e2c9309704fba63af99a8d9c5efc651afb631fe9f546b938cc3b8e526c4159e5c9f7afb29fd1d55fabf09367ce2a63a35e7a2062d1c772ed981fd77157a847f687a177cf9886ce41df8cc509302b46bc1e2ba896b1c1656a1bbfdf4cd9ac39cf8510d1c823075f16550fd044aacc8d42a56f03718f7b18475cdc3999faeb25ab3dd8a807ee04d8e5d831d08b4e309dff50330685138797e10c6362636f53f22bfc1f3d5090a5d369282d9de36bb4e2505411ccc6ea395afa1567b15a2fb4be2adeea7126b1a8e80034105e0d98bdd78e796ce1cdc06a4ae666fc0baec5c52614340ed997673e26ec47c88846c000bb7c9077337cd44f5c041fdcc64986e5e1c0f488148f0ee6f842c44c0b72e82109270341bba6e9080b70fcf930d0f10be5a36798e70111fed72727b72282ff164fc08319d74f1f57cde71b57cb397a9e753f87b97729bafba017a24cbfdee5dfe7fc296c112e93bb8fce560ca80a3afd8370baaa79ad783b51352b5440b144a47378c9ae22eda5794328e95bcca220fd07bb56915529b155c61858efe89ad36a79288e74c0e251addcfaf797432175a5562b46eff5e3aebeb74623e18beef85389383c604d8884431b07dc4bea0174aadc337ff41f558a63f16690feae47efa2a5d1318b7397e1e4ba398727d286791b71610e1d78d32800e7e113c12abf0f60b6ca4401ecd23b7aacd990633b2b017daf6bfef1b2361ece74b7dbcbb1a73d4bc1f9d2e5c9fb0b7980d25cc44d1b10c09ef5a6a05c84669294a5cadf0cd88ab449f9f0bcdd8c48590d416c5c1feaa494a2145949c2a3373df7c6014225f2745bbeb20ff294d22c0d96ca111e6926946207cab56a03162a49e68968e398f70690188ee3ca847ef421742d60b9a6ad029e8a3d607950b2bf8ad8ff297cb39acc94905635770436e134435e28205140331b5100d9f64469792fffac87bca0835cbc617446ff86a7b50418c305f32e658b32130e491e38709fd3697017ac8084cdf1ed81a28375aed092ab4e32ca88a933154dd3a9e99351acbada926b67b310c7070ac1a414a28c5abfe1f45476249a12f18ca2d981528d881ed3c5072e46a6eff3cdf37dcbc89c7f79c88a1f8d15d15beb66a0e4440c7b93e379c4e2bac1d5c8e85f1852887e2cfeb178fba1c67dc2adb0c87df8ca4444ca7f455509f492effb5001328b8cc696e2933207a2d78bbce8562ca34a248193c914406b161c8141479d891b0c6110ec1e25cad38299b489f2ec437017cadba67dcb58abd4933c95b3526f1d4747b8701a7d71e446e4b62e2941d4281faca0cf22914be5aad80f47100000000ceb24e82508fe55a92fb6db70d03d1c1ec09cfee31639341756a4630a0eaaecac7bfbddf9d30c42cbd45eb181d5bd341307ad26f496bb042e2b655c03ac3dcc587acbf50f79b5c239be9938b62d3251b199f8413b020605d5d0552cfd9c39c9132719d6d0a326b000e12fcb51bc274df79d11430060d05978cdd50583f1bca82c57dbee605e2d00fcb5414af13a596d35cb5ba62de6a28cbccc857d23547b1c7fd5ac8fbf6758d5b8451fa46d9acc00344dc2e565674b1dd3547eb8f8aa5fff99042f8d1d59e6ad2f53379211e6832fcb68f5777eb2db85b28f724f4e4ce6342cf55713ff7b0cb4f7f47dd12a6566b86709eaefae024373267ce72a89e7f3e42ab48edcccc96b5d0403fe93a927e5ccf470014f220b8257393226cd7b996f20e6a34f81206733a9fdce03b701943c1b560d3eab68c2c225cf7f7f2b56123be2bb173e9e5b37f4d3348f6b987764ad07c2acd44514ff264d7eda31e5e517a179414841ad4553d51c08f435e05f10aa82d74b97a9ba3a133e6c9175fdcd4f3dc9c16d3be1d5bbaf13240177081ac1d56681bfa988a93af09868afd608520c0bfd71d857a6661fdaf6f2e166987eb007449dd26334ae932c5003fefc0f983b9e49cbfcea325f2de16a9ae935caa46f5b3433957fb370971ed957f138f08a60fed5b84995e428e7ae7d5c22021ff016baef0e713a118344c016a99ad469313ba7f2452da0dd82e019f64aa229cf80a69b3e08ac5847f10d247179855546313232f23e055c2f74ecef14e0fdcc29a9bf0976fbb249bd5c7903183d2a53c70960a183630e7d4928daa7091a85ad987d2a4a5b8f6be6612fa72d9fbb33c67bb38eff19f2e784f94e0354cf6d35a5b2c62233c039de3734b38e97ec72bd673fef09fd56fec329818cc68cdf12cb52f7d37a8350c16e94208880bfcd3e895d7aa4489e3dd15db4a9026f0d2a46f1e89c35845dbd976a1992b87c15a0c7580e6424b8792a7bb7b933d7c5433d4133ba4dbbcf7995d6ed3feaa32f876a287feeb9cc6107778c1f83e0119d980b9e994c2a3ae3de24a103efb3cacb746b49d1ad85746b233ab4aaf0e988ec2a786bc93f32040d3bdc3008031634cdfded5ac95b2279e096243228296591e7ba53c4a127772cc4620e6b238ccad250629194533d0a669ff3366c52d64928693e0b0cbb0b8e2c6029089d4dfe2b4b6c5dcd85f1a02770611e65001e48a32a8b0431a3b9d77fa3a95be38a0436a704c05a8e0183f3214c25531a63796f679bf72885aa766468d42b2543542d7e82544efc5c5e81e6a91a0f5d4e68000cff687d63e45c9a11d4ef515050daa592c9a828ac7c0488e7cdb3d6fdaef5e9176ee68d981ea50d386d74df3b40660351736deb03bfceb721878cf9894b0302df15964242ab6b9f77f98ba1c7993735983d2b022600ab74a19e3636e1400d08ba45d3a5c2774cb06a1c358bbfc11d27efaf7ca53c2e7757c8c76da24707d91a4a5244262898d68083ff91c514d9b9b1ebaa0cb0b10254fda1b1e82b9a1a47f117b5b280ddbec1f6732d11117ef1a7a674699df87fe795d1243cb9c4527e364e2b711b6562a87fafc130ce0baf1701686639b05f0c8dc708f008b1e6ab89e8d623bb83f3d54b7bcdbdacd055ac4eccbd36bbe0af0f65a00e3d6dd985ae8851d176976cfb5816d1fc2a63d3546aecaa4e712ca6961d1f181315d553de6b53485faed0dcfcf819a1ba3badffe797377d3d1ddaed8e7a0acc0c3d277762262a139f94de49faca167b11bf04f2104a5ab9a73367a6461f7124c91a2c4229ef98e6ebde9aac283c7d029400d71293f488ba169b62c1e94689cf5b248ed4aea62b88d65bb764cfe27d5231a58486e7381df518f4ed81cb905108c54a5050a94ca0e94da20d3794bc5fab9127dc95b6404b1e27b4e28136fc27806f7be798444c33aca88ffd45b860eba0d5033839f5a092863954604f1952bd61dad23b11643fe14f3ade08116aa2c13eee701ccd13e506bd65a1060bf69579aea8c8143cd38c0891a3065f251eba0c20ab9c69ddf28e3bd6400cc203bac8de1882239ad4e1b97b0ae2f1abb7bac7c0d8ef82b97ebfb1f5577f06a3a1377b09ada4db87d342f20ab0eca4b9c206042471307511429cb57a578211f92d3647189861cad9145f5eb26ab696abe50a2a6c1b469df97da28aba4e79b586c348a430f5ea61c4be1032fa61d18581f05a07fb8707c8996e0fff1c3eda59b992687fa12483b9327e10224b20d42e8b3fc4670bf070ced602283273d6818acd1f6da567c44d3f5e1377065d43d87d889843ae48e7fa8ba1634815695b8c480ca271e6e833799c70da80fd79acc09b989667a2294de5da73f0363df9a33ad4dab8d27cf7bed0a06838672e3d07d52b6396e9b5576021d5e925abd533bf161c944795065fdd44e8462e3070c479f1c118276653488dd9b2f1a673f8cad3612ca1fab4388ec9c8f834a01a499adb7b3a9a977672f6d75b41bbdd7f91ceb7e7a88568d17bb432be9e4e96e115075bce197ef4754d2914c2c59e2d7f4c08f0dbe34d31f229428f211bf1d7e8f5c319ed4a8273cb6255eb318851ac4557b0278fac63107a54d407c42f300b843a12abd3b893b46c7efac2e388ab42b87aebe2543bd4c15f459bc50aad10ffe1c1196fb52c26e54bdaa7fbd52451f207ffb073ef4b3f71eedd7da40c89505019739e3fa733bcdc84ff4919e8fe2358129ef28291be1d6426b8bafe88463b1d3cd7273745381c7f65221898e6ad361e88b24c54ccc7ac9a830145b6dc096e2d71ef71ec4f03524cb870b724e08d223bdec2f6fdde6200217a13b5136004d455d66547f5a1793e0cad85677d49e5c558852107007c8136812cf021afaf6f7e8f59883371be46cda412dd9c6fcf187c31252ceb5758901d39cd5355ab386d9a7fe6ea46ebf277aaf809c3023211ea9aa189de4d422080ebb9fec50ffab6b95ba4ae5018accc497e79149ed6047ce561ccc10e9194cdccd5c9fb75175c8dbc9d0a916ad59288f010defbbb50d263041ab37aac0f93253bef6f898cd0825d99d27224f26181f9713b8979da64756c95e7505f25a2688960d6155c3613dcc31b6c337a6dbfc6b12cfde1db22b93bbd5e48534fb0bda8b212577a14dcf665c834b0bd24e5f624d2455fe048dbe930328d7cb632db3b0e244bb5d43390b420b15157a339487fc78976f867d3a361aafdd3f50a93c01882da7c220089a544381db22e2c86b228dc2be01820468460437588952a549d37498e529e62aa62bad1580546bcb1e9a6ed1870b7838d05d12f6e3a041e78b1bdb80894626f20889ccb3a468aa4fb24b9c87cbb28623ce59c6b3c6286db366d08004551a25fe4d8d194a2bb7c52e1c85a5fbe4cb15b171489da121bea1c469a6bb185d63213084e3a81ee54dc03a94dc5ecdda7bfaad1df68021aaf4627c9d529f13e5c81b5ee4dd228949ca16b9a61d186211d153294470907557e5e14ae665013f285fe4d3766e7b3d8ce5e2a14692072d4d8f79354bcc8db8a2a36c8bcd", 0x2000, &(0x7f00000069c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000066c0)={0x90, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x801}}}, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f00000020c0)='./file0/file0\x00', 0x0, 0x0) ioctl$KDSETLED(r2, 0x5385, 0x1190000) 16:28:18 executing program 2: r0 = socket(0x11, 0x800000003, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000800)=@newqdisc={0x88, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb, 0x1, 'mqprio\x00'}, {0x58, 0x2, {{0xc, [], 0x1}}}}]}, 0x88}}, 0x0) 16:28:18 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x25}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1392.964618][ T4831] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1393.048846][ T4837] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1393.467383][ T4837] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1394.009126][ T3511] tipc: TX() has been purged, node left! 16:28:21 executing program 5: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @dev}}, 0x1e) connect$pptp(r0, &(0x7f0000000040)={0x18, 0x2, {0xe0, @empty}}, 0x1e) 16:28:21 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0x4) r0 = gettid() tkill(r0, 0x23) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) umount2(&(0x7f00000000c0)='./file0\x00', 0xc) 16:28:21 executing program 3: r0 = epoll_create1(0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x90, 0x0, r1, 0x0) 16:28:21 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000200)='wireguard\x00') sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0xdc, r1, 0x409, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PEERS={0xac, 0x8, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg='\xdb\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'}, @WGPEER_A_ALLOWEDIPS={0x2c, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x2}}]}]}]}, {0x54, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x2c, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g='\x97\\\x9d\x81\xc9\x83\xc8 \x9e\xe7\x81%K\x89\x9f\x8e\xd9%\xae\x9f\t#\xc20x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, r3}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000440)={r3, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}}, 0xf6a, 0x1, 0x7, 0xb9e, 0x1}, &(0x7f0000000240)=0x98) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000300)={r3, 0x9c2, 0x80000001, 0x100}, &(0x7f0000000340)=0x10) r4 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r4, 0x2) dup3(0xffffffffffffffff, r4, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r4, 0x4, &(0x7f0000000000)='nl80211\x00', &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="72dad2f9", @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r5, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r6, 0x1) flock(r6, 0x1) flock(r6, 0x2) getsockname$l2tp6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000280)=0x20) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="d676096888000000", @ANYRES16=r1, @ANYBLOB="050000000000000000000f0000002b000e0080000000ffffffffffff080211000000ffffffffffff00000000000000000000640001002a010300080026006c0900000a00340002020202020200001c001b800500010003000000050001003e00000004000200040002000a0034000202020202020000080035000200000004000501"], 0x88}}, 0x0) 16:28:21 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x48}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:21 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x44}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0xf}, [@IFLA_PROTO_DOWN={0x8, 0x1c, 0xffffffef}]}, 0x28}}, 0x0) [ 1395.650114][ T4867] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1395.683271][ T4874] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:21 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x6, [@typedef={0x4, 0x0, 0x0, 0x7}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x2}}]}, {0x0, [0x0, 0x0, 0x0, 0xda]}}, &(0x7f0000000340)=""/142, 0x52, 0x8e, 0x8}, 0x20) 16:28:21 executing program 2: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) recvfrom$phonet(r0, 0x0, 0x0, 0x2020, 0x0, 0x0) 16:28:21 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x18, 0x2, 0x1, 0x801, 0x0, 0x0, {}, [@CTA_TUPLE_REPLY={0x4, 0x19}]}, 0x18}}, 0x0) [ 1396.056954][ T4874] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1396.108374][ T4883] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 16:28:22 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r3, 0x2) r4 = socket$packet(0x11, 0x3, 0x300) dup3(r4, r3, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x20, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0x4}]}, 0x20}}, 0x0) r8 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r8, 0x2) r9 = socket$packet(0x11, 0x3, 0x300) dup3(r9, r8, 0x0) sendmsg$NL80211_CMD_GET_WIPHY(r8, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="0200e4858c363ec9a77b010000000000010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000008}, 0x4000084) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501dfcc102fdc99f697a75210f579263efa026f6c51330059cb284248f3c2666803fadb7bc4f2524858ff47fbd982db46e2b24094ce9d5cd128f8e8484479b5ed42de2800ce97bbf5ba1dffecb3738d8ba0"], 0x74}}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) [ 1396.375621][ T4883] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1396.409246][ T4903] BPF:[3] ARRAY (anon) [ 1396.414370][ T4903] BPF:type_id=1 index_type_id=2 nr_elems=0 [ 1396.420339][ T4903] BPF: 16:28:22 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x4c}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1396.424064][ T4903] BPF:Invalid elem [ 1396.427841][ T4903] BPF: [ 1396.427841][ T4903] [ 1396.610785][ T4903] BPF:[3] ARRAY (anon) [ 1396.615827][ T4903] BPF:type_id=1 index_type_id=2 nr_elems=0 [ 1396.622167][ T4903] BPF: [ 1396.624996][ T4903] BPF:Invalid elem [ 1396.628773][ T4903] BPF: [ 1396.628773][ T4903] 16:28:22 executing program 5: r0 = perf_event_open(&(0x7f0000000000)={0x8, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x8, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r0, 0x0) 16:28:22 executing program 4: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40046602, &(0x7f0000000000)) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40046602, &(0x7f0000000000)=0x80000) 16:28:22 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000180)='/dev/video#\x00', 0x3ff, 0x0) ioctl$VIDIOC_TRY_FMT(r0, 0x4004560e, &(0x7f00000001c0)={0x1, @vbi}) [ 1397.011625][ T4927] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:22 executing program 3: syz_mount_image$omfs(&(0x7f0000000400)='omfs\x00', &(0x7f0000000440)='./file0\x00', 0x0, 0x0, &(0x7f00000016c0), 0x0, &(0x7f0000001700)={[{','}], [{@smackfstransmute={'smackfstransmute'}}]}) [ 1397.084962][ T4928] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1397.499478][ T4927] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:23 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r3, 0x2) r4 = socket$packet(0x11, 0x3, 0x300) dup3(r4, r3, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2080000}, 0xc, &(0x7f0000000440)={&(0x7f0000000300)={0x13c, r1, 0x20, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x4}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x64}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xd3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x19}], @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x33}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xc}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16d5}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffffffff}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x40}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3}, @NL80211_ATTR_CENTER_FREQ2={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16f8}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x21}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x2df}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x23}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x121}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1c}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xa054}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}], @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x81}]}, 0x13c}, 0x1, 0x0, 0x0, 0x400c040}, 0x4c0c1) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x2ac82e07}, &(0x7f0000000040)=0x8) 16:28:23 executing program 5: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="7400000030003deb0000000020f01500ff000000600001005c0001000b000100706f6c696365000048000280070001"], 0x74}}, 0x0) r0 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 16:28:23 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x60}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:23 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0), 0x151) 16:28:23 executing program 4: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40046602, &(0x7f0000000000)) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40046602, &(0x7f0000000000)=0x80000) 16:28:23 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x43}, [@ldst={0x6, 0x0, 0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x5323, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) [ 1398.470786][ T4968] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1398.478343][ T4969] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1398.492279][ T4969] netlink: 60 bytes leftover after parsing attributes in process `syz-executor.5'. 16:28:24 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000003670f58100000000000000", @ANYRES32=r2, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1398.548122][ T4971] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:24 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x5, 0x1, 0x58}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x2e], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x23) [ 1398.870207][ T4969] not chained 10000 origins [ 1398.871670][ T4969] CPU: 0 PID: 4969 Comm: syz-executor.5 Not tainted 5.9.0-rc8-syzkaller #0 [ 1398.871670][ T4969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1398.871670][ T4969] Call Trace: [ 1398.871670][ T4969] dump_stack+0x21c/0x280 [ 1398.871670][ T4969] kmsan_internal_chain_origin+0x6f/0x130 [ 1398.871670][ T4969] ? kmsan_get_metadata+0x116/0x180 [ 1398.871670][ T4969] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 1398.871670][ T4969] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1398.871670][ T4969] ? update_load_avg+0x867/0x1350 [ 1398.871670][ T4969] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 1398.871670][ T4969] ? rb_erase+0x26a/0x27e0 [ 1398.871670][ T4969] ? kmsan_get_metadata+0x116/0x180 [ 1398.871670][ T4969] ? kmsan_get_metadata+0x116/0x180 [ 1398.871670][ T4969] ? kmsan_internal_set_origin+0x85/0xc0 [ 1398.871670][ T4969] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 1398.871670][ T4969] ? _copy_from_user+0x201/0x310 [ 1398.871670][ T4969] ? kmsan_get_metadata+0x116/0x180 [ 1398.871670][ T4969] __msan_chain_origin+0x57/0xa0 [ 1398.871670][ T4969] __get_compat_msghdr+0x6db/0x9d0 [ 1398.871670][ T4969] get_compat_msghdr+0x108/0x2b0 [ 1398.871670][ T4969] __sys_sendmmsg+0x77e/0x1010 [ 1398.871670][ T4969] ? kmsan_internal_check_memory+0xb1/0x520 [ 1398.871670][ T4969] ? kmsan_internal_set_origin+0x85/0xc0 [ 1398.871670][ T4969] ? kmsan_copy_to_user+0x9c/0xb0 [ 1398.871670][ T4969] ? _copy_to_user+0x1bf/0x260 [ 1398.871670][ T4969] ? kmsan_get_metadata+0x116/0x180 [ 1398.871670][ T4969] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 1398.871670][ T4969] ? kmsan_get_metadata+0x116/0x180 [ 1398.871670][ T4969] ? kmsan_get_metadata+0x116/0x180 [ 1398.871670][ T4969] __se_compat_sys_sendmmsg+0xcd/0xf0 [ 1398.871670][ T4969] __ia32_compat_sys_sendmmsg+0x56/0x70 [ 1398.871670][ T4969] __do_fast_syscall_32+0x129/0x180 [ 1398.871670][ T4969] do_fast_syscall_32+0x6a/0xc0 [ 1398.871670][ T4969] do_SYSENTER_32+0x73/0x90 [ 1398.871670][ T4969] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 1398.871670][ T4969] RIP: 0023:0xf7f40549 [ 1398.871670][ T4969] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 1398.871670][ T4969] RSP: 002b:00000000f553a0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000159 [ 1398.871670][ T4969] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000200 [ 1398.871670][ T4969] RDX: 00000000675dec16 RSI: 0000000000000000 RDI: 0000000000000000 [ 1398.871670][ T4969] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1398.871670][ T4969] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 1398.871670][ T4969] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1398.871670][ T4969] Uninit was stored to memory at: [ 1398.871670][ T4969] kmsan_internal_chain_origin+0xad/0x130 [ 1398.871670][ T4969] __msan_chain_origin+0x57/0xa0 [ 1398.871670][ T4969] __get_compat_msghdr+0x6db/0x9d0 [ 1398.871670][ T4969] get_compat_msghdr+0x108/0x2b0 [ 1398.871670][ T4969] __sys_sendmmsg+0x77e/0x1010 [ 1398.871670][ T4969] __se_compat_sys_sendmmsg+0xcd/0xf0 [ 1398.871670][ T4969] __ia32_compat_sys_sendmmsg+0x56/0x70 [ 1398.871670][ T4969] __do_fast_syscall_32+0x129/0x180 [ 1398.871670][ T4969] do_fast_syscall_32+0x6a/0xc0 [ 1398.871670][ T4969] do_SYSENTER_32+0x73/0x90 [ 1398.871670][ T4969] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 1398.871670][ T4969] [ 1398.871670][ T4969] Uninit was stored to memory at: [ 1398.871670][ T4969] kmsan_internal_chain_origin+0xad/0x130 [ 1398.871670][ T4969] __msan_chain_origin+0x57/0xa0 [ 1398.871670][ T4969] __get_compat_msghdr+0x6db/0x9d0 [ 1398.871670][ T4969] get_compat_msghdr+0x108/0x2b0 [ 1398.871670][ T4969] __sys_sendmmsg+0x77e/0x1010 [ 1398.871670][ T4969] __se_compat_sys_sendmmsg+0xcd/0xf0 [ 1398.871670][ T4969] __ia32_compat_sys_sendmmsg+0x56/0x70 [ 1398.871670][ T4969] __do_fast_syscall_32+0x129/0x180 [ 1398.871670][ T4969] do_fast_syscall_32+0x6a/0xc0 [ 1398.871670][ T4969] do_SYSENTER_32+0x73/0x90 [ 1398.871670][ T4969] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 1398.871670][ T4969] [ 1398.871670][ T4969] Uninit was stored to memory at: [ 1398.871670][ T4969] kmsan_internal_chain_origin+0xad/0x130 [ 1398.871670][ T4969] __msan_chain_origin+0x57/0xa0 [ 1398.871670][ T4969] __get_compat_msghdr+0x6db/0x9d0 [ 1398.871670][ T4969] get_compat_msghdr+0x108/0x2b0 [ 1398.871670][ T4969] __sys_sendmmsg+0x77e/0x1010 [ 1398.871670][ T4969] __se_compat_sys_sendmmsg+0xcd/0xf0 [ 1398.871670][ T4969] __ia32_compat_sys_sendmmsg+0x56/0x70 [ 1398.871670][ T4969] __do_fast_syscall_32+0x129/0x180 [ 1398.871670][ T4969] do_fast_syscall_32+0x6a/0xc0 [ 1398.871670][ T4969] do_SYSENTER_32+0x73/0x90 [ 1398.871670][ T4969] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 1398.871670][ T4969] [ 1398.871670][ T4969] Uninit was stored to memory at: [ 1398.871670][ T4969] kmsan_internal_chain_origin+0xad/0x130 [ 1398.871670][ T4969] __msan_chain_origin+0x57/0xa0 [ 1398.871670][ T4969] __get_compat_msghdr+0x6db/0x9d0 [ 1398.871670][ T4969] get_compat_msghdr+0x108/0x2b0 [ 1398.871670][ T4969] __sys_sendmmsg+0x77e/0x1010 [ 1398.871670][ T4969] __se_compat_sys_sendmmsg+0xcd/0xf0 [ 1398.871670][ T4969] __ia32_compat_sys_sendmmsg+0x56/0x70 [ 1398.871670][ T4969] __do_fast_syscall_32+0x129/0x180 [ 1398.871670][ T4969] do_fast_syscall_32+0x6a/0xc0 [ 1398.871670][ T4969] do_SYSENTER_32+0x73/0x90 [ 1398.871670][ T4969] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 1398.871670][ T4969] [ 1398.871670][ T4969] Uninit was stored to memory at: [ 1398.871670][ T4969] kmsan_internal_chain_origin+0xad/0x130 [ 1398.871670][ T4969] __msan_chain_origin+0x57/0xa0 [ 1398.871670][ T4969] __get_compat_msghdr+0x6db/0x9d0 [ 1398.871670][ T4969] get_compat_msghdr+0x108/0x2b0 [ 1398.871670][ T4969] __sys_sendmmsg+0x77e/0x1010 [ 1398.871670][ T4969] __se_compat_sys_sendmmsg+0xcd/0xf0 [ 1398.871670][ T4969] __ia32_compat_sys_sendmmsg+0x56/0x70 [ 1398.871670][ T4969] __do_fast_syscall_32+0x129/0x180 [ 1398.871670][ T4969] do_fast_syscall_32+0x6a/0xc0 [ 1398.871670][ T4969] do_SYSENTER_32+0x73/0x90 [ 1398.871670][ T4969] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 1398.871670][ T4969] [ 1398.871670][ T4969] Uninit was stored to memory at: [ 1398.871670][ T4969] kmsan_internal_chain_origin+0xad/0x130 [ 1398.871670][ T4969] __msan_chain_origin+0x57/0xa0 [ 1398.871670][ T4969] __get_compat_msghdr+0x6db/0x9d0 [ 1398.871670][ T4969] get_compat_msghdr+0x108/0x2b0 [ 1398.871670][ T4969] __sys_sendmmsg+0x77e/0x1010 [ 1398.871670][ T4969] __se_compat_sys_sendmmsg+0xcd/0xf0 [ 1398.871670][ T4969] __ia32_compat_sys_sendmmsg+0x56/0x70 [ 1398.871670][ T4969] __do_fast_syscall_32+0x129/0x180 [ 1398.871670][ T4969] do_fast_syscall_32+0x6a/0xc0 [ 1398.871670][ T4969] do_SYSENTER_32+0x73/0x90 [ 1398.871670][ T4969] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 1398.871670][ T4969] [ 1398.871670][ T4969] Uninit was stored to memory at: [ 1398.871670][ T4969] kmsan_internal_chain_origin+0xad/0x130 [ 1398.871670][ T4969] __msan_chain_origin+0x57/0xa0 [ 1398.871670][ T4969] __get_compat_msghdr+0x6db/0x9d0 [ 1398.871670][ T4969] get_compat_msghdr+0x108/0x2b0 [ 1398.871670][ T4969] __sys_sendmmsg+0x77e/0x1010 [ 1398.871670][ T4969] __se_compat_sys_sendmmsg+0xcd/0xf0 [ 1398.871670][ T4969] __ia32_compat_sys_sendmmsg+0x56/0x70 [ 1398.871670][ T4969] __do_fast_syscall_32+0x129/0x180 [ 1398.871670][ T4969] do_fast_syscall_32+0x6a/0xc0 [ 1398.871670][ T4969] do_SYSENTER_32+0x73/0x90 [ 1398.871670][ T4969] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 1398.871670][ T4969] [ 1398.871670][ T4969] Local variable ----msg_sys@__sys_sendmmsg created at: [ 1398.871670][ T4969] __sys_sendmmsg+0xc1/0x1010 [ 1398.871670][ T4969] __sys_sendmmsg+0xc1/0x1010 [ 1399.681488][ T4968] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:25 executing program 4: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40046602, &(0x7f0000000000)) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40046602, &(0x7f0000000000)=0x80000) [ 1399.895051][ T4983] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 16:28:25 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x68}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1400.197967][ T4980] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 16:28:26 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x5, 0x1, 0x58}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x2e], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x23) [ 1400.485192][ T4994] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:26 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000380)={0x7, 0x7b, 0x1}, 0x7) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r1, 0x506, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) [ 1400.544155][ T4995] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:26 executing program 4: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40046602, &(0x7f0000000000)) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40046602, &(0x7f0000000000)=0x80000) [ 1400.935506][ T4994] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:28 executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040), 0x4) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x1000}, 0x4) 16:28:28 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x5, 0x1, 0x58}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x2e], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x23) 16:28:28 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x6c}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:28 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r3, 0x0, 0x0, 0x0, &(0x7f0000000040)) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000000)) r4 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r4, 0x1) flock(r4, 0x1) flock(r4, 0x2) setsockopt$inet_mreqn(r4, 0x0, 0xf28ac39c2cd27fe2, &(0x7f0000000180)={@multicast2, @local}, 0xc) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r2, @ANYBLOB="0812050003000000f2e9577f538acc501eaa41eadb0c57051de5cddf81327db29a0b5947d90e2ea8181ec0a9b86ab377038bfe27852f498ef52be8973821c1eb40a3ef1efdb3b2ca230ac435bbe29ad520dc3c83c12ccdb569cf2be519e5bde2fe61e4f53365713a28efaf7a7c82f1cf96145bd0b5c2f7610bb4ad97bfe8dab6a2"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)={0x9c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x50, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @val={0x2a, 0x1, {0x1, 0x1, 0x1}}, @void, @val={0x2d, 0x1a, {0x20, 0x1, 0x1, 0x0, {0x2, 0x4, 0x0, 0x3f8, 0x0, 0x1, 0x0, 0x3, 0x1}, 0x800, 0x9, 0x6}}, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1, 0x45, 0x9}}, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16fd}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x400}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x9c}}, 0x0) 16:28:28 executing program 4: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x300c050, 0x0) r0 = creat(&(0x7f0000000180)='./file0/file0\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f00000003c0)={0x1}) truncate(&(0x7f00000005c0)='./file0/file0\x00', 0x0) 16:28:28 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r1, 0x0) r2 = socket$inet(0x2b, 0x801, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r2, 0x8983, &(0x7f0000000000)={0x3, 'vlan0\x00'}) [ 1402.868137][ T5036] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1402.899369][ T5044] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1402.919426][ T5042] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:28:29 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r1, 0x0) r2 = socket$inet(0x2b, 0x801, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r2, 0x8983, &(0x7f0000000000)={0x3, 'vlan0\x00'}) 16:28:29 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x5, 0x1, 0x58}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x2e], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x23) 16:28:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY={0x14, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_TYPE={0x8}]}]}, 0x30}}, 0x0) [ 1403.195427][ T5034] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1403.307566][ T5044] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:29 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc04064a0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x307400, 0x0, 0x0, 0x0, {0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "0000001c000000000000000000000000000000000000008000"}}) 16:28:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = openat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={0x450040, 0xc, 0xa}, 0x18) write$UHID_SET_REPORT_REPLY(r3, &(0x7f0000000540)={0xe, {0x5, 0x3f, 0x0, 0x3, "0e65f8"}}, 0xf) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x290, r1, 0x5, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_PBSS={0x4}, @acl_policy=[@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}], @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}, @NL80211_ATTR_TWT_RESPONDER={0x4}, @NL80211_ATTR_HE_OBSS_PD={0x14, 0x117, 0x0, 0x1, [@NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET={0x5, 0x1, 0x1}, @NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET={0x5, 0x1, 0x12}]}, @NL80211_ATTR_HIDDEN_SSID={0x8, 0x7e, 0x1}, @NL80211_ATTR_TWT_RESPONDER={0x4}, @NL80211_ATTR_TX_RATES={0x228, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x10c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x39, 0x2, [{0x1, 0x2}, {0x1, 0xa}, {0x4, 0x1}, {0x5, 0x8}, {0x6, 0x8}, {0x4, 0x2}, {0x6, 0x1}, {0x7, 0x9}, {0x6, 0x3}, {0x3, 0x5}, {0x7}, {0x1, 0x2}, {0x1, 0xa}, {0x2, 0x7}, {0x0, 0x8}, {0x6, 0x7}, {0x7, 0x7}, {0x5, 0x1}, {0x6, 0xa}, {0x3, 0x8}, {0x2, 0x3}, {0x3, 0x3}, {0x3, 0x6}, {0x0, 0x5}, {0x3, 0x5}, {0x2, 0x6}, {0x2, 0x2}, {0x2, 0x2}, {0x6, 0x6}, {0x4, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x3, 0x7}, {0x6, 0x8}, {0x7, 0x9}, {0x5, 0x9}, {0x1, 0x9}, {0x5, 0x3}, {0x0, 0x7}, {0x6, 0x7}, {0x3, 0x2}, {0x0, 0x9}, {0x4, 0x2}, {0x7, 0x3}, {0x5, 0x4}, {0x0, 0x7}, {0x7, 0x6}, {0x7, 0x8}, {0x4, 0x4}, {0x2, 0x9}, {0x3, 0x9}, {0x5, 0x1}, {0x0, 0x9}]}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0x18, 0xc, 0x9, 0x2c]}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x1b, 0x24, 0x1b, 0x12, 0x1b, 0x12, 0xb, 0x5, 0x36, 0xc, 0x48, 0x2, 0xc, 0x12, 0x9, 0xc, 0x48, 0x4, 0x18]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x30, 0x9, 0x3, 0x24, 0x6c, 0x12, 0x1b, 0x3, 0x30, 0x1, 0x54, 0x3, 0x1b, 0x9, 0x19, 0x4, 0xb, 0x36, 0x3, 0x24, 0x60, 0x0, 0x4, 0x4, 0x6c]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xb0c, 0x0, 0xe99d, 0xe3b, 0x7, 0x100, 0x1980, 0x1]}}, @NL80211_TXRATE_HT={0x4b, 0x2, [{0x5, 0x5}, {0x6, 0x5}, {0x1, 0x1}, {0x6, 0x9}, {0x0, 0x2}, {0x0, 0x6}, {0x0, 0x6}, {0x5, 0x8}, {0x4, 0x3}, {0x6, 0x7}, {0x0, 0xa}, {0x1, 0x7}, {0x6, 0x3}, {0x4, 0x4}, {0x2, 0x3}, {0x7, 0x6}, {0x1, 0xa}, {0x5, 0x5}, {0x3, 0x5}, {0x2, 0xa}, {0x3, 0x1}, {0x6, 0xa}, {0x0, 0x7}, {0x0, 0x6}, {0x4, 0x3}, {0x5, 0x9}, {0x7, 0x7}, {0x2, 0x8}, {0x1, 0x5}, {0x5, 0x7}, {0x2, 0x1}, {0x5, 0x3}, {0x0, 0x9}, {0x6, 0x6}, {0x7, 0xa}, {0x3, 0x5}, {0x6, 0x8}, {0x2}, {0x5, 0x4}, {}, {0x6, 0x2}, {0x4, 0xa}, {}, {0x2, 0x9}, {0x3}, {0x7, 0x8}, {0x3, 0x7}, {0x6, 0x5}, {0x4}, {0x7}, {0x0, 0x3}, {0x4, 0x2}, {0x4, 0x8}, {0x1, 0x8}, {0x4, 0x3}, {0x2, 0xa}, {0x7, 0x7}, {0x7, 0x8}, {0x5, 0x1}, {0x0, 0xa}, {0x2, 0x1}, {0x7, 0x5}, {0x1, 0xa}, {0x2, 0x8}, {0x6, 0x3}, {0x1, 0x7}, {0x0, 0x4}, {0x6, 0x2}, {0x1, 0x3}, {0x0, 0x9}, {0x3, 0x4}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x9, 0x9, 0x1, 0x3, 0x7, 0x6, 0x6]}}]}, @NL80211_BAND_5GHZ={0xbc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x10, 0x1, [0x48, 0x30, 0x4, 0x18, 0x9, 0x4, 0x5, 0x16, 0x24, 0x36, 0x60, 0x36]}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0x1b, 0xc, 0x2, 0x30, 0x48, 0x1b, 0x6, 0x12, 0x5, 0x64, 0x2, 0xb, 0x16, 0x3, 0x6, 0x48, 0x6b, 0x0, 0x5, 0x1, 0x6, 0x5, 0x16]}, @NL80211_TXRATE_HT={0x2b, 0x2, [{0x0, 0x5}, {0x0, 0x9}, {0x3, 0x6}, {0x1}, {0x7, 0xa}, {0x3, 0x5}, {0x5, 0x2}, {0x0, 0xa}, {0x0, 0xa}, {0x6, 0x3}, {0x5, 0x9}, {0x7, 0x1}, {0x1, 0x1}, {0x5, 0x4}, {0x5, 0x9}, {0x4, 0x4}, {0x2, 0x2}, {0x5, 0x4}, {0x1, 0x7}, {0x7, 0xa}, {}, {0x6, 0x1}, {0x0, 0x8}, {0x3, 0x9}, {0x5, 0x3}, {0x1, 0x3}, {0x6, 0x5}, {0x1}, {0x3, 0x6}, {0x7, 0x1}, {0x1, 0x7}, {0x6, 0x4}, {0x7, 0x5}, {0x1, 0x2}, {0x2, 0x9}, {0x5, 0x4}, {0x5, 0xa}, {0x0, 0x2}, {0x7, 0x4}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x200, 0x9, 0x4, 0x3f, 0x8, 0x1, 0x0, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x4, 0x9, 0xfffe, 0x9, 0x5, 0x1, 0x2]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x7023ee01cebe02ca}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x10, 0x4, 0x5, 0x5, 0x0, 0x9, 0xcd6, 0x8]}}, @NL80211_TXRATE_LEGACY={0xc, 0x1, [0x6b, 0x5, 0x6, 0x1, 0x18, 0x2, 0x60, 0x12]}]}, @NL80211_BAND_5GHZ={0x14, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x10, 0x1, [0x6, 0x30, 0x60, 0x12, 0x5, 0x6c, 0x4, 0x42, 0x1b, 0x48, 0x24, 0x48]}]}, @NL80211_BAND_6GHZ={0x48, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0xe, 0x1, [0x48, 0x1, 0xc, 0x36, 0x30, 0x4, 0x1b, 0xc, 0xc, 0xb]}, @NL80211_TXRATE_HT={0x15, 0x2, [{0x7, 0x9}, {0x0, 0x1}, {0x1, 0x7}, {0x4, 0x1}, {0x0, 0x3}, {0x3, 0x2}, {0x1, 0x4}, {0x5, 0xa}, {0x0, 0x13}, {0x1, 0x8}, {0x5, 0x2}, {0x6, 0x6}, {0x5, 0x4}, {0x1, 0x3}, {0x4, 0x2}, {0x5, 0x7}, {0x3, 0x5}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x5, 0x800, 0xe5f6, 0x5, 0x3, 0x8, 0x1000]}}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x5}]}, 0x290}}, 0x0) ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f0000000000)=""/58) 16:28:29 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x74}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:29 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r1, 0x0) r2 = socket$inet(0x2b, 0x801, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r2, 0x8983, &(0x7f0000000000)={0x3, 'vlan0\x00'}) [ 1404.129045][ T5072] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1404.184976][ T5075] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY={0x14, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_TYPE={0x8}]}]}, 0x30}}, 0x0) 16:28:30 executing program 2: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f00000012c0)) 16:28:30 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x8}, [@call={0xdc, 0x0, 0x3b00}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) [ 1404.604058][ T5072] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:30 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r1, 0x0) r2 = socket$inet(0x2b, 0x801, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r2, 0x8983, &(0x7f0000000000)={0x3, 'vlan0\x00'}) 16:28:30 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000380)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e24, @local}, @in6={0xa, 0x4e20, 0x200, @private1={0xfc, 0x1, [], 0x1}, 0x40}, @in={0x2, 0x4e20, @rand_addr=0x64010102}], 0x4c) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x20, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0x4}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0xb0, r3, 0x5, 0x0, 0xfffffffd, {{}, {@void, @void}}, [@mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "8c2f3a43f5bfc379c6b968ab1790752c9641fc7e3a7f89da"}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "7c32331b5d50eb54b970ea89bef100da6e4429b0e1b85b21"}, @NL80211_ATTR_MNTR_FLAGS={0x4}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "7da038572d5e0dacf16604c576991708d805858b9d21b992"}]]}, 0xb0}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0xfffffffe, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac, {0x0, 0xac}}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:28:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr\x00', 0x4) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20001732, &(0x7f00000003c0)={0x2, 0x4e20, @local}, 0x10) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 16:28:30 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac=@device_a={0x8, 0x2, 0x11, 0x0, 0x0, 0x7a}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY={0x14, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_TYPE={0x8}]}]}, 0x30}}, 0x0) 16:28:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000017c0)={0x1c, r1, 0x1, 0x0, 0x0, {0x1b}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0x4, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}]}, 0x1c}}, 0x0) [ 1405.377567][ T5101] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1405.431270][ T5105] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:31 executing program 2: mknod$loop(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./file0\x00', &(0x7f0000000100)='romfs\x00', 0x0, 0x0) 16:28:31 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000040)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='syz_tun\x00', 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @initdev}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000013, &(0x7f0000000000), 0x4) sendto(r0, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x3, &(0x7f0000000040), 0x4) 16:28:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY={0x14, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_TYPE={0x8}]}]}, 0x30}}, 0x0) [ 1405.787982][ T5101] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:31 executing program 0: r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8800) sendmsg$alg(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)="cc11a1479e795c043c4c23be7d16cf6f214dc73d44677d4bfbf68c67654f9fe6dd06386ec9656755b5649055d13f229b4f00edb019726bb887d5f1d950d038e328c00ac69e573e437f3c2c08", 0x4c}, {&(0x7f0000000340)="0fe0158ce852db17c436fdbaf3ce91e831152c49a31d6b61570f13f22a4cdaf2e79cbe1ceb78a3d2014a7f42137b6121d4c2d7ef9a7c5f7f884a73f2d3095ad02498fb376ae3a2aea6049a35d9f53354e8959a3dfe776c", 0x57}, {&(0x7f00000003c0)="b32729c37b8923f0e41889860f1a7b80b05bb6c2237b1e50b38a228875886772fe5422c22f1025a7b4c856d08d91bf08729974f7b7a702aabd5c44f4166dfca7d4bd80c41847403137f7c07be9210232241023d188a10d9d2a2a8fe93011a3c82138bcb1bed096d2b5af0f263442f27ee6483dbe6aff165ab620271040b5a34cfa43169c8fb836c6e162ec6f2c84aad6ba20f4007a86544b3f2a3405d5ff9af3cbcab19cc997f24bd4d89b3ccaee7f3ffe76ac91596b9a55613f5439d1b3e37817c66deaf4d508a0f6b02d6c9f0957", 0xcf}, {&(0x7f00000004c0)="0e879dc647a10da8a6a96aa3ad708fa9f2f434bd435ced3009edbe8c8222a4ca00f5773cb7c54b492524a1aec82da3358e81d3639b29f634e0b7701317fb4aa9a5cafbd2b781fd", 0x47}, {&(0x7f0000000540)="8ad4911497b934bb48ae19400a45b2792de934a819f3328b912a8451daf32682ef80ba152eb9a70e31f2513259753c5752252cadfc0e4d99f1d75fb60aee62d84da666966baa4e576352e6f3a19f91afad08610ae9e019559b6801e189a4253ed073f457947a9c9afc78bb2c0cf4394c1b2bc85b0e626670ad9ac346207df9156cac1b39d4474a7ca5e5239a97030bebbfb332e03a6f5ce7ca156304ec1b761498ce2bcc62bcf4c260c88ce81c9e84bbb61cafd9047f2cbd8adab20fd8657a92d4f4bfbb6498194ea93816478ebec11814222a826268f9c32d17e50366b4ce612b010cbe4fac48174d871ccc52349c00", 0xf0}], 0x5, &(0x7f0000000640)=[@iv={0xa8, 0x117, 0x2, 0x96, "03206a0478c87399514b18c7232bee75f680bce36f759de80aadc38c1f1056ab3496dc1c71f130a4c211f8b634a89bedfd8d5bb6c3808844d7c8319684544a08aeda621988eb7057eda94971f4e0d526d1c82314c744cf947571f3c92616f1226c71d282a3997ec4280738147b605e0ca24965c110b5aadf74b2cf8f7b66f108725442ff22788951e850ba18d29d198f277eb7eeccfa"}, @op={0x10, 0x117, 0x3, 0x1}, @assoc={0x10}, @iv={0x30, 0x117, 0x2, 0x1d, "b2824dc526ec3bfc637c5418f7211bb861e819b3fc42ab578b4d1115a0"}, @iv={0xd4, 0x117, 0x2, 0xc2, "7623430844aec4705a69aa1d1a1bbc75c0a09472c5d5a6167fca7adc599893d4fe845571c2c39717af16f64c1304c25b1f63badb01f09950ab400a35fb3da182e8dd7e0ca66e6eb41fddfc8c5681f7f673a56f78a006f0556f9c6572fdfc934604847c1d4392745170fcaeba49a069531f795e213a92809d7bd9d8729ce375ca127b0fc9ae687877f9c4278ad98a813efd437e20500e5dbc616d3e8a7af0cd9bda95c5d5d984ff4684debecf26ddb520ecc3addf303e56f06dbc955391973474ea12"}, @assoc={0x10, 0x117, 0x4, 0x2}], 0x1dc, 0x20000000}, 0x4004880) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r3, @ANYBLOB="08000589004ca86f3d0000000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r2, 0x807, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1478}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:28:31 executing program 5: r0 = eventfd(0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) ppoll(&(0x7f00000000c0)=[{r0}], 0x1, &(0x7f0000000180)={0x0, r1+60000000}, &(0x7f00000001c0)={[0xe707]}, 0x8) r2 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f00009b1ffc)) close(r0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r2, 0x13) [ 1406.090968][ T2841] print_req_error: 38 callbacks suppressed [ 1406.091042][ T2841] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 16:28:32 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:32 executing program 2: add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffd) 16:28:32 executing program 4: set_mempolicy(0x4003, &(0x7f0000000140)=0x1000000000dd5, 0x61c0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x8636d) 16:28:32 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r1, 0x0) mkdir(&(0x7f0000000040)='./file0/file0\x00', 0x0) [ 1406.755878][ T5138] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) dup3(r2, r1, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000001c0)=0x3) r4 = fcntl$dupfd(r3, 0x0, r1) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @ioapic={0xfdfdffff}}) [ 1406.827491][ T5143] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@ptr={0xe, 0x0, 0x0, 0x2, 0x5}]}}, 0x0, 0x26}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:28:33 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000200)=@bpf_lsm={0x3, 0x2, &(0x7f00000000c0)=@raw=[@call={0x85, 0x0, 0x0, 0x63}, @exit], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 16:28:33 executing program 4: set_mempolicy(0x4003, &(0x7f0000000140)=0x1000000000dd5, 0x61c0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x8636d) [ 1407.237075][ T5143] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:33 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000000)=@l={0x92, 0x0, 0xb0}) 16:28:33 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x2}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:33 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000000c0)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x3e) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000440)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) write(r0, &(0x7f00000000c0)="8f0d0a65bd8c06dc0304000e0280a7b6072e63e286a5cefe24876ece", 0x5ac) 16:28:33 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$inet(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="fd", 0x1}, {&(0x7f00000002c0)="cc5c4b123ade5ca6977bf25e17b30dcd813823e012ef9bbe81a9392984bbb331fce7dfce4365aea4dd5dbfacbe8ef9f586b6c6b618719c2625e08c5cb380faacb00a5033aedf87478b6695356a04bcbad291ddf352a141360d25155883511ff3ea376a9b30809a94fab7deeeb3ce7379bdcf7fa1d2db6ff1ac69c79bf57d2f4c2c1d5b756a5e12ac0fb0b4f76d570a22fec89e24e8155e0faec0becc73d77bb17e946fed5232", 0xa6}, {&(0x7f0000000380)="99b1d5eafe067c75f9f52c8121924ae3c3d6cf06340243b8233444a10a4f11b232730397d9f9f3f0fb455e4246b9aae7c79ea74887c4b330c0b58c8de64be7584abdf71e3ecb55d37ff30e16fd977589cc723df543aa99495aaf8f085a961f20a451b2bdd5fd757356ad723e721c7668ece4f2fbe20389eb69c2b46e24c15d3619d965eb75b2d363c4bb5a4b034086ef682b253e561e62f296c200000000000000", 0xa1}, {&(0x7f0000000440)="b01341b13454d8b787154f7e0a6e0fda4befff2de421deb1e6fd88f466c6e9066546334999f9118dbe2fb5ed77f914df68c73d50b177004d9ff2e1392c521aa85105000000000000004eef5e5831ee6e841e4a0c2a", 0x55}, {&(0x7f00000004c0)="6a55115e0b0bef9b907f18beb496be934644d16d01a14d10a774e4f2295b0731a89282362f4c585a5dfa1ee45b51d9afb77d5e9ce6551ff8971f33b518e0fd08552dd3da9444486d733296af862a1bb8f897183f7db85efdb7bd8a1bce96450c366b1b9a8861ccc3d3334f611dedec7b134e502f30d497183d6c0c3a", 0x7c}, {&(0x7f0000000540)="bee5fdd8e86eeb4e270f34c851f88cf166e1647a98e35fc745ead3827cd7d75ec7bd9dd605174c5899eba9fa3189f94707c2c3438aa556e09dfc47c04cd3e7eb54aae62c038bd7ef48fe2b02efc9a2a388eb0f8144a797c2d0e5348a99f73dd76f4d6b9df6c133d6673db765118f085f0cdf765cd21093fbd577f59011d636e9bfc623d889db05debbecb5c81f965d797492c3d9637efef527062baf98584891757135f7a0e07b5e1c8f4947c0621b0871f9448800667c7975b6d2657cf60761", 0xc0}], 0x6, &(0x7f0000000600)=[@ip_tos_int={{0x10, 0x0, 0x1, 0x7fffffff}}], 0x10}, 0x801) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0)='nl80211\x00') sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="74000000dc6084c93b90ccb5334f21c345fa2e58f3e43eabae187908e306724f93cb19f0f717d559b02e9f1eee16e62a2824c5925e9cae52f42d68875c8d465fac211b0e00e681e14e66a1a6f36ea8bb2063745598c4114dd1ab5752d5d39b6e7aa018cbd6e0eca5c5fb3150ba1dbec1473d98c6e85848000000007504000000", @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000240)) 16:28:34 executing program 4: set_mempolicy(0x4003, &(0x7f0000000140)=0x1000000000dd5, 0x61c0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x8636d) [ 1408.136325][ T5174] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:34 executing program 3: r0 = openat$vicodec1(0xffffff9c, &(0x7f0000000000)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r0, 0xc0e85667, &(0x7f0000000040)={0x0, 0x0, "8c2b9e727a5248fe1294a741b03282a4129daabd4a47d4ae1836531941270694"}) [ 1408.202767][ T5175] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1408.616048][ T5174] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) dup3(r2, r1, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000001c0)=0x3) r4 = fcntl$dupfd(r3, 0x0, r1) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @ioapic={0xfdfdffff}}) 16:28:34 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) r3 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000)='/dev/nvme-fabrics\x00', 0x612182, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100)='fuse\x00', 0x0, &(0x7f0000002140)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) setsockopt$PNPIPE_ENCAP(r3, 0x113, 0x1, &(0x7f00000002c0)=0x1, 0x4) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x1f, 0x0, 0x0, 0xfff8}}, 0x50) write$FUSE_WRITE(r3, &(0x7f0000000040)={0x18, 0xfffffffffffffffe, r5, {0x2}}, 0x18) 16:28:34 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000000c0)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x3e) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000440)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) write(r0, &(0x7f00000000c0)="8f0d0a65bd8c06dc0304000e0280a7b6072e63e286a5cefe24876ece", 0x5ac) 16:28:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) dup3(r2, r1, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000001c0)=0x3) r4 = fcntl$dupfd(r3, 0x0, r1) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @ioapic={0xfdfdffff}}) 16:28:34 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x3}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:34 executing program 4: set_mempolicy(0x4003, &(0x7f0000000140)=0x1000000000dd5, 0x61c0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x8636d) [ 1409.508751][ T5220] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1409.562070][ T5223] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:35 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000000c0)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x3e) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000440)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) write(r0, &(0x7f00000000c0)="8f0d0a65bd8c06dc0304000e0280a7b6072e63e286a5cefe24876ece", 0x5ac) 16:28:35 executing program 4: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000380)={0x28, 0x0, 0x0, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000040), 0x10) close(r0) poll(&(0x7f0000000500)=[{r1}], 0x1, 0x0) 16:28:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) dup3(r2, r1, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000001c0)=0x3) r4 = fcntl$dupfd(r3, 0x0, r1) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @ioapic={0xfdfdffff}}) [ 1410.003029][ T5220] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$KVM_SET_TSC_KHZ(0xffffffffffffffff, 0xaea2, 0xfff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000240)='/dev/vcsa#\x00', 0xb4c7, 0x320bb6b28f14f94) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2c, r5, 0x42b, 0x0, 0x0, {{}, {}, {0x10, 0x17, {0x200020}}}}, 0x2c}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r3, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x30, r5, 0x800, 0x70bd2c, 0x25dfdbfc, {{}, {}, {0x14, 0x18, {0x2, @bearer=@udp='udp:syz2\x00'}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x10000000) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x7c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2d, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @val={0x25, 0x3, {0x1, 0x99, 0x80}}, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x7c}}, 0x0) 16:28:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) dup3(r2, r1, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000001c0)=0x3) r4 = fcntl$dupfd(r3, 0x0, r1) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @ioapic={0xfdfdffff}}) 16:28:36 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000000c0)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x3e) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000440)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) write(r0, &(0x7f00000000c0)="8f0d0a65bd8c06dc0304000e0280a7b6072e63e286a5cefe24876ece", 0x5ac) 16:28:36 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x4}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1410.563560][ T5246] tipc: Enabling of bearer <:> rejected, illegal name 16:28:36 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000080)={r1, 0x1, 0x6, @local}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000380)={r1, 0x1, 0x6, @local}, 0x10) 16:28:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) dup3(r2, r1, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000001c0)=0x3) r4 = fcntl$dupfd(r3, 0x0, r1) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @ioapic={0xfdfdffff}}) [ 1411.057780][ T5260] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1411.112100][ T5265] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:37 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09a4885eb0ca8123f3647a65af000008000c006400000008000d00000000000a0034000242020202020000080035000000000004000501e7d0aefbd2100bcfff92601743af4e1cc857f3ed79cf19976bda1060a0d703dc8b505a06435e743b7ae362bbb8d68d850f76a002f00e0379ab4c1a38bde9"], 0x74}}, 0x0) [ 1411.332441][ T5268] device batadv_slave_1 entered promiscuous mode [ 1411.370567][ T5267] device batadv_slave_1 left promiscuous mode 16:28:37 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="74000000100001651fb03252f504000000000000", @ANYRES32=r1, @ANYBLOB="000000000000000054001280110001006272696467655f736c617665000000003c0005"], 0x74}}, 0x0) 16:28:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) dup3(r2, r1, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000001c0)=0x3) r4 = fcntl$dupfd(r3, 0x0, r1) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @ioapic={0xfdfdffff}}) [ 1411.408875][ T5269] device batadv_slave_1 entered promiscuous mode [ 1411.435010][ T5267] device batadv_slave_1 left promiscuous mode [ 1411.523996][ T5260] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1411.645766][ T5282] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.0'. 16:28:37 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r2) sendmmsg$inet6(r0, &(0x7f0000002280)=[{{&(0x7f00000004c0)={0xa, 0x0, 0x0, @private2}, 0x1c, 0x0, 0x0, &(0x7f00000016c0)=[@dstopts_2292={{0x18}}], 0x18}}], 0x1, 0x0) [ 1411.934854][ T5292] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.0'. 16:28:37 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x5}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:37 executing program 3: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @random="e0d35b1004bb", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00006371ae9b1c01"}}}}}, 0x0) 16:28:38 executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, 0x0, 0x0) 16:28:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='\'\x00\b\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r2, @ANYBLOB="000018000303030303030000000018000303030303030000"], 0x42}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000680)='TIPCv2\x00') r5 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r5, 0x1) flock(r5, 0x1) flock(r5, 0x2) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000c40)='TIPCv2\x00') r7 = openat$null(0xffffff9c, &(0x7f0000000dc0)='/dev/null\x00', 0x1, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000001200)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000000e40)={0x344, r6, 0x800, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x94, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0x78, 0x3, "054c0554d4b1ebe507e954dbab6eec025ce918e224b7c5a679890024b3cde880a491cc8aaa3c22c36fd96337252eb902d43c9df13b687b837b92da652fac27333fba0dfd022ee1792369395499f6f1f564e9d0575ab8d46db021324b800340ed43a09bff08edd95fbcb4ec06157937bf456850e6"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x200}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x658}]}, @TIPC_NLA_MEDIA={0x18, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000000}]}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER={0xbc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x7, @remote, 0x4}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @empty}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x3, @ipv4={[], [], @rand_addr=0x64010102}, 0xffff}}}}]}, @TIPC_NLA_BEARER={0xa0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @multicast1}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast2}}}}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x78e0}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}, @TIPC_NLA_BEARER={0x8c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @multicast2}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x1f, @empty}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @local}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010102}}}}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_NODE={0x88, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x3d, 0x4, {'gcm(aes)\x00', 0x15, "63f937503ffe2a1df1916762e884de2388e44ddd3d"}}, @TIPC_NLA_NODE_KEY={0x3e, 0x4, {'gcm(aes)\x00', 0x16, "a14c0459eef7b32f27cb616060c718ef0475882d17f1"}}]}, @TIPC_NLA_SOCK={0x8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x344}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000d80)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000c80)={0x84, r6, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x70, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7f}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8001}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7fff}}, {0x14, 0x2, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x3e}}}}}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x1c0}, 0x884) sendmsg$TIPC_NL_MON_SET(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000002800)={0x20, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x4}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80804000}, 0xc, &(0x7f0000000180)={&(0x7f0000000800)={0x3bc, r4, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x10001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8164}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xa7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NODE={0x384, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x23, 0x3, "5fb1fe2af46b15c38f227eaacf885b75feab1a361cf0d76f025fb26aa8c81b"}, @TIPC_NLA_NODE_ID={0xff, 0x3, "f9e3b0b18e4f97f1c446c515c867182602fa43f2ad3ee43f63efc424f8be5e4f434b1cb82dbdb3af25c5120440b4c6d3344d7aaa34b008edb8279a9f4c9836ae3c676ec44ffa998eb2fb72a48a76e24dbf07762627ebb2fb70cf786a884d061f497e6bcfd6b2ac73937480de828d74d3179618effed7f037f9ee51d754b1e6595ea0be20ecc1e1f35d7aa06cb017030d3cbac7a8f03a127c1692b3c7721a2bfb2c2ac49f65236c060fd547bf1e4a77b5978ddb571b4050f269db58b3b6cbe623c2e701833ba7bab9544894e5dee211d7b179fa29c6993e36b69ff21e3c7bce9f45be11e4b5d72d537bdaadd7c7eb3a4787cb3c28f9ec85c7054be2"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "df0680ca3eee620b2dc63ad47bf79e81dce0f16863af53cb9a21d9ac7ae0e018e05b"}}, @TIPC_NLA_NODE_ID={0xe5, 0x3, "7d28b35916c66a2594979643fa7b2cece09e5d23ae3b2f3c317088d8106d0c3a86b24b0a47333c988395d3e15194516e5b7552990adbf2db21714e1f7f19e5fd3068ddb5a3590d4513f261494d900e03fc526169040cd6d9f281a729aebc9a66d40c47be1060ea1defcbf8f7485bbf67a4042e1498cbc52a7b86ec33cd1372b0f2532f3ab807e519a820b4b23f4d19bd4e3c8b3a94e47d02914be991d7b6bab7b1e5af2174745d66e4f5d915c4adf281f58072478d25ca7d78dd485c926ec40ed683a6ce48d81211f8adfde01dc9f07a61f53ea6937ebe6344d3fbeaa26dda63b3"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xff}, @TIPC_NLA_NODE_ID={0xd, 0x3, "382cd1033194744651"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0x103, 0x3, "3fcade8551d31b61ed04fbd382e1723c69d0aeceb333d1ea2f4c920805ebc93da23c10da83d2f31dbdc9d54a3cce8df95260ebadf9e44bd8431b9a5a91fdfa9f17d4e0cf9d62ca369d2aed1c8cdb686c1186c8b9347d9b0bb837ac5a4e222ca675268bb75665162b5eb6cfa6d5710bd38ea765ae45b750d1e58e8fb72a8467442fb2c88c0b7d4c7e4187a4ffa2ce2d88c49c359488cad56509bc262cc23383365557423243f07775daa473c7a37eef14ca17fcf9e6517f749b722f93ef5e1fd992f093094388bd336373f9f0acde1e1fd1304324b377aba54795a245310f6ed7711a0fba1fad8a6e5e9e5b627c15bdbd5f144ffef7b8228b1c90a2766388a3"}]}]}, 0x3bc}}, 0x4008800) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x5bc, r1, 0x5, 0x0, 0x0, {{}, {@void, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x57d, 0xe, {@wo_ht={{}, {}, @broadcast, @device_b, @from_mac}, 0x0, @default, 0x1, @void, @val={0x1, 0x8, [{}, {0x5}, {0x0, 0x1}, {0x16}, {0xc, 0x1}, {0x18, 0x1}, {0xb}, {0xc, 0x1}]}, @void, @void, @void, @val={0x5, 0x79, {0x0, 0x28, 0x53, "e9d0a427b317be82224b91b2000cb98e1b96238c092e6616059c47e97e474d6e7f57d22173f1f3ce0a62696c20021b24e54acaaa97e05e40c649467e110d89f66348a3ec9fa21a9e45ac01008b000000000000000000000020f0cca35abbe382746b92e618e05621a0281a4b41ca059a37c52b9f05fb"}}, @void, @void, @void, @val={0x2d, 0x1a, {0x10, 0x0, 0x4, 0x0, {0x7, 0x9, 0x0, 0x200, 0x0, 0x0, 0x0, 0x2}, 0x1, 0xdaea, 0xdd}}, @val={0x72, 0x6}, @void, @void, [{0xdd, 0x69, "5da5d87046e81b8347ec445fa45ef41db3bf1cd8ff0c8f1e16553c1f1e401d0d197ea31c33bd3389e5243aa09abed02d264740979c409798aaecda6c59a247e32d17f38ef51b93c57d2f17a03c0dff456bfa207438e5c216691a2296c18e6ce215a42e8bc78def7c94"}, {0xdd, 0x8c, "a1a247db043bdb746cab354bacd1ba4b941fab194fbb19dcdf310fab0948de8f22183998dd749cdc0cac7fa6d6d7baad00ede399c341e7f32c3cd72ff38296f159de84dbd5938bfd687d6b18e8c3a023e8cd1b91210e02ca32b8cf5872d0a3f70f061375d972db02ac0f71cf8a008b584fef09630f35cb44234b6e6e72c7ea4e5df083218fa03fe8865964db"}, {0xdd, 0xc9, "3c300b3aacf4fc896f1d60a3f5decfb2667d293fcd4b77801dabc1cc7e3fffc2d1e5b3d5941fa4ce1f52ab59aa57d33f0a5ef707203fdc97c8eeccbe296c215edf29f96e9baf493ba41201f07ad4f1c71f97e492f620aa5c0cbeda32b1e37ea4c5e51793524ab7eb7309b6c479077d293240348a9b8bb91e868387bfad21fc5ac8650e186538d5c635700ba641e98e6d54bf6e0221fa5b58dcf48cd2f894daec164339d6bbba28054fdc19660dc16dfb47b72e53fa9f6089d171748945ae2359c3f92b00f8ccc86196"}, {0xdd, 0x57, "8b1a03e7866db378b3727fbc04d226130839436f49257e46d9be20f0ed103505d4172dec2afa698d4f10b8e057c7d492a735cb7e2cc41f54786e86f9061ae662ea3439ee3608fb68d4003991cbea3beba3eada0ca86f23"}, {0xdd, 0xba, "36dfe1405e837516aad5e3c2b15630500327428be492718aaef5df33794348eb4477cf8e1a6bc42550cb210adc401ccc74b9bba2484bb6a26e421bd09f7cef9cf91ba3f4da5e799d28dd4924da344712668feb8099d5dacf439d47735d41a3192fd55144b611a5d15c9df586353c3fac786d627508a4502ec4fbc6f607522f39eee94ef887514f28ab7a2923427f41b6db9d3d359f2fcf28e403bcd52310699ecdeb505e61f01e009b80fa6541070434a83dce42951d955cd54e"}, {0xdd, 0xbf, "cdc86f8b5c9c36e1d11d5017d291615e16244e5bfcfd998fdcdbacd2dbec17dd035191f8ac0d949e048629cbbcd70b49fa2a0cfa83618386ff4badd55cd704248c89e20203c484ba945d738dd11cae8399dd9124398cf0b22d0e75a20324d2cb1565651c474a8dfa53053975fc53d0b69ad3e92a2cfe28f3f6c3fb7a8dfb2c4588341955e4d71c463e298555d5c0450f6dc7661d17c764c1589d7960fac2fcf96f54ebe086e297da432dae0e4efb3f7b7e8080b1f8c41d02e07dc6303bc6ee"}, {0xdd, 0xe7, "88e81d7f6366827841f6e392aa88fd73da95fba8282a3835cdcc706040b795caf9a24ea6f4f919364d511744f060bf9c22bc546fd81e0e111a5b63e5097ea740d9faddaddae8d60723ca290eeaa83ac723c768502808d966f73d2d16cb371ad14c53abd916ff9c9d49a719921b6bd8a3b11ac91d811de4b3aa828eb6030b42c6f26e90e3336c11194f945bca8a7dd7ff099f07d5eb97c3cda1e3d7f79af55d58fd821149c1f587443b62ccfd8e5f1b261e46740e1e20a189d0b7a1c173242e0959e23047e48bdd2bfde9b195f69519886dab20cf1208e9280392fd44e4492eb6fe46fe5725e736"}, {0xdd, 0x27, "43bc745229bf57122312c7294ccedba4ee817582c469c5f88086de89c706ce915145a22e119d5f"}]}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1702}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x1}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x5bc}}, 0xc001) 16:28:38 executing program 4: syz_mount_image$ntfs(&(0x7f0000000140)='ntfs\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="64697361626c655f737061727365cc91cfb9a6a7061e89835ca2463db1b01b56cf0e434be4723d6e6f2c6572726f7273"]) [ 1412.554388][ T5307] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1412.620076][ T5311] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:38 executing program 3: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @random="e0d35b1004bb", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00006371ae9b1c01"}}}}}, 0x0) [ 1412.824422][ T5316] netlink: 'syz-executor.0': attribute type 1 has an invalid length. 16:28:38 executing program 2: timer_create(0x8, &(0x7f00000002c0)={0x0, 0x0, 0x1, @thr={0x0, 0x0}}, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000280)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000140)={{0x77359400}, {r0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x77359400}}, &(0x7f00000000c0)) [ 1412.986967][ T5307] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:38 executing program 5: unshare(0x400) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000300), 0x4) [ 1413.078249][ T5319] netlink: 'syz-executor.0': attribute type 1 has an invalid length. [ 1413.092862][ T5323] ntfs: (device loop4): parse_options(): Unrecognized mount option disable_sparsȇϹ¦§‰ƒ\¢F. [ 1413.103760][ T5323] ntfs: (device loop4): parse_options(): The errors option requires an argument. [ 1413.193489][ T5323] ntfs: (device loop4): parse_options(): Unrecognized mount option disable_sparsȇϹ¦§‰ƒ\¢F. [ 1413.204194][ T5323] ntfs: (device loop4): parse_options(): The errors option requires an argument. 16:28:39 executing program 5: r0 = openat$cachefiles(0xffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x301400, 0x0) listen(r0, 0x0) 16:28:39 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x6}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:39 executing program 4: r0 = openat$vimc1(0xffffff9c, &(0x7f0000000280)='/dev/video1\x00', 0x2, 0x0) ioctl$VIDIOC_G_EDID(r0, 0xc04c561a, &(0x7f0000000300)={0x0, 0x0, 0x0, [], 0x0}) 16:28:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x2, 0x70bd29, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x84}, 0x804) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) sendmsg$NL80211_CMD_SET_KEY(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000040)={&(0x7f00000002c0)={0x78, r2, 0x808, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY={0x44, 0x50, 0x0, 0x1, [@NL80211_KEY_SEQ={0x7, 0x4, "085efe"}, @NL80211_KEY_DEFAULT_TYPES={0xc, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x20, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_SEQ={0x7, 0x4, "3c1ece"}]}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x20008041}, 0x0) 16:28:39 executing program 3: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @random="e0d35b1004bb", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00006371ae9b1c01"}}}}}, 0x0) 16:28:39 executing program 2: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) r1 = dup(r0) getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, 0x0, &(0x7f0000000100)) [ 1413.837655][ T5342] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x200000000204a100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@ipv4={[], [], @empty}, 0x0, 0x0, 0x0, 0x4}, 0x20) [ 1413.896835][ T5345] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:40 executing program 3: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @random="e0d35b1004bb", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00006371ae9b1c01"}}}}}, 0x0) 16:28:40 executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000600500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b000000800000002f000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="000000000000000000000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000000040)='6', 0x1, 0x560}], 0x0, &(0x7f0000000080)) [ 1414.264120][ T5342] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1414.280326][ T5358] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable 16:28:40 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b8050000000f01c10f46a78900000066ba2100b067ee4066ba2000b000eeedb9800000c00f3266bac0000f3066b808008ed0660f38806f000f011c268ee0", 0x3e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000040)=0x4, 0x4) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000300)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c7]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) getsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f00000000c0)) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, 0x1c) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000003c0)={0x1, 0x0, @ioapic={0x5000}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:28:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f00)={&(0x7f0000000440)={0x40, r1, 0x105, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @val={0xc}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}]]}, 0x40}}, 0x0) 16:28:40 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='t\x00@\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) 16:28:40 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x7}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1414.778941][ T5372] EXT4-fs (loop4): bad geometry: block count 512 exceeds size of device (2 blocks) [ 1414.937138][ T5370] kvm: pic: non byte read [ 1414.975886][ T5372] EXT4-fs (loop4): bad geometry: block count 512 exceeds size of device (2 blocks) 16:28:40 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x3) ioctl$TCFLSH(r0, 0x540b, 0x0) [ 1415.029961][ T5370] kvm: pic: non byte read [ 1415.083826][ T5370] kvm: pic: non byte read [ 1415.107750][ T5383] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1415.135474][ T5370] kvm: pic: single mode not supported [ 1415.135499][ T5370] kvm: pic: level sensitive irq not supported [ 1415.178087][ T5386] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1415.210144][ T5370] kvm: pic: non byte read [ 1415.252711][ T5370] kvm: pic: non byte read 16:28:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x40, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x1, 0x6d}, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'bridge0\x00'}]}, 0x40}}, 0x0) [ 1415.302587][ T5370] kvm: pic: level sensitive irq not supported [ 1415.302659][ T5370] kvm: pic: non byte read 16:28:41 executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000600500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b000000800000002f000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="000000000000000000000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000000040)='6', 0x1, 0x560}], 0x0, &(0x7f0000000080)) [ 1415.669494][ T5383] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:41 executing program 2: syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000340)={[{@noalign='noalign'}]}) 16:28:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r3 = socket$nl_rdma(0x10, 0x3, 0x14) setsockopt$netlink_NETLINK_RX_RING(r3, 0x10e, 0x6, &(0x7f0000000380)={0x5, 0x9, 0x5, 0x9}, 0x10) sendmsg$NL80211_CMD_SET_CHANNEL(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r2, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x400}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20044840}, 0x8000) r4 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r4, 0x2) r5 = socket$packet(0x11, 0x3, 0x300) dup3(r5, r4, 0x0) setsockopt$inet6_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f00000003c0)=@ccm_128={{0x304}, "a05f5101ffba81d6", "e6831bdab124e735318f3ffe207e12a9", "c8104c55", "9a103ea66235ab21"}, 0x28) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000008000300", @ANYRES32=r6, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:28:41 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0)='devlink\x00') sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000680)={0x4c, r1, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd, 0x87, 'l2_drops\x00'}, {0x5}}]}, 0x4c}}, 0x0) [ 1415.834968][ T5404] EXT4-fs (loop4): bad geometry: block count 512 exceeds size of device (2 blocks) 16:28:41 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000080)="240000002e20070356ff01010000000000000a0009000000001d85680c1ba3a20400bf7e280000005e00ffffba16aeaa1c0009b3ebea865131d338fc16d1b0c6f1bd2138bb7e55d900000000", 0x4c}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000003c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 16:28:41 executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000600500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b000000800000002f000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="000000000000000000000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000000040)='6', 0x1, 0x560}], 0x0, &(0x7f0000000080)) 16:28:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x8}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1416.146758][ T5410] XFS (loop2): Invalid superblock magic number [ 1416.226453][ T5423] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 16:28:42 executing program 5: r0 = socket$inet(0x2, 0x2000000080002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000001c0)=@broute={'broute\x00', 0xa, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000100], 0x2, 0x0, &(0x7f0000000100)=[{}, {}, {}]}, 0xe0) 16:28:42 executing program 2: syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000340)={[{@noalign='noalign'}]}) [ 1416.523142][ T5423] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1416.578892][ T5435] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:42 executing program 3: syz_mount_image$nilfs2(&(0x7f0000000000)='nilfs2\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="02000000000034340501", 0xa, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000017100)) [ 1416.630579][ T5440] EXT4-fs (loop4): bad geometry: block count 512 exceeds size of device (2 blocks) [ 1416.631389][ T5441] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:42 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$dlm_control(0xffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x20200, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') r5 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r4, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r5}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000880)={0x1c, r4, 0x1, 0x0, 0x0, {0x5}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000340)={&(0x7f0000000040), 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r4, 0x100, 0x70bd26, 0x1000}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x80) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r9, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x20, r8, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0x4}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_SET_REG(r3, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10008000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="04005e8d316eef8b66ab65cf5fad2d088a76029a18b626bd5e00ffdbdf251a000000e684ab4fde1d0f648d4bacec00738c617bbeee56b5da7d20261267d5470831"], 0x14}, 0x1, 0x0, 0x0, 0x48044}, 0x2b13aba863d056d6) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:28:42 executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000600500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b000000800000002f000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="000000000000000000000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000000040)='6', 0x1, 0x560}], 0x0, &(0x7f0000000080)) [ 1417.030307][ T5450] XFS (loop2): Invalid superblock magic number [ 1417.067189][ T5453] NILFS (loop3): couldn't find nilfs on the device [ 1417.091188][ T5435] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1417.179052][ T5453] NILFS (loop3): couldn't find nilfs on the device 16:28:43 executing program 5: futex(&(0x7f0000000080), 0x800000000005, 0x0, 0x0, &(0x7f00000000c0), 0xc3400007) 16:28:43 executing program 2: syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000340)={[{@noalign='noalign'}]}) 16:28:43 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_PASTESEL(r0, 0x5412, &(0x7f0000000080)=0x1a) 16:28:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x9}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1417.569180][ T5473] futex_wake_op: syz-executor.5 tries to shift op by 1024; fix this program [ 1417.605106][ T5468] EXT4-fs (loop4): bad geometry: block count 512 exceeds size of device (2 blocks) [ 1417.725629][ T5473] futex_wake_op: syz-executor.5 tries to shift op by 1024; fix this program [ 1418.312628][ T5488] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gre={{0x8, 0x1, 'gre\x00'}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_OFLAGS={0x6, 0x13}]}}}]}, 0x3c}}, 0x0) [ 1418.387407][ T5485] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1418.407279][ T5483] XFS (loop2): Invalid superblock magic number 16:28:44 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="24fcff00fe02e32f68b6b24751a30631fd1044f9dadc8b6388499934f2db5601a440e3e364f3fa57e8387a37ed696587ccfcac3ed5fa4ca4a121534e25c84afca3440d9f0d4d15d6ab2602a254f129dadf25fa57f7e4", @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r2, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:28:44 executing program 3: openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') write$binfmt_elf32(r0, 0x0, 0x0) 16:28:44 executing program 2: syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000340)={[{@noalign='noalign'}]}) 16:28:44 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=@newtaction={0x6c, 0x30, 0xffff, 0x0, 0x0, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8, 0x1, 'ife\x00'}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x3}]}, @TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) [ 1418.883719][ T5485] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1418.951416][ T5495] netlink: 'syz-executor.5': attribute type 19 has an invalid length. 16:28:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0xa}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:45 executing program 4: setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000005c0)=0x1, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x380000, @ipv4}, 0x1c) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@loopback}, &(0x7f00000004c0)=0x20) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@remote}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0), 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000300)={@local={0xfe, 0x80, [0xa4ffffff]}}, &(0x7f00000004c0)=0x20) 16:28:45 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000000)={0x2, 'ip_vti0\x00'}, 0x18) [ 1419.603949][ T5509] XFS (loop2): Invalid superblock magic number 16:28:45 executing program 3: close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile64(0xffffffffffffffff, r0, 0x0, 0x0) [ 1419.836593][ T5522] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1419.902194][ T5526] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:45 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = openat$mice(0xffffff9c, &(0x7f0000000040)='/dev/input/mice\x00', 0x4201) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r3, 0x40a45323, &(0x7f0000000400)={{0x4, 0x40}, 'port0\x00', 0x20, 0x191000, 0x2, 0x8, 0xffffff16, 0x20, 0x7, 0x0, 0x0, 0x8}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="ffffef7f1f00000000b80294b359118072475619000000bf0000000000", @ANYRES16=r1, @ANYBLOB="000400000000fddbdf250f00000008000300", @ANYRES32=r4, @ANYBLOB="0c009900000000003200000036010e00800000000802110000000802110000000802110000010000000000000000000064000100056fd67e1cf10fe740e9261bdbe541d12d624d56974c1f6878e46eb6d249d06d973799d043d88a532ba9833f654e8b9c3ecaa6b1262ea9948f25b5adfc84834f50da952fdaa262ef3eead508ea9f6c5cbd98d8cdc2b8a682d537cb0352f932f5ceb84009987b7bd4e5a77bb21e2c02cc5b2d1a0800000300000000000000400003001e0000000100ff070000347206030303030303dd77a704f9c091714d263c3bc80f3d183b024d76ed6b98baf7db1e0f5e22e2c69cdfbedb1921749acffa6ac781b0469ad4588387751270e85151579d7103bd60ee8ee6931fdc09a0baeb8229e3e3fcd312bd0cd2e053eba461802e86d15b6eda8e4456b83e8144e498838731447e33b6041a665a0f197f7c440000080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x190}}, 0x0) 16:28:46 executing program 5: perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)) write$cgroup_subtree(r0, 0x0, 0xfd45) 16:28:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000140)=0xfffc, 0x4) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000200)=ANY=[], 0x6) recvmmsg(r0, &(0x7f00000033c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 16:28:46 executing program 4: r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', 0x0}) 16:28:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0xb}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:46 executing program 3: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000)='security.capability\x00', 0x0, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0x4240a2a0) r3 = socket$inet(0x2, 0x3, 0x84) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x8000, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000001280)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x19404, 0x0) 16:28:46 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x8e, &(0x7f00000001c0)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "083ff2", 0x58, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x16, 0xc2, 0x0, 0x0, 0x0, {[@window={0x3, 0x3}, @window={0x6, 0x3}, @exp_smc={0xfe, 0x6}, @exp_fastopen={0xfe, 0x13, 0xf989, '\x00'/15}, @timestamp={0x8, 0xa}, @mptcp=@remove_addr={0x1e, 0x18, 0x0, 0x0, "ce0bd61b07af590be62b79623e03f96aa086d1091e"}]}}}}}}}}, 0x0) 16:28:47 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000005c0)=@security={'security\x00', 0xe, 0x4, 0x3a8, 0xffffffff, 0x0, 0x374, 0x13c, 0xffffffff, 0xffffffff, 0x460, 0x460, 0x460, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa4, 0x100}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv4=@dev}}}, {{@ipv6={@loopback, @loopback, [], [], 'veth1_to_bridge\x00', 'bond_slave_0\x00'}, 0x0, 0xd0, 0xf4, 0x0, {}, [@common=@inet=@l2tp={{0x2c, 'l2tp\x00'}}]}, @common=@unspec=@NFQUEUE1={0x24, 'NFQUEUE\x00'}}, {{@ipv6={@loopback, @mcast2, [], [], 'vxcan1\x00', 'wlan1\x00'}, 0x0, 0xa4, 0xec}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'ip6erspan0\x00'}}}], {{[], 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x404) 16:28:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r3, 0x2) r4 = socket$packet(0x11, 0x3, 0x300) dup3(r4, r3, 0x0) write$fb(r3, &(0x7f0000000380)="32b5b2d0eaa03423158ab785902dbf071b963280a7b4d988dc685e544a0a3bfb5468f56cefc566bd0ea65d511679f0f23425964c74acf24f33afcbfd12315c4ad02a4959830aac246712a2f18876d7aacffde45799d5e9f4972829261d0c8ad1fb9a9c8c6344b933ce6fb194ab75a2e1392efa5df7ff0ecf93dfd53eb19a9e352d16b68d8cb68c52baaf794f6e8183a20fe4fd78297da6a80fe0decf87daa8c40fe8fc573bc57e4014bc40e9534b551c4f376836f97cb2377011bcb529dcf248", 0xc0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r5, 0x75c7e8fecf985200, 0x70bd28, 0x25dfdbfd, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4040001) [ 1421.226998][ T5564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:47 executing program 5: unshare(0x2000400) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000180)={0x1f, 0x0, 0x0}) [ 1421.297653][ T5564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1421.370459][ T5569] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 16:28:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x2b) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000440)=0x1, 0xffe6) sendto$inet(r0, &(0x7f0000000180)='M', 0x1, 0x2404c031, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10) [ 1421.693751][ T5564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:47 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000005c0)=@security={'security\x00', 0xe, 0x4, 0x3a8, 0xffffffff, 0x0, 0x374, 0x13c, 0xffffffff, 0xffffffff, 0x460, 0x460, 0x460, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa4, 0x100}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv4=@dev}}}, {{@ipv6={@loopback, @loopback, [], [], 'veth1_to_bridge\x00', 'bond_slave_0\x00'}, 0x0, 0xd0, 0xf4, 0x0, {}, [@common=@inet=@l2tp={{0x2c, 'l2tp\x00'}}]}, @common=@unspec=@NFQUEUE1={0x24, 'NFQUEUE\x00'}}, {{@ipv6={@loopback, @mcast2, [], [], 'vxcan1\x00', 'wlan1\x00'}, 0x0, 0xa4, 0xec}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'ip6erspan0\x00'}}}], {{[], 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x404) 16:28:47 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, 0x9, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_ADT={0x4, 0x8, 0x0, 0x0}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}}, 0x0) 16:28:47 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0xc}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb, 0x1, 'bridge\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x2}]}}}]}, 0x3c}}, 0x0) 16:28:48 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) modify_ldt$write2(0x11, &(0x7f0000000000)={0x6, 0x100000, 0x400, 0x1, 0x2, 0x1, 0x1, 0x1, 0x1}, 0x10) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:28:48 executing program 3: r0 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000002c0)={0x0, 0x3}) [ 1422.483303][ T5596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:48 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000005c0)=@security={'security\x00', 0xe, 0x4, 0x3a8, 0xffffffff, 0x0, 0x374, 0x13c, 0xffffffff, 0xffffffff, 0x460, 0x460, 0x460, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa4, 0x100}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv4=@dev}}}, {{@ipv6={@loopback, @loopback, [], [], 'veth1_to_bridge\x00', 'bond_slave_0\x00'}, 0x0, 0xd0, 0xf4, 0x0, {}, [@common=@inet=@l2tp={{0x2c, 'l2tp\x00'}}]}, @common=@unspec=@NFQUEUE1={0x24, 'NFQUEUE\x00'}}, {{@ipv6={@loopback, @mcast2, [], [], 'vxcan1\x00', 'wlan1\x00'}, 0x0, 0xa4, 0xec}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'ip6erspan0\x00'}}}], {{[], 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x404) [ 1422.558973][ T5596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:48 executing program 5: set_mempolicy(0x3, &(0x7f0000000280)=0x8bd, 0x7) syz_io_uring_setup(0x526e, &(0x7f0000000040), &(0x7f0000000000/0x2000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) [ 1422.975750][ T5596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:49 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) read$alg(r0, 0x0, 0x0) 16:28:49 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x3}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:28:49 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000005c0)=@security={'security\x00', 0xe, 0x4, 0x3a8, 0xffffffff, 0x0, 0x374, 0x13c, 0xffffffff, 0xffffffff, 0x460, 0x460, 0x460, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa4, 0x100}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv4=@dev}}}, {{@ipv6={@loopback, @loopback, [], [], 'veth1_to_bridge\x00', 'bond_slave_0\x00'}, 0x0, 0xd0, 0xf4, 0x0, {}, [@common=@inet=@l2tp={{0x2c, 'l2tp\x00'}}]}, @common=@unspec=@NFQUEUE1={0x24, 'NFQUEUE\x00'}}, {{@ipv6={@loopback, @mcast2, [], [], 'vxcan1\x00', 'wlan1\x00'}, 0x0, 0xa4, 0xec}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'ip6erspan0\x00'}}}], {{[], 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x404) 16:28:49 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0xd}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @erspan={{0xb, 0x1, 'erspan\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x30}, @IFLA_GRE_LINK={0x8, 0xe, r2}]}}}]}, 0x44}}, 0x0) 16:28:49 executing program 5: set_mempolicy(0x3, &(0x7f0000000280)=0x8bd, 0x7) syz_io_uring_setup(0x526e, &(0x7f0000000040), &(0x7f0000000000/0x2000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) [ 1423.754929][ T5637] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1423.808021][ T5640] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1423.813577][ T5639] netlink: 'syz-executor.3': attribute type 14 has an invalid length. [ 1423.946613][ T5641] netlink: 'syz-executor.3': attribute type 14 has an invalid length. 16:28:49 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x274, 0xec, 0x118, 0x118, 0xec, 0x118, 0x1d0, 0x1fc, 0x1fc, 0x1d0, 0x1fc, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0xa4, 0xc8}, @common=@unspec=@STANDARD={0x24}}, {{@uncond, 0x0, 0xa4, 0xe4}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "aae10f3c8ba2f95e5ce029b11252e10b99b35216c29885200fc7b0f44508"}}}], {{[], 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2d0) 16:28:50 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) read$alg(r0, 0x0, 0x0) [ 1424.216546][ T5637] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gretap={{0xb, 0x1, 'gretap\x00'}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_PMTUDISC={0x5}, @IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}, @IFLA_GRE_FWMARK={0x8}]}}}]}, 0x4c}}, 0x0) 16:28:50 executing program 0: r0 = openat$pfkey(0xffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) unshare(0x8000400) futimesat(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x1dc, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x190, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x100000000000000, @default, 0x1, @val={0x0, 0x6, @default_ibss_ssid}, @void, @void, @void, @val={0x6, 0x2, 0x3}, @void, @void, @void, @void, @void, @void, @void, @void, [{0xdd, 0x3e, "242b16215a117f6d515ce4221fb25989a6af3bfe738287f426f7e66fa40a7107c2dc8816e21a229059372e669b20b40dde3c35e928461f7d86d2b26cde16"}, {0xdd, 0x46, "4e64ee79b63c4443a16c6c2d5b6d689e2b405a29b1d2e194bf29aa65be49930b25f9cbc1483cae9b45794685c740d369e36da03be695b622a40c876f5a4286d4e32ef3279a52"}, {0xdd, 0xd2, "f9c55683741520c26726ad5184033527c21bc058b6bfdf086f0c491addf396fd74422b79415f8750499b88f9df5fb504d255f048cb0f054af080260dced5e9d5db26cf1a258a235a3c3dfe5ab9bbc721b7d2813d7184046d5e3d758c574df0b0d16c44cea2d59fd32e14244d62d0467651c7556447e95975a0fa60d0ef328c3ce892bc5b03dfce1a718bfb73d0112eea253892c3d99e765c4b67bcbce3ceecdd5f8054c0fbc1152516e58abcfdf366910a124fa3007f4f9e6fea9bf930c0b1aae73c2463a75c35406afb21f95df01ecc7ed5"}]}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1707}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x1dc}}, 0x0) 16:28:50 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0xe}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:28:50 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x274, 0xec, 0x118, 0x118, 0xec, 0x118, 0x1d0, 0x1fc, 0x1fc, 0x1d0, 0x1fc, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0xa4, 0xc8}, @common=@unspec=@STANDARD={0x24}}, {{@uncond, 0x0, 0xa4, 0xe4}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "aae10f3c8ba2f95e5ce029b11252e10b99b35216c29885200fc7b0f44508"}}}], {{[], 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2d0) 16:28:50 executing program 5: set_mempolicy(0x3, &(0x7f0000000280)=0x8bd, 0x7) syz_io_uring_setup(0x526e, &(0x7f0000000040), &(0x7f0000000000/0x2000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 16:28:50 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) read$alg(r0, 0x0, 0x0) [ 1425.055579][ T5658] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:28:51 executing program 3: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x100000, 0x0) mount(&(0x7f0000000180)=@filename='./file0\x00', &(0x7f00000000c0)='.', 0x0, 0x23880, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x80000, 0x0) mount(&(0x7f00000002c0)=ANY=[@ANYBLOB='/'], &(0x7f00000001c0)='./file0\x00', 0x0, 0x5110, 0x0) mount(&(0x7f0000000280)=@filename='./file0\x00', &(0x7f0000000140)='.', 0x0, 0x2003002480, 0x0) 16:28:51 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x274, 0xec, 0x118, 0x118, 0xec, 0x118, 0x1d0, 0x1fc, 0x1fc, 0x1d0, 0x1fc, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0xa4, 0xc8}, @common=@unspec=@STANDARD={0x24}}, {{@uncond, 0x0, 0xa4, 0xe4}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "aae10f3c8ba2f95e5ce029b11252e10b99b35216c29885200fc7b0f44508"}}}], {{[], 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2d0) 16:28:51 executing program 5: set_mempolicy(0x3, &(0x7f0000000280)=0x8bd, 0x7) syz_io_uring_setup(0x526e, &(0x7f0000000040), &(0x7f0000000000/0x2000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 16:28:51 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="240000000265905417692bdbfebc7d5f5216853915128d28161f3395eb07bf82ce3fb64c92a759d47e9e364b7c92e5bb049fa1ff32e869243a55957e39073673136a91bdda21bc95a5ab85d4002721e328f9f87fc7e8c95bc12f45a711036d7c55b11419717f6477bf5ab952f365e2466bbb6618c007855f79235d7fd5abc215d60e75ac", @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r2, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x7c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2e, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac=@device_b}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x3c, 0x4, {0x1, 0x3, 0xc, 0x5}}, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xa}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x7c}}, 0x0) 16:28:51 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) read$alg(r0, 0x0, 0x0) 16:28:51 executing program 3: futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x800000000005, 0x0, 0x0, &(0x7f0000048000), 0x4000000) 16:28:51 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x274, 0xec, 0x118, 0x118, 0xec, 0x118, 0x1d0, 0x1fc, 0x1fc, 0x1d0, 0x1fc, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0xa4, 0xc8}, @common=@unspec=@STANDARD={0x24}}, {{@uncond, 0x0, 0xa4, 0xe4}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "aae10f3c8ba2f95e5ce029b11252e10b99b35216c29885200fc7b0f44508"}}}], {{[], 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2d0) 16:28:52 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x3, 0x1, 0x101}, 0x14}}, 0x0) [ 1426.720391][ T3515] tipc: TX() has been purged, node left! [ 1429.834180][ T3515] device hsr_slave_0 left promiscuous mode [ 1429.858715][ T3515] device hsr_slave_1 left promiscuous mode [ 1429.895632][ T3515] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1429.903622][ T3515] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1429.924729][ T3515] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1429.932549][ T3515] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1429.943072][ T3515] device bridge_slave_1 left promiscuous mode [ 1429.949803][ T3515] bridge0: port 2(bridge_slave_1) entered disabled state [ 1429.969386][ T3515] device bridge_slave_0 left promiscuous mode [ 1429.976466][ T3515] bridge0: port 1(bridge_slave_0) entered disabled state [ 1430.015136][ T3515] device veth1_macvtap left promiscuous mode [ 1430.022609][ T3515] device veth0_macvtap left promiscuous mode [ 1430.028786][ T3515] device veth1_vlan left promiscuous mode [ 1430.035174][ T3515] device veth0_vlan left promiscuous mode [ 1435.727494][ T3515] team0 (unregistering): Port device team_slave_1 removed [ 1435.747109][ T3515] team0 (unregistering): Port device team_slave_0 removed [ 1435.764304][ T3515] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1435.781280][ T3515] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1435.864688][ T3515] bond0 (unregistering): Released all slaves [ 1435.925890][ T5739] IPVS: ftp: loaded support on port[0] = 21 [ 1436.001187][ T30] Bluetooth: hci4: command 0x0409 tx timeout [ 1436.148735][ T5739] chnl_net:caif_netlink_parms(): no params data found [ 1436.283258][ T5739] bridge0: port 1(bridge_slave_0) entered blocking state [ 1436.290533][ T5739] bridge0: port 1(bridge_slave_0) entered disabled state [ 1436.301490][ T5739] device bridge_slave_0 entered promiscuous mode [ 1436.335053][ T5739] bridge0: port 2(bridge_slave_1) entered blocking state [ 1436.342648][ T5739] bridge0: port 2(bridge_slave_1) entered disabled state [ 1436.353057][ T5739] device bridge_slave_1 entered promiscuous mode [ 1436.420311][ T5739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1436.445787][ T5739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1436.508029][ T5739] team0: Port device team_slave_0 added [ 1436.524675][ T5739] team0: Port device team_slave_1 added [ 1436.608241][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1436.616195][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1436.642394][ T5739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1436.696523][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1436.703889][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1436.730745][ T5739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1436.814257][ T5739] device hsr_slave_0 entered promiscuous mode [ 1436.827767][ T5739] device hsr_slave_1 entered promiscuous mode [ 1436.836411][ T5739] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1436.844949][ T5739] Cannot create hsr debugfs directory [ 1437.246286][ T5739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1437.277790][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1437.286758][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1437.310809][ T5739] 8021q: adding VLAN 0 to HW filter on device team0 [ 1437.330793][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1437.343115][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1437.352674][ T8468] bridge0: port 1(bridge_slave_0) entered blocking state [ 1437.359810][ T8468] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1437.384409][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1437.394461][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1437.404917][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1437.414678][ T8468] bridge0: port 2(bridge_slave_1) entered blocking state [ 1437.422110][ T8468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1437.444418][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1437.469738][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1437.494278][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1437.504742][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1437.522668][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1437.554874][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1437.564850][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1437.576168][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1437.586773][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1437.607611][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1437.618145][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1437.643002][ T5739] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1437.688810][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1437.697548][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1437.730521][ T5739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1437.847949][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1437.858395][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1437.919680][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1437.929075][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1437.950879][ T5739] device veth0_vlan entered promiscuous mode [ 1437.959494][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1437.969320][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1438.008544][ T5739] device veth1_vlan entered promiscuous mode [ 1438.029888][ T30] Bluetooth: hci4: command 0x041b tx timeout [ 1438.071009][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1438.081129][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1438.103448][ T5739] device veth0_macvtap entered promiscuous mode [ 1438.126772][ T5739] device veth1_macvtap entered promiscuous mode [ 1438.168048][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1438.179533][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.189728][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1438.200415][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.211999][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1438.223304][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.233832][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1438.244792][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.255065][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1438.265688][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.278760][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1438.290870][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1438.300800][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1438.310020][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1438.320451][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1438.338802][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1438.349517][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.359916][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1438.370605][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.380943][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1438.392841][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.403041][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1438.413742][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.425392][ T5739] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1438.437281][ T5739] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.450673][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1438.461635][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1438.471974][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1438.854267][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1438.862425][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1438.936492][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1438.970436][ T3515] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1438.978911][ T3515] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1438.993833][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1439.191125][ T5966] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1439.217388][ T5966] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:05 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0xf}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:05 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x50, 0x1, 0x9, 0x5, 0x0, 0x0, {}, [@NFCTH_TUPLE={0x3c, 0x2, [@CTA_TUPLE_PROTO={0x4, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @empty}}}]}]}, 0x50}}, 0x0) 16:29:05 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_buf(r0, 0x0, 0x400000000000485, 0x0, &(0x7f0000000000)=0x2) 16:29:05 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r2 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r2, 0x1) flock(r2, 0x1) flock(r2, 0x2) ioctl$VIDIOC_SUBDEV_G_EDID(r2, 0xc0245628, &(0x7f0000000040)={0x0, 0xffff, 0xdff5, [], &(0x7f0000000000)=0x9}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r4 = syz_open_dev$vcsu(&(0x7f0000000180)='/dev/vcsu#\x00', 0x2, 0x20d00) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000300)={0x0, 0x2}, 0x8) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000008e2c000000004000"/23, @ANYRES32=r3, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x6c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_TAIL={0x1e, 0xf, [@chsw_timing={0x68, 0x4, {0xffe1, 0x5}}, @link_id={0x65, 0x12, {@from_mac=@device_b, @broadcast}}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x6c}}, 0x0) [ 1439.537610][ T5966] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:05 executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x1}, 0x8) sendto$inet6(r0, &(0x7f0000847fff)='x', 0x1, 0x0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @ipv4={[], [], @rand_addr=0x64010101}}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="81", 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @private2}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000002c0), 0x8) 16:29:05 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001840)={0xe, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x64}]}, &(0x7f0000001600)='GPL\x00', 0x5, 0xb6, &(0x7f0000001700)=""/182, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 1439.811785][ T5977] netlink: 'syz-executor.2': attribute type 2 has an invalid length. [ 1440.114419][ T30] Bluetooth: hci4: command 0x040f tx timeout 16:29:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) keyctl$invalidate(0x15, 0x0) 16:29:06 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001840)={0xe, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x64}]}, &(0x7f0000001600)='GPL\x00', 0x5, 0xb6, &(0x7f0000001700)=""/182, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 16:29:06 executing program 2: write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="8f4260770000000000000000873c6fa532"], 0x191) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000100)="b2ed64d5a1f79b06931ebfb0d226df6d", 0x10}, {&(0x7f00000001c0)='J', 0x1}, {&(0x7f0000000140)="e1", 0x1}, {0x0}], 0x2f) [ 1440.243020][ T5988] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1440.296203][ T5989] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:06 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') capset(&(0x7f0000000340)={0x19980330}, &(0x7f0000000380)={0x81, 0x10001, 0x1, 0xfff, 0x2, 0x9}) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x48, r5, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3f}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x1}]}, 0x48}}, 0x1) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000880)={0x1c, r5, 0x1, 0x0, 0x0, {0x5}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000300)={&(0x7f0000000000), 0xc, &(0x7f00000002c0)={&(0x7f0000000040)={0x24, r5, 0x2, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x84) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) [ 1440.693118][ T5988] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@bridge_setlink={0x3c, 0x13, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET={0x18, 0x4, 0x0, 0x1, {0x14, 0xa, 0x0, 0x1, [{0x8, 0x1}, {0x8, 0x2}]}}]}]}, 0x3c}}, 0x0) 16:29:06 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/timer\x00', 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0x40345410, &(0x7f0000000280)={0x3}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000000)={0x5, 0x0, 0x7d}) 16:29:06 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:06 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001840)={0xe, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x64}]}, &(0x7f0000001600)='GPL\x00', 0x5, 0xb6, &(0x7f0000001700)=""/182, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 16:29:07 executing program 2: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDCTL_SYNTH_INFO(r0, 0xc0045405, &(0x7f0000000040)={"49c6d8c7df7b10504e97b31f6ec73480518ecd43bb65b3294bcb64181a0d"}) 16:29:07 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_GET_SECUREBITS(0x1b) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:29:07 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) setsockopt$inet_mreqn(r0, 0x0, 0x28, &(0x7f0000000080)={@multicast1, @local, r2}, 0xc) 16:29:07 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001840)={0xe, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x64}]}, &(0x7f0000001600)='GPL\x00', 0x5, 0xb6, &(0x7f0000001700)=""/182, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 1441.682362][ T6031] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:07 executing program 5: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f0000000140)="240000005a001f00ff03f4f9002304000a04f51108000100020100020800028001", 0x21) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$nl_route(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) [ 1441.772232][ T6033] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:07 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0}]}]}, 0x58}}, 0x0) [ 1442.142361][ T6033] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1442.182136][ T8467] Bluetooth: hci4: command 0x0419 tx timeout 16:29:08 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x54, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9, 0x1, 'veth\x00'}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14}}}}, @IFLA_ADDRESS={0xa, 0x1, @broadcast}]}, 0x54}}, 0x0) 16:29:08 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000400)={&(0x7f0000000580)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00012cbd7000fcdbdf25010032710000039cc3b955f5ed4f03b1a40f000200020000009390975665e23d94fe26adf370d84ad7a38d65ee"], 0x1c}}, 0x4004) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) flock(0xffffffffffffffff, 0x1) flock(0xffffffffffffffff, 0x2) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600)='nl80211\x00') sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r4, 0x200, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x4, 0x2f}}}}, [@NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$IP_VS_SO_SET_STOPDAEMON(r5, 0x0, 0x48c, &(0x7f00000003c0)={0x1, 'bridge_slave_1\x00'}, 0x18) r6 = open(&(0x7f0000000040)='./file0\x00', 0x2fc, 0x0) flock(r6, 0x1) flock(r6, 0x1) flock(r6, 0x2) 16:29:08 executing program 3: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000900)={0x1, [0x0]}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x23, &(0x7f00000000c0)={r1}, 0x8) 16:29:08 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:08 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x824b0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x4000}, 0x0, 0xff7fffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x53) 16:29:08 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x14, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0b6300000f630c40"], 0x1, 0xfffffdfd, &(0x7f0000000140)='p'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0xff8e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10630840b4"], 0x0, 0x0, 0x0}) 16:29:08 executing program 4: sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00008feff0)={0x0, 0x193}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="020d0000100000002f3144e800000000030006000720000002004000e0000000000000f5000000000800120002000100000000000000000030006c000203009f7eae02000000adb20200000000152c000000000000000001020014bb000000000000000000000000030005000000000002"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f00000000c0), 0x4000676, 0x0) [ 1443.154794][ T6066] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1443.207677][ T6068] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1443.587752][ T6066] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)={0x30, r1, 0x5, 0x0, 0x25dfdbff, {{}, {@val={0x3, 0x3, r2}, @val={0xc, 0x99, {0x8000, 0x79}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x30}}, 0x80) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r3, 0x2) r4 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r4, 0x2) r5 = socket$packet(0x11, 0x3, 0x300) dup3(r5, r4, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000040)) r6 = socket$inet_dccp(0x2, 0x6, 0x0) r7 = accept4(r3, &(0x7f0000000300)=@hci, &(0x7f0000000380)=0x80, 0x0) sendmsg$DEVLINK_CMD_TRAP_SET(r7, &(0x7f0000000540)={&(0x7f00000003c0), 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0xd4, 0x0, 0x20, 0x70bd27, 0x25dfdbfd, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x1c, 0x82, 'source_mac_is_multicast\x00'}, {0x5, 0x83, 0x1}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x1c, 0x82, 'source_mac_is_multicast\x00'}, {0x5}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x1c, 0x82, 'source_mac_is_multicast\x00'}, {0x5}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4}, 0x448d1) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r6, 0x8040942d, &(0x7f00000002c0)) dup3(0xffffffffffffffff, r3, 0x0) ioctl$TIOCMGET(r3, 0x5415, &(0x7f0000000000)) [ 1443.669779][ T6078] binder: 6074:6078 unknown command 0 [ 1443.675730][ T6078] binder: 6074:6078 ioctl c0306201 20000200 returned -22 [ 1443.728402][ T6079] binder: 6074:6079 ioctl c0306201 200000c0 returned -14 [ 1443.785217][ T6080] binder: 6074:6080 unknown command 0 [ 1443.790696][ T6080] binder: 6074:6080 ioctl c0306201 20000040 returned -22 16:29:09 executing program 3: socket$packet(0x11, 0x0, 0x300) r0 = socket$kcm(0x10, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f0000000100)={[0x0, 0x4]}, 0x8) r2 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_mreqsrc(r2, 0x0, 0x25, &(0x7f0000000000)={@multicast1=0xe0000306, @dev={0xac, 0x14, 0x14, 0x28}, @remote}, 0xc) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-generic\x00'}, 0x58) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000140)={0x1, 0x4, 0x201, 0x0, 0x7, 0x20, 0x7, 0x6}, 0x20) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb92e0a480e000d000000e8bd6efb250309000e000100240248ff050005001201", 0x2e}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x32b, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb92e0a480e000d00000009000e00390340d5ae7d0200ff050005", 0x2e}], 0x1}, 0x80) [ 1443.893670][ T6078] binder: 6074:6078 unknown command 0 [ 1443.899407][ T6078] binder: 6074:6078 ioctl c0306201 20000200 returned -22 [ 1443.912062][ T6079] binder: 6074:6079 unknown command 0 [ 1443.917650][ T6079] binder: 6074:6079 ioctl c0306201 20000040 returned -22 16:29:09 executing program 4: openat$vcsa(0xffffff9c, &(0x7f0000000100)='/dev/vcsa\x00', 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x5c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6gre={{0xb, 0x1, 'ip6gre\x00'}, {0x24, 0x2, 0x0, 0x1, [@IFLA_GRE_FWMARK={0x8}, @IFLA_GRE_FLOWINFO={0x8, 0xc, 0x1000}, @IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e24}]}}}, @IFLA_MASTER={0x8, 0x3, r2}]}, 0x5c}}, 0x0) 16:29:09 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x3}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1444.187290][ T6090] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.0'. 16:29:10 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x9, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x61, 0x11, 0x1c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 16:29:10 executing program 5: capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000040)) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000280)="580000001500add427323b472545b4560a117fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) [ 1444.433366][ T6090] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1444.574019][ T6097] bridge0: port 2(bridge_slave_1) entered disabled state [ 1444.581883][ T6097] bridge0: port 1(bridge_slave_0) entered disabled state [ 1444.589596][ T6097] device bridge0 entered promiscuous mode [ 1444.808560][ T6104] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1444.853022][ T6106] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000040)={&(0x7f00000002c0)={0x1dc, r1, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_REG_RULES={0x1b8, 0x22, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x3}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x9}, @NL80211_ATTR_DFS_CAC_TIME={0x8}]}, {0x4c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x101}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x2}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x81}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xe93}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x4}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x10001}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xff}]}, {0x4c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x5}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x800}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x93}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x9}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x2}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x80000000}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x7}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x5}]}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x3}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x2}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x1000}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x6}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x7}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x8001}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xb0f}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x4}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x8001}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x1}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x7ff}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xda}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x6}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x1}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x2}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x101}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x3}]}, {0x4c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x3}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xffff}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x778b}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x2}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x2}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xef}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xce}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xff}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x639}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7}]}]}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) r3 = openat$dlm_control(0xffffff9c, &(0x7f0000000500)='/dev/dlm-control\x00', 0x20000, 0x0) getsockopt$inet6_tcp_buf(r3, 0x6, 0xd, &(0x7f0000000540)=""/232, &(0x7f0000000640)=0xe8) [ 1445.183380][ T6101] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1445.193566][ T6101] bridge0: port 2(bridge_slave_1) entered blocking state [ 1445.200852][ T6101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1445.208898][ T6101] bridge0: port 1(bridge_slave_0) entered blocking state [ 1445.216321][ T6101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1445.225125][ T6101] device bridge0 left promiscuous mode 16:29:11 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x1, 0x4, 0x401, 0x0, 0x0, {}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}]}, 0x1c}}, 0x0) [ 1445.313820][ T6097] bridge0: port 2(bridge_slave_1) entered disabled state [ 1445.321538][ T6097] bridge0: port 1(bridge_slave_0) entered disabled state [ 1445.329555][ T6097] device bridge0 entered promiscuous mode 16:29:11 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x12, 0x3, &(0x7f0000000280)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x5, 0x54}}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfc76, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000040)}, 0x48) 16:29:11 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x806, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23}, 0x1c) listen(r0, 0x3) r1 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r1, &(0x7f0000772000)={0x2, 0x4e23}, 0x10) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000001500), 0x588, 0x0) [ 1445.597551][ T6102] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:12 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x9, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x9, 0x1, 0x8}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x2e], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x23) 16:29:12 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x4}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 16:29:12 executing program 3: socket$packet(0x11, 0x0, 0x300) r0 = socket$kcm(0x10, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f0000000100)={[0x0, 0x4]}, 0x8) r2 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_mreqsrc(r2, 0x0, 0x25, &(0x7f0000000000)={@multicast1=0xe0000306, @dev={0xac, 0x14, 0x14, 0x28}, @remote}, 0xc) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-generic\x00'}, 0x58) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000140)={0x1, 0x4, 0x201, 0x0, 0x7, 0x20, 0x7, 0x6}, 0x20) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb92e0a480e000d000000e8bd6efb250309000e000100240248ff050005001201", 0x2e}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x32b, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb92e0a480e000d00000009000e00390340d5ae7d0200ff050005", 0x2e}], 0x1}, 0x80) 16:29:12 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x12, 0x3, &(0x7f0000000280)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x5, 0x54}}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfc76, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000040)}, 0x48) [ 1446.763706][ T6135] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1446.834695][ T6141] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1446.908949][ T6142] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1446.919112][ T6142] bridge0: port 2(bridge_slave_1) entered blocking state [ 1446.926633][ T6142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1446.934631][ T6142] bridge0: port 1(bridge_slave_0) entered blocking state [ 1446.942058][ T6142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1446.950105][ T6142] device bridge0 left promiscuous mode 16:29:12 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f0000002b00)={0x0, 0x0, &(0x7f0000002ac0)={&(0x7f0000002a80)={0x1c, 0x8, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 16:29:13 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x12, 0x3, &(0x7f0000000280)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x5, 0x54}}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfc76, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000040)}, 0x48) [ 1447.272624][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1447.276261][ T6135] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:13 executing program 3: socket$packet(0x11, 0x0, 0x300) r0 = socket$kcm(0x10, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f0000000100)={[0x0, 0x4]}, 0x8) r2 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_mreqsrc(r2, 0x0, 0x25, &(0x7f0000000000)={@multicast1=0xe0000306, @dev={0xac, 0x14, 0x14, 0x28}, @remote}, 0xc) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-generic\x00'}, 0x58) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000140)={0x1, 0x4, 0x201, 0x0, 0x7, 0x20, 0x7, 0x6}, 0x20) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb92e0a480e000d000000e8bd6efb250309000e000100240248ff050005001201", 0x2e}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x32b, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb92e0a480e000d00000009000e00390340d5ae7d0200ff050005", 0x2e}], 0x1}, 0x80) 16:29:13 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@rand_addr=' \x01\x00', 0x800, 0x0, 0x103, 0x1}, 0x20) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000340)={@dev, 0x800, 0x0, 0xff}, 0x20) 16:29:13 executing program 0: r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r2 = dup3(r1, r0, 0x0) recvmmsg(r2, &(0x7f0000001a80)=[{{0x0, 0x0, &(0x7f0000002fc0)=[{&(0x7f0000004100)=""/4092, 0xffc}], 0x1}}], 0x1, 0x40000162, 0x0) 16:29:13 executing program 2: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_CAPACITY(r0, 0x4c00) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "6df330a38858815e1e85800856738e38dccd285dd95b5eb00ac533b2cfcfeb650eca5108001e76bf1738624fc6a0c7c18915e964a1d5f7b215794df77f661507", "14411f756a9544fe5012124211bac1653517b51e85bdfd967c01a2250ac049b7e285e99d7bdd1f60934a811545b22c1a39d29f2a71a5a6654cae88b595d3e147", "c860ccadbabc9ef6cd1e3ebb6dfd44e21e7ca7781b24d3563ae48857240be4d8"}) 16:29:13 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x5}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1447.935256][ T6160] bridge0: port 2(bridge_slave_1) entered disabled state [ 1447.942916][ T6160] bridge0: port 1(bridge_slave_0) entered disabled state [ 1447.951834][ T6160] device bridge0 entered promiscuous mode 16:29:13 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x12, 0x3, &(0x7f0000000280)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x5, 0x54}}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfc76, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000040)}, 0x48) 16:29:14 executing program 4: r0 = socket(0x28, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) 16:29:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x49, &(0x7f0000000000)=0x2, 0x4) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "083ff2", 0x14, 0x6, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1448.296722][ T6171] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1448.352978][ T6171] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1448.482111][ T6162] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1448.492095][ T6162] bridge0: port 2(bridge_slave_1) entered blocking state [ 1448.499552][ T6162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1448.507617][ T6162] bridge0: port 1(bridge_slave_0) entered blocking state [ 1448.515076][ T6162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1448.523393][ T6162] device bridge0 left promiscuous mode 16:29:14 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x6, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000320000000f000000000000000200000002000000008000000080000020000000e1f4655fe1f4655f0100ffff53ef010001000000e0f4655f000000000000000001000000000000000b0000000001000028", 0x5d, 0x400}, {&(0x7f0000000780)="0000000000000000000000001f4ebd2e6bb144ba8e000d53fbc5896c010000000c00000000000000e0f4655f00000000000000000000000000000000000000003f74420b6fe3596fc0e6bd98abcb8270a25a56a1e3b2a8fb9efdaade336c5cf318ff6637e5a676c394f8d5e209011c9aac21cd284c2983803b365c07f524dfd80e", 0x81, 0x4e0}, {&(0x7f0000010200)='\x00'/20, 0x14, 0x540}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x1000}, {&(0x7f0000012500)="ed41000000100000e0f4655fe1f4655fe1f4655f000000000000040008", 0x1d, 0x4100}, {0x0, 0x0, 0x2004180}], 0x0, &(0x7f0000013800)) 16:29:14 executing program 2: r0 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000040)=0x80000000, 0x4) [ 1448.856037][ T6164] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1448.883806][ T6170] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:14 executing program 3: socket$packet(0x11, 0x0, 0x300) r0 = socket$kcm(0x10, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f0000000100)={[0x0, 0x4]}, 0x8) r2 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_mreqsrc(r2, 0x0, 0x25, &(0x7f0000000000)={@multicast1=0xe0000306, @dev={0xac, 0x14, 0x14, 0x28}, @remote}, 0xc) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-generic\x00'}, 0x58) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000140)={0x1, 0x4, 0x201, 0x0, 0x7, 0x20, 0x7, 0x6}, 0x20) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb92e0a480e000d000000e8bd6efb250309000e000100240248ff050005001201", 0x2e}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x32b, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb92e0a480e000d00000009000e00390340d5ae7d0200ff050005", 0x2e}], 0x1}, 0x80) 16:29:14 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x268, 0x0, 0x5, 0x201, 0x0, 0x0, {}, [{{0x254, 0x1, {{}, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', "279dfe19b55c0217d32900", "b8ba0787e0d2d7e78fc6e2795103e6007edd31a22549795134775a74fd263f3e"}}}]}, 0x268}}, 0x0) 16:29:14 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)={0x7c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @multicast1}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6}]}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev}, {0x8, 0x2, @broadcast=0xe0000001}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x7c}}, 0x0) [ 1449.214031][ T6184] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue 16:29:15 executing program 2: r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000200)='/dev/fb0\x00', 0x0, 0x0) ioctl$FBIOPAN_DISPLAY(r0, 0x4604, &(0x7f0000000240)={0x0, 0x10}) 16:29:15 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @loopback}]}]}, @IFLA_IFNAME={0x14, 0x3, 'ipvlan1\x00'}]}, 0x50}}, 0x0) 16:29:15 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)={0x7c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @multicast1}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6}]}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev}, {0x8, 0x2, @broadcast=0xe0000001}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x7c}}, 0x0) [ 1450.531780][ T6201] bridge0: port 2(bridge_slave_1) entered disabled state [ 1450.539414][ T6201] bridge0: port 1(bridge_slave_0) entered disabled state [ 1450.547281][ T6201] device bridge0 entered promiscuous mode [ 1450.692338][ T6202] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1450.702430][ T6202] bridge0: port 2(bridge_slave_1) entered blocking state [ 1450.709918][ T6202] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1450.718001][ T6202] bridge0: port 1(bridge_slave_0) entered blocking state [ 1450.725411][ T6202] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1450.735680][ T6202] device bridge0 left promiscuous mode [ 1450.876305][ T624] tipc: TX() has been purged, node left! [ 1453.917334][ T624] device hsr_slave_0 left promiscuous mode [ 1453.937413][ T624] device hsr_slave_1 left promiscuous mode [ 1453.958400][ T624] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1453.966643][ T624] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1453.991635][ T624] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1453.999745][ T624] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1454.021591][ T624] device bridge_slave_1 left promiscuous mode [ 1454.029346][ T624] bridge0: port 2(bridge_slave_1) entered disabled state [ 1454.052443][ T624] device bridge_slave_0 left promiscuous mode [ 1454.059261][ T624] bridge0: port 1(bridge_slave_0) entered disabled state [ 1454.098173][ T624] device veth1_macvtap left promiscuous mode [ 1454.106652][ T624] device veth0_macvtap left promiscuous mode [ 1454.113102][ T624] device veth1_vlan left promiscuous mode [ 1454.118923][ T624] device veth0_vlan left promiscuous mode [ 1456.315570][ T624] team0 (unregistering): Port device team_slave_1 removed [ 1456.340786][ T624] team0 (unregistering): Port device team_slave_0 removed [ 1456.358521][ T624] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1456.378770][ T624] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1456.470120][ T624] bond0 (unregistering): Released all slaves [ 1456.548484][ T6235] IPVS: ftp: loaded support on port[0] = 21 [ 1456.792762][ T6235] chnl_net:caif_netlink_parms(): no params data found [ 1456.960255][ T6235] bridge0: port 1(bridge_slave_0) entered blocking state [ 1456.967709][ T6235] bridge0: port 1(bridge_slave_0) entered disabled state [ 1456.977921][ T6235] device bridge_slave_0 entered promiscuous mode [ 1456.997081][ T6235] bridge0: port 2(bridge_slave_1) entered blocking state [ 1457.004777][ T6235] bridge0: port 2(bridge_slave_1) entered disabled state [ 1457.014897][ T6235] device bridge_slave_1 entered promiscuous mode [ 1457.074878][ T6235] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1457.094739][ T6235] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1457.150348][ T6235] team0: Port device team_slave_0 added [ 1457.169489][ T6235] team0: Port device team_slave_1 added [ 1457.220246][ T6235] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1457.221921][ T8467] Bluetooth: hci4: command 0x0409 tx timeout [ 1457.227410][ T6235] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1457.262396][ T6235] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1457.285900][ T6235] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1457.293872][ T6235] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1457.320170][ T6235] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1457.405514][ T6235] device hsr_slave_0 entered promiscuous mode [ 1457.416440][ T6235] device hsr_slave_1 entered promiscuous mode [ 1457.427603][ T6235] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1457.436238][ T6235] Cannot create hsr debugfs directory [ 1457.876721][ T6235] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1457.905699][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1457.915655][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1457.936785][ T6235] 8021q: adding VLAN 0 to HW filter on device team0 [ 1457.960958][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1457.971212][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1457.981464][ T8467] bridge0: port 1(bridge_slave_0) entered blocking state [ 1457.988930][ T8467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1458.033302][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1458.043336][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1458.053455][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1458.063143][ T8467] bridge0: port 2(bridge_slave_1) entered blocking state [ 1458.070438][ T8467] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1458.079849][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1458.090377][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1458.101909][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1458.112649][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1458.138632][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1458.147748][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1458.159196][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1458.186735][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1458.197041][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1458.227586][ T6235] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1458.239829][ T6235] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1458.249811][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1458.260575][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1458.306370][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1458.314205][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1458.343409][ T6235] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1458.496164][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1458.506596][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1458.557455][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1458.567177][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1458.579800][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1458.590036][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1458.616061][ T6235] device veth0_vlan entered promiscuous mode [ 1458.646908][ T6235] device veth1_vlan entered promiscuous mode [ 1458.708489][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1458.717953][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1458.737993][ T6235] device veth0_macvtap entered promiscuous mode [ 1458.758541][ T6235] device veth1_macvtap entered promiscuous mode [ 1458.799600][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1458.811203][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1458.822042][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1458.832711][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1458.842779][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1458.853448][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1458.863538][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1458.874302][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1458.885337][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1458.896399][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1458.908926][ T6235] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1458.920213][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1458.930434][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1458.940142][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1458.950607][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1458.969456][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1458.980613][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1458.991057][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1459.001828][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1459.012271][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1459.023225][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1459.033389][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1459.044040][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1459.054181][ T6235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1459.064838][ T6235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1459.078489][ T6235] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1459.087579][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1459.098180][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1459.352012][ T3114] Bluetooth: hci4: command 0x041b tx timeout [ 1459.444636][ T3532] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1459.452637][ T3532] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1459.462119][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1459.611385][ T3532] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1459.620746][ T3532] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1459.629510][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1459.806590][ T6465] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1459.829420][ T6465] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1460.153551][ T6465] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:26 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x6}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:26 executing program 4: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 16:29:26 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x0, 0x0, 0x0) sendmsg$NLBL_UNLABEL_C_ACCEPT(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x110, 0x3, 0xa, 0x201, 0x0, 0x0, {}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x2c, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'bond_slave_1\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth0_virt_wifi\x00'}]}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_HOOK={0x30, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'syz_tun\x00'}, @NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_COUNTERS={0x28, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_PACKETS={0xc}]}, @NFTA_CHAIN_COUNTERS={0x4c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_BYTES={0xc}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_DELTABLE={0x14}], {0x14}}, 0x16c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x4c, 0x18, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x0, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x201, 0x0, 0x0, {0xa}, @NFT_OBJECT_CONNLIMIT=@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}}, @NFT_MSG_DELFLOWTABLE={0x20, 0x18, 0xa, 0x101, 0x0, 0x0, {}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_DELSETELEM={0x38, 0xe, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x12c}}, 0x4048000) ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f0000001a40)={'geneve0\x00', {0x2, 0x0, @broadcast}}) 16:29:26 executing program 5: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x201, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x401, 0x0) 16:29:26 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)={0x7c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @multicast1}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6}]}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev}, {0x8, 0x2, @broadcast=0xe0000001}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x7c}}, 0x0) 16:29:26 executing program 3: setitimer(0x2, &(0x7f0000000080)={{0x77359400}, {0x0, 0x2710}}, 0x0) setitimer(0x2, &(0x7f0000000240)={{}, {0x0, 0xea60}}, 0x0) [ 1460.310722][ T6469] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1460.378167][ T6469] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:26 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)={0x7c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @multicast1}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6}]}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev}, {0x8, 0x2, @broadcast=0xe0000001}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x7c}}, 0x0) 16:29:26 executing program 2: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCMBIS(r0, 0x5416, &(0x7f0000000440)) [ 1460.771113][ T6469] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:26 executing program 3: r0 = socket$inet6(0xa, 0x5, 0x0) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000000080)=""/4096, &(0x7f0000000000)=0x1000) 16:29:26 executing program 4: unshare(0x400) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080)='/dev/fuse\x00', 0x42, 0x0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 16:29:26 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x7}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1461.382420][ T3114] Bluetooth: hci4: command 0x040f tx timeout 16:29:27 executing program 5: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x18, 0x1411, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x18}}, 0x0) 16:29:27 executing program 2: clone(0x20002044dfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000000), 0x3000000) 16:29:27 executing program 3: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8b04, &(0x7f00000000c0)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\x06\x00\x00\x00Y\x00\x00\x00\x00\x00\x01\x00,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbbg\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2\x0e\xd8\a\xca\xc8~\x82\xf6\xaaj\xe5\xf7\x19\xeb#;|\xabA1\xaa\xbc7Tf\xf1Y\x1c\xed~\xe9\xe9\xf9\xcfW0\x16\xc6G\xa36\xc70Zz\xc7\xe9\x8d\xe8\xd4\x9e2I[\xcf\xf7\xb0K\x1c\x1c\x06h\x8cd\f6\xfe\xb7\xbf\xae\xea\x99\xea\xb3G\xd5\x8c\x80\x90(\x9f\x95\x86\"\x8a\x96\xf5\x19\xb6\x19\twp\xfa\xa9\xd8\xbfSa\xb9\v3\xb1\x05\xb9\xf93\xac\x14\x1fXf\xfd\xde\x1e\x83\x7f\x80\xddL[t% /H\xed\xea\x80*NA\xbaX\r\xea\v\x83<\xa1d') 16:29:27 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x68, r1, 0x8b8e0eb13081c495, 0x0, 0x0, {{}, {0x0, 0x4109}, {0x4c, 0x18, {0x0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) [ 1461.632431][ T6498] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1461.705162][ T6499] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:27 executing program 4: r0 = gettid() process_vm_readv(r0, &(0x7f0000000200)=[{&(0x7f0000000000)=""/242, 0xf2}], 0x1, &(0x7f0000000280)=[{&(0x7f0000000240)=""/14, 0x2000000e}], 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:29:27 executing program 3: r0 = socket$inet6(0xa, 0x140000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendmmsg$sock(r1, &(0x7f0000005600)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000540)="81", 0x1}], 0x2}}], 0x1, 0x0) [ 1462.084945][ T6498] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:28 executing program 5: sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x0, 0x0, 0x0, 0x1}, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x4005}, 0x10) recvmmsg(r0, &(0x7f00000057c0)=[{{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000001600030a"], 0x18}}, 0x0) 16:29:28 executing program 2: clone(0x20002044dfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000000), 0x3000000) 16:29:28 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x2, 0x3, 0x36c, 0x0, 0x228, 0x0, 0x228, 0x228, 0x2d8, 0x2d8, 0x2d8, 0x2d8, 0x2d8, 0x3, 0x0, {[{{@ip={@multicast1, @remote, 0x0, 0x0, 'syzkaller0\x00', 'netpci0\x00'}, 0x0, 0x1c8, 0x228, 0x0, {}, [@common=@inet=@hashlimit3={{0x158, 'hashlimit\x00'}, {'ip6tnl0\x00', {0x2, 0x0, 0x60, 0x0, 0x0, 0x7ff, 0x5, 0x2}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffff, [0x4, 0x3]}, {0xffff}}}}, {{@ip={@remote, @empty, 0x0, 0x0, '\x00', 'ipvlan0\x00'}, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{[], 0x0, 0x70, 0x94}, {0x24}}}}, 0x3c8) 16:29:28 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x8}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:28 executing program 4: r0 = gettid() process_vm_readv(r0, &(0x7f0000000200)=[{&(0x7f0000000000)=""/242, 0xf2}], 0x1, &(0x7f0000000280)=[{&(0x7f0000000240)=""/14, 0x2000000e}], 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:29:28 executing program 3: r0 = socket$inet6(0xa, 0x140000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendmmsg$sock(r1, &(0x7f0000005600)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000540)="81", 0x1}], 0x2}}], 0x1, 0x0) [ 1462.930309][ T6531] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:28 executing program 5: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2000001, 0x13, r0, 0x0) r1 = socket(0x15, 0x5, 0x0) getsockopt(r1, 0x200000000114, 0x8, 0x0, &(0x7f0000019580)=0xfffffffffffffc93) [ 1463.008710][ T6533] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:28 executing program 2: clone(0x20002044dfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000000), 0x3000000) 16:29:29 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xe}, 0x40) 16:29:29 executing program 4: r0 = gettid() process_vm_readv(r0, &(0x7f0000000200)=[{&(0x7f0000000000)=""/242, 0xf2}], 0x1, &(0x7f0000000280)=[{&(0x7f0000000240)=""/14, 0x2000000e}], 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1463.399374][ T6533] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1463.462699][ T3114] Bluetooth: hci4: command 0x0419 tx timeout 16:29:29 executing program 3: r0 = socket$inet6(0xa, 0x140000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendmmsg$sock(r1, &(0x7f0000005600)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000540)="81", 0x1}], 0x2}}], 0x1, 0x0) 16:29:29 executing program 5: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x272) write(r0, &(0x7f000018efdc)="2400000052001f0014f9f407000904000200071010000300feffffff0800000000000000", 0x24) 16:29:29 executing program 2: clone(0x20002044dfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000000), 0x3000000) 16:29:29 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xe}, 0x40) 16:29:29 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x9}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:29 executing program 4: r0 = gettid() process_vm_readv(r0, &(0x7f0000000200)=[{&(0x7f0000000000)=""/242, 0xf2}], 0x1, &(0x7f0000000280)=[{&(0x7f0000000240)=""/14, 0x2000000e}], 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:29:30 executing program 2: r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000080), 0x10) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000040)=0x4, 0x4) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000000), 0x4) 16:29:30 executing program 5: syz_mount_image$tmpfs(&(0x7f0000000000)='tmpfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000012c0)={[{@size={'size', 0x3d, [0x45]}}]}) 16:29:30 executing program 3: r0 = socket$inet6(0xa, 0x140000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendmmsg$sock(r1, &(0x7f0000005600)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000540)="81", 0x1}], 0x2}}], 0x1, 0x0) [ 1464.392974][ T6564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:30 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xe}, 0x40) [ 1464.447995][ T6567] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:30 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r0, 0x5608, 0x3f) [ 1464.837602][ T6567] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1464.874792][ T6561] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:30 executing program 2: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, 0x0, &(0x7f00000000c0)) 16:29:31 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010200000000000000020000000900010073797a300000000030010000030a01020000000000000000020000000900010073797a30000000000d00030073797a32000000002c00048014000300626f6e645f736c6176655f310000000014000300766c616e3000000000000000000000001400030076657468305f7669727402d534e22d"], 0x18c}}, 0x0) 16:29:31 executing program 3: creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x5ff, &(0x7f0000000040)=0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000000)='fuse\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) io_submit(r0, 0x1, &(0x7f0000000640)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="1000000006ffffffffff600000000000", 0x10}]) 16:29:31 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xe}, 0x40) 16:29:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x44, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x23, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_batadv\x00'}, @IPVS_DAEMON_ATTR_STATE={0x4}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}]}, 0x44}}, 0x0) [ 1465.672549][ T6590] netlink: 196 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1466.142214][ T6600] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1466.152758][ T6600] netlink: 3 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1466.275465][ T6601] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1466.285330][ T6601] netlink: 3 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1466.509333][ T3545] tipc: TX() has been purged, node left! [ 1469.470723][ T3545] device hsr_slave_0 left promiscuous mode [ 1469.496798][ T3545] device hsr_slave_1 left promiscuous mode [ 1469.524254][ T3545] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1469.532381][ T3545] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1469.618382][ T3545] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1469.626352][ T3545] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1469.652202][ T3545] device bridge_slave_1 left promiscuous mode [ 1469.658948][ T3545] bridge0: port 2(bridge_slave_1) entered disabled state [ 1469.688867][ T3545] device bridge_slave_0 left promiscuous mode [ 1469.696264][ T3545] bridge0: port 1(bridge_slave_0) entered disabled state [ 1469.740548][ T3545] device veth1_macvtap left promiscuous mode [ 1469.747042][ T3545] device veth0_macvtap left promiscuous mode [ 1469.754231][ T3545] device veth1_vlan left promiscuous mode [ 1469.760105][ T3545] device veth0_vlan left promiscuous mode [ 1472.057048][ T3545] team0 (unregistering): Port device team_slave_1 removed [ 1472.076868][ T3545] team0 (unregistering): Port device team_slave_0 removed [ 1472.097088][ T3545] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1472.119588][ T3545] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1472.199073][ T3545] bond0 (unregistering): Released all slaves [ 1472.274973][ T6627] IPVS: ftp: loaded support on port[0] = 21 [ 1472.507623][ T6627] chnl_net:caif_netlink_parms(): no params data found [ 1472.628292][ T6627] bridge0: port 1(bridge_slave_0) entered blocking state [ 1472.635638][ T6627] bridge0: port 1(bridge_slave_0) entered disabled state [ 1472.646463][ T6627] device bridge_slave_0 entered promiscuous mode [ 1472.682085][ T6627] bridge0: port 2(bridge_slave_1) entered blocking state [ 1472.689516][ T6627] bridge0: port 2(bridge_slave_1) entered disabled state [ 1472.700061][ T6627] device bridge_slave_1 entered promiscuous mode [ 1472.757921][ T6627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1472.777923][ T6627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1472.835941][ T6627] team0: Port device team_slave_0 added [ 1472.852516][ T6627] team0: Port device team_slave_1 added [ 1472.906087][ T16] Bluetooth: hci4: command 0x0409 tx timeout [ 1472.962266][ T6627] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1472.969341][ T6627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1472.996252][ T6627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1473.020243][ T6627] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1473.029385][ T6627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1473.055932][ T6627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1473.173545][ T6627] device hsr_slave_0 entered promiscuous mode [ 1473.187473][ T6627] device hsr_slave_1 entered promiscuous mode [ 1473.195101][ T6627] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1473.203640][ T6627] Cannot create hsr debugfs directory [ 1473.659907][ T6627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1473.693861][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1473.702939][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1473.725044][ T6627] 8021q: adding VLAN 0 to HW filter on device team0 [ 1473.747285][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1473.756863][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1473.767534][ T16] bridge0: port 1(bridge_slave_0) entered blocking state [ 1473.774982][ T16] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1473.789639][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1473.809131][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1473.819680][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1473.829410][ T9499] bridge0: port 2(bridge_slave_1) entered blocking state [ 1473.836854][ T9499] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1473.868917][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1473.894010][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1473.918597][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1473.928596][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1473.963216][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1473.972619][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1473.983308][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1473.994149][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1474.003306][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1474.026695][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1474.038591][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1474.061355][ T6627] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1474.109868][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1474.118294][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1474.147556][ T6627] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1474.260952][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1474.271885][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1474.320965][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1474.330758][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1474.349986][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1474.361102][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1474.375684][ T6627] device veth0_vlan entered promiscuous mode [ 1474.403998][ T6627] device veth1_vlan entered promiscuous mode [ 1474.467282][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1474.477355][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1474.498570][ T6627] device veth0_macvtap entered promiscuous mode [ 1474.521481][ T6627] device veth1_macvtap entered promiscuous mode [ 1474.564608][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1474.575654][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.588244][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1474.598888][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.609116][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1474.619786][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.629892][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1474.640589][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.650751][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1474.661395][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.675130][ T6627] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1474.683321][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1474.693112][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1474.703112][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1474.713414][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1474.753334][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1474.765327][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.776117][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1474.787099][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.797213][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1474.807841][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.817928][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1474.828606][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.838677][ T6627] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1474.849352][ T6627] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1474.862720][ T6627] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1474.904588][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1474.915195][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1474.987042][ T16] Bluetooth: hci4: command 0x041b tx timeout [ 1475.274731][ T3525] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1475.283492][ T3525] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1475.354990][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1475.417978][ T3511] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1475.426032][ T3511] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1475.435389][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1475.606949][ T6857] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1475.626559][ T6857] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1475.951506][ T6857] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xa}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:41 executing program 2: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a32000000000800410073697700140033006c6f"], 0x38}}, 0x0) 16:29:41 executing program 5: r0 = userfaultfd(0x0) r1 = socket(0x29, 0x2, 0x0) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)={0x14}, 0xec0000}}, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000c34000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000291000/0x400000)=nil, 0x400000}, 0x0, 0x6000000}) 16:29:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280)='devlink\x00') sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r1, 0x501, 0x0, 0x0, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd, 0x87, 'l2_drops\x00'}}]}, 0x44}}, 0x0) 16:29:41 executing program 3: syz_emit_ethernet(0x72, &(0x7f0000000180)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "a0f009", 0x3c, 0x3c, 0x0, @local={0xfe, 0x80, [0x2, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @mcast2, {[@dstopts={0x0, 0x3, [], [@enc_lim, @pad1, @hao={0xc9, 0x10, @ipv4={[], [], @multicast2}}]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x0, @mcast2}}}}}}, 0x0) 16:29:41 executing program 4: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r1) r2 = getpid() r3 = pidfd_open(r2, 0x0) r4 = getpid() r5 = pidfd_open(r4, 0x0) r6 = dup3(r5, r3, 0x0) setns(r6, 0x8000000) [ 1476.123604][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.129648][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.136331][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.146656][ T6865] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1476.162521][ T6865] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 16:29:42 executing program 3: r0 = socket(0xa, 0x802, 0x80000000088) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r3) sendmsg$TIPC_CMD_SHOW_PORTS(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={0x0}}, 0x0) writev(r1, &(0x7f0000fb1000)=[{&(0x7f0000000180)="480000001400197f09004b0101048c590a88ffffff010001000000000028213ee20600d4ff5bffff00c7e5ed5e00000000000000000000eaf60d18125d4b18857a9eace3dbe8b12c", 0x48}], 0x1) recvmmsg(r1, &(0x7f0000000080)=[{{0x0, 0xfffffffffffffe15, 0x0}}], 0x183, 0xec0, 0x0) [ 1476.494553][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.502123][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.510546][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.518103][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.525373][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.532728][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.539994][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.547359][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.554720][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.562146][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.569430][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.576757][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.584121][ T6865] lo speed is unknown, defaulting to 1000 16:29:42 executing program 0: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = syz_io_uring_setup(0x3176, &(0x7f0000000180), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r0, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x450c, 0x0, 0x0, 0x0, 0x0) [ 1476.592354][ T6865] lo speed is unknown, defaulting to 1000 [ 1476.599576][ T6865] lo speed is unknown, defaulting to 1000 16:29:42 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @local}, 0x7, {0x2, 0x0, @loopback}, 'vcan0\x00'}) [ 1476.687645][ T6876] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1476.736467][ T6876] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:42 executing program 5: mlockall(0x2) shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000) shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x4000) [ 1477.062980][ T16] Bluetooth: hci4: command 0x040f tx timeout [ 1477.108095][ T6876] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:43 executing program 2: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a32000000000800410073697700140033006c6f"], 0x38}}, 0x0) 16:29:43 executing program 0: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = syz_io_uring_setup(0x3176, &(0x7f0000000180), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r0, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x450c, 0x0, 0x0, 0x0, 0x0) 16:29:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xb}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:43 executing program 3: r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000001180)='/dev/adsp1\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_STEREO(r0, 0xc0045007, 0x0) 16:29:43 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1003e, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) syz_open_procfs(0x0, &(0x7f0000272000)) 16:29:43 executing program 0: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = syz_io_uring_setup(0x3176, &(0x7f0000000180), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r0, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x450c, 0x0, 0x0, 0x0, 0x0) 16:29:43 executing program 2: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a32000000000800410073697700140033006c6f"], 0x38}}, 0x0) [ 1477.952708][ T6907] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1478.052148][ T6910] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1478.409766][ T6907] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:44 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000340)={'filter\x00'}, &(0x7f0000000380)=0x24) 16:29:44 executing program 3: r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x1, &(0x7f00009c8000)={{}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0xffffffffffffffff, &(0x7f0000000080)={{0x77359400}, {0x0, 0x9}}, 0x0) 16:29:44 executing program 2: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a32000000000800410073697700140033006c6f"], 0x38}}, 0x0) 16:29:44 executing program 0: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = syz_io_uring_setup(0x3176, &(0x7f0000000180), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r0, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x450c, 0x0, 0x0, 0x0, 0x0) [ 1479.145890][ T16] Bluetooth: hci4: command 0x0419 tx timeout 16:29:45 executing program 5: mlockall(0x2) shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000) shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x4000) 16:29:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xc}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:45 executing program 3: openat$procfs(0xffffff9c, &(0x7f0000000100)='/proc/partitions\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x38, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 16:29:45 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x2, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xffffffff}}]}]}}}]}, 0x44}}, 0x0) 16:29:45 executing program 0: socketpair$unix(0x1, 0x400000000000002, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0x25ba) sendmmsg$unix(r1, &(0x7f00000bd000), 0x5c3, 0x0) connect$unix(r0, &(0x7f0000000140)=@abs, 0x6e) 16:29:45 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) bind$packet(r1, &(0x7f0000000240)={0x11, 0x0, r3}, 0x14) getsockname$packet(r1, &(0x7f0000000500)={0x11, 0x0, 0x0}, &(0x7f0000000040)=0x10eef0f1) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_VFINFO_LIST={0x20, 0x16, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN_LIST={0x18, 0xc, 0x0, 0x1, [{0x14, 0x2}]}]}]}]}, 0x40}}, 0x0) [ 1479.484231][ T6939] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1479.553665][ T6941] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1479.950484][ T6939] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:45 executing program 4: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/seq\x00', 0x0) read(r1, &(0x7f00000001c0)=""/237, 0xed) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x1c1, @time}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000100)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f00000002c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x3938700}}, 0x0) tkill(r0, 0x1004000000016) 16:29:45 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000140)={0x4a7, 0x4}) close(r2) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'macvlan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000180)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @dev}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0x8000005, 0x4) splice(r0, 0x0, r2, 0x0, 0x4a, 0x0) 16:29:46 executing program 0: prctl$PR_SET_SECUREBITS(0x1c, 0x5) setresuid(0x0, 0xee01, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') write$cgroup_netprio_ifpriomap(r0, &(0x7f0000000000)={'erspan0'}, 0x2000000a) 16:29:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xd}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1480.998719][ T6975] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1481.053464][ T6976] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) r2 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000400)={'syz', 0x0}, &(0x7f00000002c0)="c2", 0x1f0, 0xffffffffffffffff) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0x218, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) 16:29:47 executing program 5: mlockall(0x2) shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000) shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x4000) 16:29:47 executing program 4: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/seq\x00', 0x0) read(r1, &(0x7f00000001c0)=""/237, 0xed) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x1c1, @time}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000100)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f00000002c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x3938700}}, 0x0) tkill(r0, 0x1004000000016) [ 1481.477962][ T6975] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:47 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/seq\x00', 0x0) read(r1, &(0x7f00000001c0)=""/237, 0xed) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x1c1, @time}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000100)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f00000002c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x3938700}}, 0x0) tkill(r0, 0x1004000000016) 16:29:47 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b18a3cac804b0e0301a4ce875f2e3ff5f1600800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000e00006ad8e5ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0x14, 0x2, [@TCA_CAKE_OVERHEAD={0x8}, @TCA_CAKE_ATM={0x8}]}}]}, 0x44}}, 0x0) 16:29:47 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xe}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:47 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) r2 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000400)={'syz', 0x0}, &(0x7f00000002c0)="c2", 0x1f0, 0xffffffffffffffff) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0x218, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) [ 1482.252366][ T7001] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1482.306791][ T7003] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:48 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b18a3cac804b0e0301a4ce875f2e3ff5f1600800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000e00006ad8e5ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0x14, 0x2, [@TCA_CAKE_OVERHEAD={0x8}, @TCA_CAKE_ATM={0x8}]}}]}, 0x44}}, 0x0) [ 1482.688629][ T7001] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:48 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/seq\x00', 0x0) read(r1, &(0x7f00000001c0)=""/237, 0xed) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x1c1, @time}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000100)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f00000002c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x3938700}}, 0x0) tkill(r0, 0x1004000000016) 16:29:48 executing program 4: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/seq\x00', 0x0) read(r1, &(0x7f00000001c0)=""/237, 0xed) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x1c1, @time}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000100)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f00000002c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x3938700}}, 0x0) tkill(r0, 0x1004000000016) 16:29:48 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xf}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:48 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) r2 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000400)={'syz', 0x0}, &(0x7f00000002c0)="c2", 0x1f0, 0xffffffffffffffff) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0x218, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) 16:29:49 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b18a3cac804b0e0301a4ce875f2e3ff5f1600800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000e00006ad8e5ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0x14, 0x2, [@TCA_CAKE_OVERHEAD={0x8}, @TCA_CAKE_ATM={0x8}]}}]}, 0x44}}, 0x0) 16:29:49 executing program 5: mlockall(0x2) shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000) shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x4000) [ 1483.490892][ T7019] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1483.550299][ T7027] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1483.907140][ T7019] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:49 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b18a3cac804b0e0301a4ce875f2e3ff5f1600800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000e00006ad8e5ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0x14, 0x2, [@TCA_CAKE_OVERHEAD={0x8}, @TCA_CAKE_ATM={0x8}]}}]}, 0x44}}, 0x0) 16:29:50 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) r2 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000400)={'syz', 0x0}, &(0x7f00000002c0)="c2", 0x1f0, 0xffffffffffffffff) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0x218, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) 16:29:50 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x10}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:50 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/seq\x00', 0x0) read(r1, &(0x7f00000001c0)=""/237, 0xed) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x1c1, @time}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000100)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f00000002c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x3938700}}, 0x0) tkill(r0, 0x1004000000016) 16:29:50 executing program 4: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/seq\x00', 0x0) read(r1, &(0x7f00000001c0)=""/237, 0xed) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x1c1, @time}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000100)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f00000002c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x3938700}}, 0x0) tkill(r0, 0x1004000000016) 16:29:50 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r0, 0x4b52, &(0x7f0000000040)) [ 1484.846380][ T7043] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1484.899365][ T7047] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:51 executing program 0: r0 = memfd_create(&(0x7f0000000100)='\xa5E\f\x87\xda\n\xd9F\xde\x8c$3\x92\xe6ej{\xf7<\xeb\xcc,\xab\xfc\xe4\xec\xff\xff\xffo\x00\x00\x00\x00\x9af\xaeM\xc4\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x7, 0x11, r0, 0x0) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000000), 0x0) [ 1485.348503][ T7043] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:51 executing program 5: clone(0x5fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) clone(0x101efff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000140)="6d527cd53870164a3a0d4b64fb0d7bebad2dce076e7768215970e33adf15173c9e665cff10727f6273ef2aace367c13b8e834788d7da2d60077ebc24a796b221a2f39fd294dc01861206b499138d02ebf3cfc3b11f0e18858568476bac483df9c4d0a61da2d2f9b7c4cb601c0141f209fc9e06d9457920a9a749a23ccd52eb91db50189627774719cf91bd6e63a2b8a3b657c0e438ffc3e275b03ef0f384a0c1f20143b7b87f2e34729b000000805e0ad338423d4200f349c545516c46bb9f104a3816b12950faa20fab5827bc62a8d4cc12c4c8954308a933d63aa66cdb3646a37626de7361b5338c197dd3e6844dafcb4338dce0b79ee41da150eca12fbd36b4873ce8e4747b63e8830ee6c32f254d37792053e2b77cc86279ea843600"/297, 0x3accf8d5) ptrace(0x4206, r0) wait4(0x0, 0x0, 0x20000000, 0x0) tkill(r0, 0x800000009) 16:29:51 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x0, @dev}}, 0x0, 0x0, 0x44, 0x0, "6fea5b52886bae2a7bd5615fca0e8a8e576fa830fd6d27b363e30ea68891e654167ba05f23401021bbc560a82a1f98b56ce8f92a35e8364eb069ab8457345beb48e3c01d01df67b62ed11059be1712eb"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @broadcast}}, 0x0, 0x0, 0x37, 0x0, "68de069891ddd9c5cb1fdfba623b369a48f9c0848c725fd8af831a62bc7764512d4ce450fb70ad4c178af80c5ded568b5ac626628ef856c79e9de47e09075133730863725f599c066d285aee9762e7fc"}, 0xd8) close(r0) 16:29:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x11}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:51 executing program 0: r0 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_SIOCBRADDBR(r0, 0x89f0, 0x0) 16:29:51 executing program 2: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000400)='asymmetric\x00', 0x0, &(0x7f0000000200)="3081", 0x2, r0) 16:29:51 executing program 4: pipe(0x0) clone(0x1000000210007fb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000480)={'syz'}, &(0x7f0000000440)='`', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000001480)='user\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000001740)="01", 0x1, 0xfffffffffffffffd) r2 = add_key$user(&(0x7f0000001400)='user\x00', &(0x7f0000001440)={'syz'}, &(0x7f0000000280)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539", 0xc0, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000000)={r2, r0, r1}, &(0x7f0000000700)=""/250, 0xfa, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe) 16:29:51 executing program 3: get_mempolicy(0x0, &(0x7f0000000040), 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4) 16:29:52 executing program 5: clone(0x5fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) clone(0x101efff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000140)="6d527cd53870164a3a0d4b64fb0d7bebad2dce076e7768215970e33adf15173c9e665cff10727f6273ef2aace367c13b8e834788d7da2d60077ebc24a796b221a2f39fd294dc01861206b499138d02ebf3cfc3b11f0e18858568476bac483df9c4d0a61da2d2f9b7c4cb601c0141f209fc9e06d9457920a9a749a23ccd52eb91db50189627774719cf91bd6e63a2b8a3b657c0e438ffc3e275b03ef0f384a0c1f20143b7b87f2e34729b000000805e0ad338423d4200f349c545516c46bb9f104a3816b12950faa20fab5827bc62a8d4cc12c4c8954308a933d63aa66cdb3646a37626de7361b5338c197dd3e6844dafcb4338dce0b79ee41da150eca12fbd36b4873ce8e4747b63e8830ee6c32f254d37792053e2b77cc86279ea843600"/297, 0x3accf8d5) ptrace(0x4206, r0) wait4(0x0, 0x0, 0x20000000, 0x0) tkill(r0, 0x800000009) [ 1486.259909][ T7079] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1486.310781][ T7080] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:52 executing program 2: clone(0x5fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) clone(0x101efff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000140)="6d527cd53870164a3a0d4b64fb0d7bebad2dce076e7768215970e33adf15173c9e665cff10727f6273ef2aace367c13b8e834788d7da2d60077ebc24a796b221a2f39fd294dc01861206b499138d02ebf3cfc3b11f0e18858568476bac483df9c4d0a61da2d2f9b7c4cb601c0141f209fc9e06d9457920a9a749a23ccd52eb91db50189627774719cf91bd6e63a2b8a3b657c0e438ffc3e275b03ef0f384a0c1f20143b7b87f2e34729b000000805e0ad338423d4200f349c545516c46bb9f104a3816b12950faa20fab5827bc62a8d4cc12c4c8954308a933d63aa66cdb3646a37626de7361b5338c197dd3e6844dafcb4338dce0b79ee41da150eca12fbd36b4873ce8e4747b63e8830ee6c32f254d37792053e2b77cc86279ea843600"/297, 0x3accf8d5) ptrace(0x4206, r0) wait4(0x0, 0x0, 0x20000000, 0x0) tkill(r0, 0x800000009) 16:29:52 executing program 0: r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x8002) write$UHID_INPUT(r0, &(0x7f0000000040)={0x8, {"b61c05104f8bd40276f078e948e1a8259cbacc0087e9f3c87304c0d4e053ac3aa74b92c309255085e6e4d7e691da7bec1496361cbb2c517b1e8fe374a65225d52c45ca74aaa6289296a07ed6b7142eee19159e390bc6ee06cf716d945ff8a1eeccfca36e7d7c777213ea5e0b297b9cae4ee81d8126d14257beeec87434543fa0b65bcab0b93a0f442e8bc44479bcb843305128241b73b467e2db11c22af0893d935d367f7d84c89d45a2e2be4e8fd688801bd09b05dfece824267463a437428553d9a4bb1ec7d0b8b7b1dbd5f19757529dd87ded32752ee474100f38e9c6553f92984ec60239c1bf2e78836b9faaa5919218520ad6d043a90ad08073ce6cb154512e3a8fd070e8240f949b4148ec4fe2d7ca2523f1ba9dc614391391b335a184639d6997c930f4c536be8bc643f63e58df085ea86f96d8b1f3209373169fdfdb2d5a741601c865801d2c71151c8ab78634af534895c2990e8de7d5766139a6e8f3a8f1300c4baf928d7b1ab9b4031f42f811b4d79726ea049a38329a3010e38de53adf3676bf7a8fd896d58261e8e02375dcbd8dec023baf20210c5edf85357f604debd1dd74456d8b05bb5c996ea3195dcd13c5f898f2845a477b5b5602caeb9de14481c8b36ff9b476d2362f96b0096fff9a49046390dbff0bd9a06c06731d2249750e41d42688c3354029bbc3d96c6d7aa6769795614c7fb8cd68f809a9a08c5e12b0a4ddbb66181d281a013f8e41c81a07bec0967e60acf44fd43ff5d07991d97cbd092696ccd2103ec56fe176163cedffdfb83a8224028f996cbbe7f8225cf2575869ee5b92220ea7d4932f760ea7c0f077a502121ac3ff8e9545c3526da339c0a2d469c40fff06d01d57095e43a3bfa97919ff1423964e50fa0c613dc68d8bd5bdfde8abd1e8721ec475acfdf7241b579b62c73a981fbc0b7bd486be0c69405168341594d2509ef8c3720d734f95ff87f697cb7a14dff8991a553a5c6f16003c9141700a056fb852a5d7f2b018d4ba626b530a0a2ee77ceb078a6f36666539b0538413a8be67c450525d244aa46f4b6d9081f63b0863d5f86a1944006dc9a3f924fb6032a7ef62771cf8ce912abb5cfa178f91c6e08d8c80cc5244c4e21b6cd62586904f351287c9406b97476d510ec6af32380b0bdce148288bc52109af8ab3011879f9b19d86fb381760798b3aaffc2e28ac986562a28175404584c83ce24fc1e78d2622ae5f40d68294a62937c95db15d712fd94912988352f98ec2e00c5772a90ec54be1221493f14aba1cceeb334454d6999ff17ce6356455872b5198315963c84858c490d127068c0df2bcbc89e62acd2322b925145afc18f667f7872f9442475e088ff9b14e1d747d5581cad8d4b72c74a53ea25283b6ba809553b4f0d92bcd9ae3c4bdff4cef6a92ac4323c69c56bfc3c8e0732230d893a4aaf25a1c4b05c663c70d1e3292d9bd5e5e3bdd69f2bcede48cee6abdce1ec2ba2e0b00dec2caff8a7a575fc2b062034d34e2b5b6da89166c4e41eb283547dfb46ab6c71c078358c1ce401d0b04eb65318e8455014a9679c679696beef442c10005e94c5fa00ce313b0838abd83b5ce874de244a0105865edd317fe3480cb520e3803b48667d8f33e02e987d70865c90fcbafe0eb0fad2c33c8db7a8fcf7aea6d160f26449d32af68bbad98507a65db632eeb420fd75c76e20c57532616eb58f9b02c7d5f5d4fefdc22298a426c645b5b9927a0004993576bf456dff4beaf5a3b0ae05688d6bc63fd5d185c67c82fb3b2a4b1aa5053a16565ba9fcf39d4d2ad77fbed948bfbb2eb911467d837953d4ce23aa97951b41680db43bfa63987cd362c745f776eaa62c7f35444411095c0cfda8fe86e6c31cdd52d72f742674d1f9969b26d92093aed32d5d312923d855a918323b524589efdbf6124a339882448ecd2fb327d7afdaac821b5dbe187e7c2d3ebbc62e464ef32d2c4a13c045710c87ab0a2bab96a27a0a79b005ae03f9f1712c05f47ca64b9a0e3fe1be432b062cd86d2bf5662e10389a6ddd14ed7b3a630f475a7c50b546c4acb15ca5e2f0e90bfeaa3a0103b04f6658299916c9829a8ab9182317a8a2fbccf7fc82535c10e9565f31d3ca57e13aa5759a24c176b73e60869770af6149bdcac5602efd9fe92cb1db7df043ce304b31be9be2a4a70f73f60dfa033b8767ab6c8d50d4b397c3334ad34b3d9c1d90e94fb74886b3c71f556fc4a8bae3e374c25d6d76d31f797c5c64f41652d44d94897fe67b8f230f68e56b8b246add5342f5ff9b1fbb54735c21618ff3c767ed26f5d6561866e43d6cb61e1a64a0dd89b7037ea8f55102099afa6a97d02f7bd41a72eeebd4c1b01ffb4ba1315ae93587093f33e0df6ddeb8216867fcb7d772663d1e71261b23f38ef369bc7ff15561557ad787d501f473c3ccbf56731fa5ff425ac604f5e7b98551bb3c35f473786e4b14b5d5c5355b08fa019f4fbb9ca85e601f107af0d82b2ad0cc9735e75becd1c918ec0d68b217ec7a63beed0768086303ab1ce8c1411af882979f8a681e6ca464cbb602afef6167d7087e3985a90cdb017d4caa5a5f837d57ce9978f09cdda7ac222a1eb6769df4b312fa5b038546b04c60e0888d434858e5e5ff47a01e516d8942ce9fd642158c169ca61042fad3342612fe14a8bc5628e7eca0062fa39e6efd08686dd40a446157c5e98970e1ba9854746d2fedee49951302e6f75840deb66297274031c2f445d684dd3547dc81b2561aa812513e1086f2907711802ef329b7e02cfa773865678c1147e879afb48d48f5458419e06fb28c4248dc953ee5c435814de3314ffb89dad2c7b3d10e9f13f4ed8ec05f853b091ce403007bb19114f4aba92ebae2866e45e6f97fa31341430fe941867b45c6f557b4c6be2451d469185a7fb99a2df70df97ba38e24a21f6064b4320e3c38f63afa61932751a8c0b58e0d3a3496ecb2df8e3114e8aad4673598e6c7afb8eb3814bbe18380f28434b7fa0a3ba5e8bc40d8421297dac590522fadc4848d3bb8e6cc9b9a92a41a56366aabc18f8b758d7fedfc1b2783416d4fbbffe6482fb66abe1b70ad35be322bc5ae1d16c1da96b0fdb3116f77eb1dab251c4aec071dbbc0e603aecbe05859a2a9e5054c0a33221c9283d323f207155786e040bdc67312ee2ca2c4422f625d2a7d3e345c63fe896af2694d76acd0bcb4aab9eea87039b7f2f00b851673f91eba34161d34216fafbd53e33a755bffc843240752132ccf39eed61551af9379610884a6cde76126987fb99ac2070b49ddca5126b3de6f75a143a358b925a1a8019d106a852a8a07339741e03c89b14ec3fa0720c49e783b1cc20793ac25770c4487a6204e84e42051c0c7b2786ace9ae8faf7386316e30ce703b4c37fd19d0fe92244c6fb53c7246c9d10bdd509d4185d273137d7e87bd9daf8fac7bc858428102f04ebde2a04fe96546f613e6af8493378ec121efdaf5f1def19e39900b718096f18be5f197bdd6fd14cfc9044ec33433ce6c007f360b2ff78357a70832a21aaa3b683f8b92baa8d675f7468addba04407c2c1a2a17c51dcd300057c347df5218b7b0d4105e8b1fcbc38d680525bbbc5a07c9a30b54682adb0444683b196ec2ecb7cdbf77f1da4079f46522699981d191585dd9c137b7b16f82235dd0ae3a078b39e86b801c190b59cdd8e2b70e982a690a1054813fad98c7e905ed43f9a3cf0550efbcc7dbd331d93204d7aa5951a2f95dab619900b5f6628c61f674f28e2eccd540f92d2d08d2ade01ae3f136fb1a20892a98b2d61f36d52c81b2f683125c11ddcbf45122d12b68dd88908d17e3f0c8764adc295c9bde9de691b52b1ebeacd6830e62c4aa3881b6eb75bf630eb7cb86b9eb672d3a6b79646add89722f8f68979a79291878ed6307f66319598067b8efa5fb67a30e8d2054b82c021ae5c0ddc19a5dfe8747c1312da861174e41f8ba05697c5f95823a482d2bfe79260aab56e6f8581e63af8689f3034176a75b8ac33b5abcd99bdf2308224321aa455fbe5479653ca2a0001f4e609517fac79eba065237d7d3f283b7993a59852949f79f84ceab6ce3979839a86e061dad4203f5280146c511ef94cf711e3b871ed1e1f0622b43c989d7ab693cf1fb388267288f6bd4de417edf24871d0de26cad3e0cb614ec26317d40524a59aaf430494e0b6f51fc83ea14dbd4d39d4be1184ae7fddb2c6b2a7b322b6c62b7ea180d176214cd4e5b4a093fd1f478a9bc032372d8340d4aefd228a1a4a080344b70472e26b4b462dbab17f8b0d6159df3b3722b729c0169a83d62dd07f3f8f3674bcb13b19e79f86b83bc4dd87d399f23cbe2f222bfc18fab904f6df75358385cfdf503c8ea3fdf2553f9d8546fdf7e0d4baa49a9497635fea499486b5587f97e1a8aac870064ffd0a68066ba661eed7e60edda41a7f0d2bd020be7327ea3825dc7c28b4f05b3f98c974f7738ffc214acb26e58c6b0c6e1dfcf053d02c9d44966845ef1b852b382ba881d8ac08f5dd8bf15580830a1301ba4bc49c19bf92fe1eae5c524bcd736201ffc7bb3bcedeb1142b0e17442f1db75a2ec40b1f0af06adcf50b8c2a439a0d589168c1432e163c4444c0f820af04399249c44376cd9c7268ad7e714a8d34f2dd31a6adb77c4d65661cc233eb13910c540a69f691a81017e7b7b44ff42558cc9e0f31a8c3aa2d195d9f800f732704b507b79e580f711feef8b988a4600da8b474897f87ca862ccbda23a8768325852d7799e7c115042d2e675706504c9100265dbfa0b3d56f976dcb2aa1ca49247dd269a2ea408ad7b984b96e0783b1c3a61f63c3962a16a6cc6d1ae5b41e895fa5b9af2e4b5b327be89b618ee2916b45174013c9ca9a11c26d2f78d872ea45177a72de7f72bbe8be0debd6ed60f20a7eaa782537b903c4552926a3a700f0e1b5c5b04cc8be0124cf5965918605d2478381adcbb68fd2f46c02025e8576f89a4949bcb19539f64c09c1e55c07cce76ab9a5b1777651b235bf4f6d409f68425215ee83b530597ab2dc21d814a92167149208b0c492abb7b3eee1e4d5f93c52cfc1e82f7f45b2546f89c5abcaee710620cffbfa69b85b9b67570babbf2ae0b627a0e247a1a71389d1c2897182de968ae1ce7ba2e8291972de765e0c59ae79bd7a1cb7aaaa33ed712304eecdd277ebdce430b3f49a9567b7c86e71bbb1678d29bfbddc90d868ba759f4c3a523cea35e09d2d5da81eeebbc0922063d9602c338d3602b8773a6d6e414f7a41f50121834b6a4b67677d3685de524a9cd5d1e5bb051c797bd65855f63c2bae9d5ef31fcfb5e14cf56e89c1b0318120e0a430c86b824d53e1af9acc1a500f81a0987a9474827dc5816565336de5ff41e75dd6a1885ff18dbb500d4c127b61c8bd5e1b9ce1b40fd577e0738cfb9539918d360312c06596224962df889dcac2b449bee9e185569669df30c0e817057275b619e08bd691a535098e343dfbd26903c974492d9c3b336ca3bf895854cb062f37ff9e5512819e72cadfad522fab1afe9e35b40dee6de2d2e955b9dbeca12b502e4c6d62875f03f8e5bbbc38fd7738e85d6a654a1bfd375862512a47e084fbcc180475d550b916125ac531f6bfd0c4cf4ecb20767c802e46290626db1133b0e6e80d2fa2ebcc6fd82dc11a678710b61bcf4633d9697cc8c298dfa9ee800cd2e81ba834b73e591596f6a48cc51ce2ad79bc52232369d6d75494056965663c126cb12960fd8eb9a9e8485fe4d7ef4693fd2dbe3b37a382ce9c05e097b64fd", 0x1000}}, 0x1006) poll(&(0x7f0000001100)=[{r0}], 0x1, 0x2) [ 1486.507128][ T7088] encrypted_key: insufficient parameters specified 16:29:52 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000f80)={0x1c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8}]}, 0x1c}}, 0x0) [ 1486.692554][ T7079] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:52 executing program 5: clone(0x5fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) clone(0x101efff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000140)="6d527cd53870164a3a0d4b64fb0d7bebad2dce076e7768215970e33adf15173c9e665cff10727f6273ef2aace367c13b8e834788d7da2d60077ebc24a796b221a2f39fd294dc01861206b499138d02ebf3cfc3b11f0e18858568476bac483df9c4d0a61da2d2f9b7c4cb601c0141f209fc9e06d9457920a9a749a23ccd52eb91db50189627774719cf91bd6e63a2b8a3b657c0e438ffc3e275b03ef0f384a0c1f20143b7b87f2e34729b000000805e0ad338423d4200f349c545516c46bb9f104a3816b12950faa20fab5827bc62a8d4cc12c4c8954308a933d63aa66cdb3646a37626de7361b5338c197dd3e6844dafcb4338dce0b79ee41da150eca12fbd36b4873ce8e4747b63e8830ee6c32f254d37792053e2b77cc86279ea843600"/297, 0x3accf8d5) ptrace(0x4206, r0) wait4(0x0, 0x0, 0x20000000, 0x0) tkill(r0, 0x800000009) 16:29:52 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x12}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:53 executing program 2: clone(0x5fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) clone(0x101efff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000140)="6d527cd53870164a3a0d4b64fb0d7bebad2dce076e7768215970e33adf15173c9e665cff10727f6273ef2aace367c13b8e834788d7da2d60077ebc24a796b221a2f39fd294dc01861206b499138d02ebf3cfc3b11f0e18858568476bac483df9c4d0a61da2d2f9b7c4cb601c0141f209fc9e06d9457920a9a749a23ccd52eb91db50189627774719cf91bd6e63a2b8a3b657c0e438ffc3e275b03ef0f384a0c1f20143b7b87f2e34729b000000805e0ad338423d4200f349c545516c46bb9f104a3816b12950faa20fab5827bc62a8d4cc12c4c8954308a933d63aa66cdb3646a37626de7361b5338c197dd3e6844dafcb4338dce0b79ee41da150eca12fbd36b4873ce8e4747b63e8830ee6c32f254d37792053e2b77cc86279ea843600"/297, 0x3accf8d5) ptrace(0x4206, r0) wait4(0x0, 0x0, 0x20000000, 0x0) tkill(r0, 0x800000009) [ 1487.093934][ T7104] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1487.216441][ T7107] encrypted_key: insufficient parameters specified [ 1487.407636][ T7112] ptrace attach of "/root/syz-executor.5"[7111] was attempted by "/root/syz-executor.5"[7112] 16:29:53 executing program 5: clone(0x5fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) clone(0x101efff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000140)="6d527cd53870164a3a0d4b64fb0d7bebad2dce076e7768215970e33adf15173c9e665cff10727f6273ef2aace367c13b8e834788d7da2d60077ebc24a796b221a2f39fd294dc01861206b499138d02ebf3cfc3b11f0e18858568476bac483df9c4d0a61da2d2f9b7c4cb601c0141f209fc9e06d9457920a9a749a23ccd52eb91db50189627774719cf91bd6e63a2b8a3b657c0e438ffc3e275b03ef0f384a0c1f20143b7b87f2e34729b000000805e0ad338423d4200f349c545516c46bb9f104a3816b12950faa20fab5827bc62a8d4cc12c4c8954308a933d63aa66cdb3646a37626de7361b5338c197dd3e6844dafcb4338dce0b79ee41da150eca12fbd36b4873ce8e4747b63e8830ee6c32f254d37792053e2b77cc86279ea843600"/297, 0x3accf8d5) ptrace(0x4206, r0) wait4(0x0, 0x0, 0x20000000, 0x0) tkill(r0, 0x800000009) 16:29:53 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @remote}, 0x14) syz_emit_ethernet(0x36, &(0x7f0000002d40)={@broadcast=[0xff, 0xff, 0xff, 0x0], @random="f674049167a6", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "2ca612", 0x0, 0x0, 0x0, @remote, @private1}}}}, 0x0) 16:29:53 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/bnep\x00') getdents64(r0, &(0x7f00000048c0)=""/133, 0x85) [ 1487.600027][ T7115] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1487.662796][ T7119] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1488.036415][ T7115] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:54 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x22, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2}, 0x10) 16:29:54 executing program 2: clone(0x5fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x40000000, 0x0) clone(0x101efff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000140)="6d527cd53870164a3a0d4b64fb0d7bebad2dce076e7768215970e33adf15173c9e665cff10727f6273ef2aace367c13b8e834788d7da2d60077ebc24a796b221a2f39fd294dc01861206b499138d02ebf3cfc3b11f0e18858568476bac483df9c4d0a61da2d2f9b7c4cb601c0141f209fc9e06d9457920a9a749a23ccd52eb91db50189627774719cf91bd6e63a2b8a3b657c0e438ffc3e275b03ef0f384a0c1f20143b7b87f2e34729b000000805e0ad338423d4200f349c545516c46bb9f104a3816b12950faa20fab5827bc62a8d4cc12c4c8954308a933d63aa66cdb3646a37626de7361b5338c197dd3e6844dafcb4338dce0b79ee41da150eca12fbd36b4873ce8e4747b63e8830ee6c32f254d37792053e2b77cc86279ea843600"/297, 0x3accf8d5) ptrace(0x4206, r0) wait4(0x0, 0x0, 0x20000000, 0x0) tkill(r0, 0x800000009) 16:29:54 executing program 3: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='bpf\x00', 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000000)='fuse\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0xc0024, &(0x7f00000000c0)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, 0xee01}}) 16:29:54 executing program 5: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000)='/dev/nullb0\x00', 0x101802, 0x0) pwritev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="15a92f75793be7020dc2837b583a8050402d125b4fa6f08fec89864e3e9b55ef22ca2af90ed67d2b9458051a7c50ac0e89d3df616f6284eaccabb746772a8a9f4bd25ca1deb5c35d9ebd96c90522c640a42f42a5f0ce8c02109744e9e26049613408a2e7f1f1dfca4f1c8940a5f7fff1a0e02847ba7b8556ba5804fc84175f3ceee7", 0x82}, {&(0x7f0000000180)="4ea8d1c936c82e8f8babfddfb33198ace120edde0b2849c8a5fde5e82f0252fd1dfa3aebf40c8f091dc61ebed34f0f04c8211f496abc63c0ffb194fc3442f642eb07b00d6da52e3ca35c8e9dd227ce342f4acf647f3dd9eb442e2ce689a153211255a1991d28cd7217a3ca53aa51d717c5761f59d596da8cd7", 0x79}], 0x2, 0x106, 0x0) 16:29:54 executing program 0: syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="90e42e8500000000000000000000000000000000000000000000000000000000f90cac8b044b4fa88bee4b8d3da88dc2000001000000000001000000000000005f42485266535f4d07000000000000000000500000000000001010000000000000000000000000000000000000000000000000010000000000d00000000000000600000000000000010000000000000000100000001000000010000000100000610000000400000000000000000000000000000000000000000000004503000000000000000000000001", 0xca, 0x10000}], 0x0, &(0x7f0000000040)) 16:29:54 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x13}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1489.137605][ T7141] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1489.180268][ T7142] BTRFS: device fsid f90cac8b-044b-4fa8-8bee-4b8d3da88dc2 devid 1 transid 7 /dev/loop0 scanned by syz-executor.0 (7142) [ 1489.216957][ T7141] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1489.406258][ T7142] BTRFS error (device loop0): superblock checksum mismatch 16:29:55 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x541b, 0x0) [ 1489.498376][ T7142] BTRFS error (device loop0): open_ctree failed [ 1489.577151][ T7141] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:55 executing program 3: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@v) 16:29:55 executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000001740), 0x10) [ 1489.680950][ T7142] BTRFS error (device loop0): superblock checksum mismatch [ 1489.782951][ T7142] BTRFS error (device loop0): open_ctree failed 16:29:55 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x25}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:55 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x1c, 0x0, &(0x7f0000000100)) 16:29:56 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x38, 0x6d, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_PROP_LIST={0x18, 0x34, 0x0, 0x1, [{0x14}]}]}, 0x38}}, 0x0) 16:29:56 executing program 4: clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@struct={0x2, 0x0, 0x0, 0x7}]}, {0x0, [0x0, 0x5f, 0x2e]}}, &(0x7f0000000080)=""/226, 0x29, 0xe2, 0x8}, 0x20) 16:29:56 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)={0x58, 0x2, 0x9, 0x801, 0x0, 0x0, {}, [@NFCTH_TUPLE={0x24, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0x10, 0x2, 0x0, 0x1, {0x5}}]}, @NFCTH_POLICY={0x9, 0x4, 0x0, 0x1, {0x8}}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x58}}, 0x0) 16:29:56 executing program 3: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@v) [ 1490.491488][ T7177] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1490.572519][ T7179] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c00000024000b0f00000000d4ff008000000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff000000000b00010064736d61726b00000c0002000600010020"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000004500)=@newtfilter={0x48, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0x6}}, [@filter_kind_options=@f_rsvp6={{0xa, 0x1, 'rsvp6\x00'}, {0x18, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private0}]}}]}, 0x48}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}, 0x1, 0x74}, 0x0) 16:29:56 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000dc0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x9}, @NFT_MSG_NEWCHAIN={0x14, 0x2, 0xa, 0x801}], {0x14}}, 0x70}}, 0x0) [ 1490.782181][ T7186] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 1490.790587][ T7186] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1490.802737][ T7185] BPF:[1] FWD _. [ 1490.806585][ T7185] BPF:struct [ 1490.809834][ T7185] BPF: [ 1490.812853][ T7185] BPF:Invalid name [ 1490.816622][ T7185] BPF: [ 1490.816622][ T7185] 16:29:56 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x38, 0x6d, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_PROP_LIST={0x18, 0x34, 0x0, 0x1, [{0x14}]}]}, 0x38}}, 0x0) [ 1490.959404][ T7177] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:57 executing program 5: syz_read_part_table(0x0, 0x2, &(0x7f0000000240)=[{0x0, 0x0, 0xfffffffffffffe00}, {&(0x7f0000000000)="05dcd3dc04577087975501d386969fdf4c4e00337f86275ec2087ced33ed539ee6519a39c720d0f80ad70116e75f91abee13a04fd4ef3badb862201b11be00a382cbc203bd55550a70804471cfdb6abb00ac870174302dd43ccb20bacddc75348b1675d6824acf4b3e242727691c410fc358dac78a6435e9bd4e576ab2866ef17594add568d30eb6f27b14c124af69cc53da077f62d22136332ee5a7fa6141b9a889dd16eb82190e7344bf073fdbc4e5bf8e2482df51be6148932c277d6cdd2db0770abe66b51f26de7579acec7b75262a8fd75984764b03402a91dbee610d19850d0c6a0c6cc3df66fb011bca813421aa8331f5bb1011c023eefd091dde23d8010b3f7799cec29757c0013d02c95d866812a0c0dda594b07cb24a33ed6beb3c674682fcb1f7bc1519363bdc3e5f4b6e3ea1116da0552056ba46c11dd5035c6adea10634d672e56f9df686e3e86376d2e1577dcce3a230766a2b0c126de42a5cb4e13993739535dfd86d63bcbb274e5096a3fb7e32ea7495f7c104563c049429083cb4e14b1b5b49ec201830f3052aa4b9b503ed6f5eb5bff14c8b2b4c3cf3f873240acaa5d57a3dfccc119a6753fe18fea1ab5f9b8f0d891ca270c93eb92d146fe4ad9617b05411a8787278fd5b4aff8467cf00a59a5167049e7752ffc5", 0x1de, 0x4}]) [ 1491.227953][ T7193] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 16:29:57 executing program 3: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@v) 16:29:57 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x48}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:57 executing program 4: syz_mount_image$afs(&(0x7f0000000ec0)='afs\x00', &(0x7f0000000f00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000002680)={[{@dyn='dyn'}, {@source={'source', 0x3d, 'none\x00'}}]}) [ 1491.477373][ T7201] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 16:29:57 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x38, 0x6d, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_PROP_LIST={0x18, 0x34, 0x0, 0x1, [{0x14}]}]}, 0x38}}, 0x0) [ 1491.667524][ T7213] loop5: AHDI p1 p3 [ 1491.672456][ T7213] loop5: p1 start 1410443384 is beyond EOD, truncated [ 1491.785243][ T7225] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1491.827438][ T7225] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1491.840610][ T7213] loop5: AHDI p1 p3 [ 1491.845849][ T7213] loop5: p1 start 1410443384 is beyond EOD, truncated 16:29:57 executing program 3: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@v) 16:29:57 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f00000002c0)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@empty, @in6=@remote}}, @sadb_address={0x3, 0x5, 0x0, 0x10, 0x0, @in={0x2, 0x0, @loopback}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x80}}, 0x0) 16:29:58 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x24, &(0x7f0000000040)="0199891d", 0x4) 16:29:58 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) bind$inet6(r0, &(0x7f0000f67fe4)={0xa, 0x4e20}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000000)=0x6, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) [ 1492.228472][ T7225] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:58 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x38, 0x6d, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_PROP_LIST={0x18, 0x34, 0x0, 0x1, [{0x14}]}]}, 0x38}}, 0x0) 16:29:58 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x4c}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:58 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f00000002c0)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@empty, @in6=@remote}}, @sadb_address={0x3, 0x5, 0x0, 0x10, 0x0, @in={0x2, 0x0, @loopback}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x80}}, 0x0) 16:29:58 executing program 3: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='tunl0\x00', 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xe5a, 0x65a0}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 16:29:58 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0x4020ae76, 0x0) 16:29:58 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='attr\x00') exit(0x0) unlinkat(r0, &(0x7f0000000040)='./file0\x00', 0x0) [ 1493.047764][ T7251] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:58 executing program 2: r0 = socket$inet(0x2, 0x100000000805, 0x0) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x6d, &(0x7f0000745ffc), &(0x7f0000000040)=0xfdaf) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='clear_refs\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000080)='oom_score\x00') sendfile(r1, r2, 0x0, 0x1) [ 1493.089166][ T7253] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:59 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f00000002c0)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@empty, @in6=@remote}}, @sadb_address={0x3, 0x5, 0x0, 0x10, 0x0, @in={0x2, 0x0, @loopback}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x80}}, 0x0) [ 1493.456017][ T7251] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:29:59 executing program 2: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r0, 0x0) recvfrom$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 16:29:59 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x60}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:29:59 executing program 4: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, 0x0, 0x45) 16:29:59 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f00000002c0)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@empty, @in6=@remote}}, @sadb_address={0x3, 0x5, 0x0, 0x10, 0x0, @in={0x2, 0x0, @loopback}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x80}}, 0x0) [ 1493.969969][ T7257] syz-executor.3 (7257) used greatest stack depth: 1200 bytes left 16:30:00 executing program 3: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='tunl0\x00', 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xe5a, 0x65a0}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 1494.217560][ T7280] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1494.263339][ T7285] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:00 executing program 2: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='bpf\x00', 0x1, 0x0) creat(&(0x7f00000000c0)='./file0/file0\x00', 0x0) 16:30:00 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='comm\x00') read$FUSE(r0, 0x0, 0x0) 16:30:00 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_sco(r0, &(0x7f0000000040), 0x3) listen(r0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0)={0x2, 0x9}, 0x8) close(r0) 16:30:00 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000280)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "1f00", 0x8, 0x11, 0x0, @private0, @mcast2, {[], {0x0, 0xe22, 0x8}}}}}}, 0x0) [ 1494.636206][ T7280] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:00 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x68}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:00 executing program 2: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='bpf\x00', 0x1, 0x0) creat(&(0x7f00000000c0)='./file0/file0\x00', 0x0) 16:30:01 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xc8, &(0x7f00000007c0), 0x4) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xcd, 0x0, 0x0) 16:30:01 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x480}]}) [ 1495.402633][ T7304] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:01 executing program 3: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='tunl0\x00', 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xe5a, 0x65a0}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 1495.474010][ T7306] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:01 executing program 2: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='bpf\x00', 0x1, 0x0) creat(&(0x7f00000000c0)='./file0/file0\x00', 0x0) [ 1495.849473][ T7304] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:01 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_sco(r0, &(0x7f0000000040), 0x3) listen(r0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0)={0x2, 0x9}, 0x8) close(r0) 16:30:01 executing program 5: r0 = syz_open_dev$swradio(&(0x7f0000000340)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_G_FMT(r0, 0xc0cc5604, &(0x7f0000000380)={0x3, @vbi={0x0, 0x0, 0x0, 0x0, [], [0x0, 0x8]}}) 16:30:02 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x480}]}) 16:30:02 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x6c}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:02 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_sco(r0, &(0x7f0000000040), 0x3) listen(r0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0)={0x2, 0x9}, 0x8) close(r0) 16:30:02 executing program 2: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='bpf\x00', 0x1, 0x0) creat(&(0x7f00000000c0)='./file0/file0\x00', 0x0) [ 1496.608843][ T7334] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:02 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x20, 0x6, 0xa, 0x201, 0x0, 0x0, {}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0x68}}, 0x0) [ 1496.659512][ T7338] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:02 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x480}]}) 16:30:02 executing program 3: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='tunl0\x00', 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xe5a, 0x65a0}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 1497.032249][ T7334] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:03 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_sco(r0, &(0x7f0000000040), 0x3) listen(r0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0)={0x2, 0x9}, 0x8) close(r0) 16:30:03 executing program 5: r0 = socket$kcm(0xa, 0x6, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x10d, 0xb, &(0x7f0000000000)=r1, 0x4) 16:30:03 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xf, 0x0, 0x0) 16:30:03 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x74}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:03 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x480}]}) [ 1497.747016][ T7363] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:03 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0x3ff, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000100)="0503460008003e0000000200c52cf7c25975e605b02f80357f2b2ff0dac8897c6b11876d886b143a301817ccd51cc5471d130a6632a88161b6fd8f24286a57c3fe257c3314a3974bb654697f462f4c73", 0x1054, 0x0, 0x0, 0x1d3) [ 1497.814167][ T7365] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:03 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x49, 0x36}}, &(0x7f0000014ff5)='GPL\x00', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) 16:30:03 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x0, 0x0) fcntl$lock(r0, 0x25, &(0x7f00000000c0)={0x5}) [ 1498.372592][ T7361] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1498.385891][ T7365] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:04 executing program 5: syz_mount_image$vfat(&(0x7f00000000c0)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000280)=[{&(0x7f0000000000)="083d906d6b66732e66617400028001000240000004f801", 0x17}, {0x0, 0x0, 0x10e00}], 0x0, &(0x7f0000000140)={[{@fat=@codepage={'codepage', 0x3d, '874'}}]}) creat(&(0x7f0000000080)='./file0/file0\x00', 0x0) 16:30:04 executing program 0: r0 = syz_open_dev$vim2m(&(0x7f0000000000)='/dev/video#\x00', 0x3f, 0x2) ioctl$vim2m_VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000040)={0x3, @vbi}) 16:30:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9, 0x1, 'bond\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_LP_INTERVAL={0x8}]}}}]}, 0x3c}}, 0x0) 16:30:04 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x7a}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:04 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@HEADER={0x4}, @HEADER={0x4}]}, 0x1c}}, 0x0) sendmmsg(r0, &(0x7f0000002500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000a00)=[{&(0x7f00000000c0)="a328", 0x2}], 0x1}}, {{&(0x7f0000000180)=@un=@abs, 0x80, 0x0}}], 0x2, 0x8040) 16:30:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0x3ff, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000100)="0503460008003e0000000200c52cf7c25975e605b02f80357f2b2ff0dac8897c6b11876d886b143a301817ccd51cc5471d130a6632a88161b6fd8f24286a57c3fe257c3314a3974bb654697f462f4c73", 0x1054, 0x0, 0x0, 0x1d3) [ 1499.113989][ T7384] bond0: option lp_interval: invalid value (0) [ 1499.120388][ T7384] bond0: option lp_interval: allowed values 1 - 2147483647 16:30:05 executing program 0: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) clock_adjtime(0x0, &(0x7f0000000040)={0xd54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}) read(r0, &(0x7f00000000c0)=""/140, 0x8c) [ 1499.367587][ T7392] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1499.463211][ T7396] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:05 executing program 3: r0 = socket$kcm(0x29, 0x2, 0x0) r1 = dup(r0) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x119, 0x4, 0x0, 0x0) 16:30:05 executing program 5: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x42, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x84842, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100)='fuse\x00', 0x0, &(0x7f00000001c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@allow_other='allow_other'}]}}) statx(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x4000, 0x0, &(0x7f0000000340)) 16:30:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x0, 0x2) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000300)={0x53, 0xfffffffffffffffc, 0x5, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f00000001c0)="9b247f9c17", 0x0, 0xffffffff, 0x0, 0x0, 0x0}) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) [ 1499.883842][ T7392] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:06 executing program 3: r0 = socket(0x18, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x2, @random="7527cd36c51e", 'macvtap0\x00'}}, 0x1e) ioctl$PPPIOCSMRU(r0, 0x40047452, &(0x7f0000000040)) 16:30:06 executing program 0: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) clock_adjtime(0x0, &(0x7f0000000040)={0xd54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}) read(r0, &(0x7f00000000c0)=""/140, 0x8c) 16:30:06 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0x3ff, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000100)="0503460008003e0000000200c52cf7c25975e605b02f80357f2b2ff0dac8897c6b11876d886b143a301817ccd51cc5471d130a6632a88161b6fd8f24286a57c3fe257c3314a3974bb654697f462f4c73", 0x1054, 0x0, 0x0, 0x1d3) 16:30:06 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x100}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1500.342024][ T31] audit: type=1800 audit(1603816206.193:146): pid=7410 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=15941 res=0 errno=0 16:30:06 executing program 2: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) setsockopt$inet_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x303}, "eeb18b014090761e", "c8abee46a5a525dac23352bce5a4f85d0000000000000003c9000061101000", "6c4da567", "ffffffffffffffff"}, 0x38) write$binfmt_elf32(r0, 0x0, 0x58) write$binfmt_script(r0, 0x0, 0xc000) 16:30:06 executing program 5: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000540)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_ENUMAUDOUT(r0, 0xc0345642, &(0x7f0000000580)={0x0, "95dfe85bc955233d7d825f10eeb48f501f34e94e8311310413aca22934c50939"}) 16:30:06 executing program 3: perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c000200080001000600d2b33b04334442ba0a73dd936b80ab2e4ad677f0f9e53bcea17ac924ebbdee2dc86e44d81cec1a"], 0x3c}}, 0x0) [ 1500.873424][ T7425] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1500.946188][ T7428] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:06 executing program 0: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) clock_adjtime(0x0, &(0x7f0000000040)={0xd54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}) read(r0, &(0x7f00000000c0)=""/140, 0x8c) 16:30:07 executing program 2: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) setsockopt$inet_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x303}, "eeb18b014090761e", "c8abee46a5a525dac23352bce5a4f85d0000000000000003c9000061101000", "6c4da567", "ffffffffffffffff"}, 0x38) write$binfmt_elf32(r0, 0x0, 0x58) write$binfmt_script(r0, 0x0, 0xc000) [ 1501.349950][ T7428] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:07 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x99}, 0x40) [ 1501.397859][ T7434] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 16:30:07 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x200}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0x3ff, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000100)="0503460008003e0000000200c52cf7c25975e605b02f80357f2b2ff0dac8897c6b11876d886b143a301817ccd51cc5471d130a6632a88161b6fd8f24286a57c3fe257c3314a3974bb654697f462f4c73", 0x1054, 0x0, 0x0, 0x1d3) 16:30:07 executing program 0: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) clock_adjtime(0x0, &(0x7f0000000040)={0xd54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}) read(r0, &(0x7f00000000c0)=""/140, 0x8c) 16:30:08 executing program 2: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) setsockopt$inet_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x303}, "eeb18b014090761e", "c8abee46a5a525dac23352bce5a4f85d0000000000000003c9000061101000", "6c4da567", "ffffffffffffffff"}, 0x38) write$binfmt_elf32(r0, 0x0, 0x58) write$binfmt_script(r0, 0x0, 0xc000) [ 1502.214437][ T7434] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 16:30:08 executing program 5: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@typedef={0x4, 0x0, 0x0, 0x7}]}, {0x0, [0x0, 0x0, 0x0]}}, &(0x7f0000000140)=""/149, 0x29, 0x95, 0x8}, 0x20) [ 1502.265026][ T7479] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1502.361977][ T7483] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:08 executing program 3: mlock(&(0x7f00007ff000/0x800000)=nil, 0x800000) munmap(&(0x7f0000400000/0xc00000)=nil, 0xc00000) 16:30:08 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x123, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0)='SEG6\x00') [ 1502.760169][ T7479] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1502.788065][ T7489] BPF:[1] FWD [ 1502.791957][ T7489] BPF:struct [ 1502.795242][ T7489] BPF: [ 1502.798159][ T7489] BPF:Invalid name [ 1502.802556][ T7489] BPF: [ 1502.802556][ T7489] [ 1502.833911][ T7490] BPF:[1] FWD [ 1502.837583][ T7490] BPF:struct [ 1502.841029][ T7490] BPF: [ 1502.844141][ T7490] BPF:Invalid name [ 1502.847928][ T7490] BPF: [ 1502.847928][ T7490] 16:30:08 executing program 5: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@typedef={0x4, 0x0, 0x0, 0x7}]}, {0x0, [0x0, 0x0, 0x0]}}, &(0x7f0000000140)=""/149, 0x29, 0x95, 0x8}, 0x20) 16:30:08 executing program 2: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) setsockopt$inet_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x303}, "eeb18b014090761e", "c8abee46a5a525dac23352bce5a4f85d0000000000000003c9000061101000", "6c4da567", "ffffffffffffffff"}, 0x38) write$binfmt_elf32(r0, 0x0, 0x58) write$binfmt_script(r0, 0x0, 0xc000) 16:30:08 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x300}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:09 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r1 = dup(r0) setsockopt$packet_int(r1, 0x107, 0x10000000000f, &(0x7f0000006ffc), 0x4) 16:30:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005074c1300000000f9ff00000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=@newtfilter={0x44, 0x64, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@filter_kind_options=@f_flower={{0xb, 0x1, 'flower\x00'}, {0x14, 0x2, [@TCA_FLOWER_KEY_CT_ZONE={0x6}, @TCA_FLOWER_KEY_CT_ZONE_MASK={0x6}]}}]}, 0x44}}, 0x0) 16:30:09 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000003400)={0x1f, 0x1ff, @fixed, 0x0, 0x1}, 0xe) [ 1503.843068][ T7507] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1503.878274][ T7510] BPF:[1] FWD [ 1503.882616][ T7510] BPF:struct [ 1503.886066][ T7510] BPF: [ 1503.888986][ T7510] BPF:Invalid name [ 1503.893211][ T7510] BPF: [ 1503.893211][ T7510] 16:30:09 executing program 5: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@typedef={0x4, 0x0, 0x0, 0x7}]}, {0x0, [0x0, 0x0, 0x0]}}, &(0x7f0000000140)=""/149, 0x29, 0x95, 0x8}, 0x20) [ 1503.984484][ T7514] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1504.015236][ T7509] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1504.042624][ T7512] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 16:30:10 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r3, 0x107, 0xf, &(0x7f00000014c0)="12cb96df", 0x4) bind(r3, &(0x7f0000000200)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) write$binfmt_aout(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="4703000006"], 0x22) splice(r0, 0x0, r2, 0x0, 0x22, 0x0) 16:30:10 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x2fe, &(0x7f0000000080)=[{&(0x7f0000000580)="d800000018008108e00f80ecdb4cb9040a6965ef0f087c02e87c55a1bc000900b8004099100000000500154002008178a8001600040008c00600026fe48a51f00003ac0414c05c06ad01eb1e634154870fd00fde0000d67f6fa7007134cf6efb8000a007a290457f0189b316277ce06bbace80174c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe04000000730d16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e04adcdf634c1f215ce3089ad809d5e1cace81ed0b7fece0b42a9ecbee5de6", 0xd8}], 0x1}, 0x0) 16:30:10 executing program 0: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r0, &(0x7f0000002000)='/', 0x1) ftruncate(r0, 0xfff) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) rename(&(0x7f0000000000)='./file0\x00', 0x0) 16:30:10 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000000)=""/110) [ 1504.369881][ T7522] BPF:[1] FWD [ 1504.373760][ T7522] BPF:struct [ 1504.377036][ T7522] BPF: [ 1504.378010][ T7509] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1504.379853][ T7522] BPF:Invalid name [ 1504.379873][ T7522] BPF: [ 1504.379873][ T7522] 16:30:10 executing program 5: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@typedef={0x4, 0x0, 0x0, 0x7}]}, {0x0, [0x0, 0x0, 0x0]}}, &(0x7f0000000140)=""/149, 0x29, 0x95, 0x8}, 0x20) [ 1504.603648][ T7529] IPv6: NLM_F_CREATE should be specified when creating new route [ 1504.612280][ T7529] netlink: 152 bytes leftover after parsing attributes in process `syz-executor.4'. 16:30:10 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x400}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:10 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r3, 0x107, 0xf, &(0x7f00000014c0)="12cb96df", 0x4) bind(r3, &(0x7f0000000200)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) write$binfmt_aout(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="4703000006"], 0x22) splice(r0, 0x0, r2, 0x0, 0x22, 0x0) 16:30:10 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=@getlink={0x1a, 0x12, 0x1}, 0x20}}, 0x0) 16:30:11 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r0, &(0x7f0000000100)="d4", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r0, 0x1) setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0), 0x14) [ 1505.167227][ T7540] BPF:[1] FWD [ 1505.171433][ T7540] BPF:struct [ 1505.175311][ T7540] BPF: [ 1505.178525][ T7540] BPF:Invalid name [ 1505.183409][ T7540] BPF: [ 1505.183409][ T7540] 16:30:11 executing program 3: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) sendto$rose(r0, 0x0, 0x0, 0x4000004, 0x0, 0x0) 16:30:11 executing program 5: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x13, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x4b}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 1505.285141][ T7543] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1505.362978][ T7544] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:11 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r3, 0x107, 0xf, &(0x7f00000014c0)="12cb96df", 0x4) bind(r3, &(0x7f0000000200)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) write$binfmt_aout(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="4703000006"], 0x22) splice(r0, 0x0, r2, 0x0, 0x22, 0x0) 16:30:11 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=@getlink={0x1a, 0x12, 0x1}, 0x20}}, 0x0) [ 1505.744443][ T7543] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:11 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x1, 0x4, 0x4, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x4, &(0x7f0000003000)={0x3, 0x0, 0x812a000, 0x0, 0x0, 0x0}, 0x2c) 16:30:11 executing program 3: clock_adjtime(0x0, &(0x7f0000000000)={0xe663}) 16:30:11 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x500}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:11 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r3, 0x107, 0xf, &(0x7f00000014c0)="12cb96df", 0x4) bind(r3, &(0x7f0000000200)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) write$binfmt_aout(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="4703000006"], 0x22) splice(r0, 0x0, r2, 0x0, 0x22, 0x0) 16:30:12 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=@getlink={0x1a, 0x12, 0x1}, 0x20}}, 0x0) 16:30:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r3, @ANYBLOB="10005a800c000080040001"], 0x2c}}, 0x0) [ 1506.555383][ T7571] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:12 executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000800)="85", 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="fc", 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, 0x1c) [ 1506.610839][ T7573] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:12 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xc0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x47) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000780)=ANY=[@ANYBLOB="f5"], 0x60}}, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000300)=@broute={'broute\x00', 0x20, 0x1, 0x1c8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000580], 0x0, 0x0, 0x0}, 0x240) 16:30:12 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)={0x3c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16ad}], @NL80211_ATTR_DURATION={0x8, 0x57, 0xbc}]}, 0x3c}}, 0x0) 16:30:12 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=@getlink={0x1a, 0x12, 0x1}, 0x20}}, 0x0) [ 1507.016697][ T7578] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1507.052265][ T7571] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1507.111556][ T7584] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 16:30:13 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x600}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:13 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x1, &(0x7f00000006c0)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) 16:30:13 executing program 5: r0 = getpgrp(0x0) r1 = pidfd_open(r0, 0x0) pidfd_send_signal(r1, 0x0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x0) 16:30:13 executing program 2: r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r2}, 0x18) sendmsg$can_j1939(r0, &(0x7f0000000080)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {}, 0xfe}, 0x18, &(0x7f0000000b80)={&(0x7f0000000340)='\x00', 0x1}}, 0x0) 16:30:13 executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000800)="85", 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="fc", 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, 0x1c) 16:30:13 executing program 4: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000080)='autofs\x00', 0x0, &(0x7f0000000400)) symlink(&(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='./file1/file0\x00') readlink(&(0x7f00000000c0)='./file1/file0\x00', &(0x7f00000001c0)=""/59, 0x3b) [ 1507.789915][ T7594] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1507.834974][ T7594] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:14 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bind$packet(r1, &(0x7f0000000000)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=@newlink={0x40, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_VFINFO_LIST={0x20, 0x16, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN_LIST={0x18, 0xc, 0x0, 0x1, [{0x14}]}]}]}]}, 0x40}}, 0x0) 16:30:14 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f0000000180)="900000001c001d4d154a816393278bff0a80a578020000004004840014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0027c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000766436c0c80cefd28581d158ba86c9d2896c6d3bb82d0000000bf32c1739d775ee9aa241731ae9e0b39000"/143, 0xca, 0x4004, 0x0, 0xfffffe92) 16:30:14 executing program 2: syz_mount_image$hfsplus(&(0x7f0000000080)='hfsplus\x00', &(0x7f0000000240)='./bus\x00', 0x0, 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='nobarrier']) 16:30:14 executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000800)="85", 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="fc", 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, 0x1c) [ 1508.228109][ T7594] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:14 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$P9_RWALK(r0, &(0x7f0000000380)=ANY=[], 0x8) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap$snddsp_control(&(0x7f0000003000/0x3000)=nil, 0x1000, 0x2, 0x12, r0, 0x83000000) 16:30:14 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x700}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1508.545867][ T7616] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.5'. 16:30:14 executing program 0: unshare(0x40600) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, 0x0, 0x0) [ 1508.646215][ T7617] hfsplus: unable to find HFS+ superblock [ 1508.778726][ T7617] hfsplus: unable to find HFS+ superblock 16:30:14 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/166, 0xa6}], 0x1) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f00000002c0)) ioctl$UI_DEV_DESTROY(r0, 0x5502) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x15) [ 1509.003127][ T7629] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:14 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0x43400) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0x43400) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0xc028660f, &(0x7f00000005c0)=0x400000000) write$cgroup_int(r2, 0x0, 0x0) 16:30:15 executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000800)="85", 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="fc", 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, 0x1c) [ 1509.109884][ T7629] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:15 executing program 0: unshare(0x40600) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, 0x0, 0x0) 16:30:15 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$P9_RWALK(r0, &(0x7f0000000380)=ANY=[], 0x8) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap$snddsp_control(&(0x7f0000003000/0x3000)=nil, 0x1000, 0x2, 0x12, r0, 0x83000000) [ 1509.425534][ T7637] input: syz0 as /devices/virtual/input/input23 [ 1509.497027][ T7631] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1509.560172][ T7643] input: syz0 as /devices/virtual/input/input24 16:30:15 executing program 0: unshare(0x40600) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, 0x0, 0x0) 16:30:15 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x800}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1510.060989][ T31] audit: type=1800 audit(1603816215.917:147): pid=7645 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="memory.events" dev="sda1" ino=16384 res=0 errno=0 16:30:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x10, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HT={0x6, 0x2, [{}, {}]}]}]}]}, 0x30}}, 0x0) 16:30:16 executing program 3: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="24000000100087031dfffd946fa2830020200a0008000100000000010000aba20400ffff", 0x24}], 0x1}, 0x0) 16:30:16 executing program 0: unshare(0x40600) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, 0x0, 0x0) 16:30:16 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0x43400) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0x43400) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0xc028660f, &(0x7f00000005c0)=0x400000000) write$cgroup_int(r2, 0x0, 0x0) 16:30:16 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$P9_RWALK(r0, &(0x7f0000000380)=ANY=[], 0x8) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap$snddsp_control(&(0x7f0000003000/0x3000)=nil, 0x1000, 0x2, 0x12, r0, 0x83000000) [ 1510.508363][ T7668] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1510.580098][ T7674] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1510.581355][ T7668] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:16 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0x3) write$binfmt_misc(r1, 0x0, 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4004ffe0, 0x0) 16:30:16 executing program 5: r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0x110000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000240)={@local, 0x1}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0x110000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f00000000c0)={@host}) close(r1) 16:30:16 executing program 3: syz_mount_image$udf(&(0x7f0000000000)='udf\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x6, &(0x7f0000000200)=[{&(0x7f0000001480)="124245413031", 0x6, 0x8000}, {&(0x7f0000010100)='\x00NSR03', 0x6, 0x8800}, {&(0x7f0000011200)="020003002300010076b5f00100010000002000006000000000200000e007", 0x1e, 0x20000}, {&(0x7f0000012800)="01000300990001005666f001e00700000100000000000000084c696e757855444600000000000000000000000000000000000000000000090100010003000300010000000100000008313233343536373831323334353637384c696e7578554446", 0x61, 0xfc000}, {&(0x7f0000012900)="0000000000000019004f53544120436f6d7072657373656420556e69636f646500000000000000000000000000000000000000000000000000000000000000000000000000000000004f53544120436f6d7072657373656420556e69636f64650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002a4c696e7578206d6b756466667300000000000000000004050000000000007810e4070913142c165c1419002a4c696e757820554446465300000000000000000000000405", 0xde, 0xfc0c0}, {&(0x7f0000012a00)="000000000000000001", 0x9, 0xfc1e0}], 0x0, &(0x7f00000007c0)={[{@iocharset={'iocharset', 0x3d, 'default'}}, {@iocharset={'iocharset', 0x3d, 'cp932'}}]}) [ 1511.007491][ T7668] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:17 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x808}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:17 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$P9_RWALK(r0, &(0x7f0000000380)=ANY=[], 0x8) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap$snddsp_control(&(0x7f0000003000/0x3000)=nil, 0x1000, 0x2, 0x12, r0, 0x83000000) 16:30:17 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0x43400) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0x43400) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0xc028660f, &(0x7f00000005c0)=0x400000000) write$cgroup_int(r2, 0x0, 0x0) 16:30:17 executing program 5: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000015c0)=ANY=[@ANYBLOB="cc050000130001fffffffffffff000000200000a01000000a30a010300000000810216000900010073797a31000000001c030000160a0102000000000000000005000006ec00038008000140000000000c00054000000000000004059800038068000380140001007465616d5f736c6176655f3000000000140001006970365f767469300000000000000000140001006970365f767469300000000000000000140001007866726d30000000000000000000d8b1194f7f687c488125801296610000140001006e657464657673696d3005fd000000000b000380140001007663616e300000000000000000006c6f000000000000000000000000000000d0010380080002400000000340000380140001006c6f000000000000001400010062737461647630000000000000000000140001006d6163766c616e3100000000000000000800014000000000a4000001007369743000000000000000000000000014000100766c616e300000000000000000000000140001006970766c616e31000000000000000000140001007866726d30000000000000000001000014000100626f6e645f736c6176655f31000000001400010076657468315f746f5f626f6e64000000140001006c6f000000000000000000000000000014000100726f736530000000000000b92f0845a5cba5f2407fffffff08000240000000042c0003801400010073797a5f74756e000000000000000000140001007665746831000000000000000000000040000380140001006d61637609006e3000000000000000001400010076657468300000000000000000000000140001006d6963766c616e300080000000008ea44dda57e2aeec8bdcad3351a2000008000240000000025400038014000100626f6e643000000000000000001400010076657468315f746f5f6272696467650014"], 0x5cc}}, 0x0) r0 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x4924924924926d3, 0x0) 16:30:17 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x10, 0x50}, [@ldst={0x7}]}, &(0x7f0000000080)='syzkaller\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x36c}, 0x48) [ 1511.682439][ T7691] UDF-fs: error (device loop3): udf_process_sequence: Primary Volume Descriptor not found! [ 1511.767889][ T7693] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1511.780747][ T7691] UDF-fs: warning (device loop3): udf_fill_super: No partition found (2) [ 1511.807601][ T7696] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1511.881553][ T7691] UDF-fs: error (device loop3): udf_process_sequence: Primary Volume Descriptor not found! [ 1511.958617][ T7691] UDF-fs: warning (device loop3): udf_fill_super: No partition found (2) [ 1512.010616][ T7705] netlink: 704 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1512.024969][ T7705] netlink: 5 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1512.036304][ T7705] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 16:30:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0) read(r0, &(0x7f0000000240)=""/102400, 0x19000) preadv(r0, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/39, 0x27}], 0x1, 0x0, 0x0) 16:30:18 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x37}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000025c0)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xe}}, [@filter_kind_options=@f_route={{0xa, 0x1, 'route\x00'}, {0x3c, 0x2, [@TCA_ROUTE4_ACT={0x38, 0x6, [@m_xt={0x34, 0x1, 0x0, 0x0, {{0x7, 0x1, 'xt\x00'}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0xfffffffe}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x6c}}, 0x0) r3 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000200), 0x4924924924926d3, 0x0) 16:30:18 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='devpts\x00', 0x0, 0x0) syz_mount_image$tmpfs(&(0x7f0000000000)='tmpfs\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0xcc6428, &(0x7f0000000180)={[{@uid={'uid'}}]}) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r0, r1, 0x0, 0x800000080004103) 16:30:18 executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x1006}, 0x4) close(r0) 16:30:18 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0x43400) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0x43400) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0xc028660f, &(0x7f00000005c0)=0x400000000) write$cgroup_int(r2, 0x0, 0x0) [ 1512.723447][ T7708] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:18 executing program 5: r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000000), 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x3}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) [ 1512.970036][ T7718] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 16:30:19 executing program 3: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'caif0\x00'}}]}, 0x38}}, 0x0) [ 1514.340902][ T7732] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1514.392203][ T3525] tipc: TX() has been purged, node left! [ 1517.429445][ T3525] device hsr_slave_0 left promiscuous mode [ 1517.455543][ T3525] device hsr_slave_1 left promiscuous mode [ 1517.774290][ T3525] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1517.782905][ T3525] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1517.793337][ T3525] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1517.800971][ T3525] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1517.826404][ T3525] device bridge_slave_1 left promiscuous mode [ 1517.833324][ T3525] bridge0: port 2(bridge_slave_1) entered disabled state [ 1517.865859][ T3525] device bridge_slave_0 left promiscuous mode [ 1517.872847][ T3525] bridge0: port 1(bridge_slave_0) entered disabled state [ 1517.947774][ T3525] device veth1_macvtap left promiscuous mode [ 1517.954154][ T3525] device veth0_macvtap left promiscuous mode [ 1517.960285][ T3525] device veth1_vlan left promiscuous mode [ 1517.966591][ T3525] device veth0_vlan left promiscuous mode [ 1521.992838][ T9499] Bluetooth: hci4: command 0x0409 tx timeout [ 1522.000621][ T3525] team0 (unregistering): Port device team_slave_1 removed [ 1522.023028][ T3525] team0 (unregistering): Port device team_slave_0 removed [ 1522.046671][ T3525] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1522.065926][ T3525] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1522.146258][ T3525] bond0 (unregistering): Released all slaves [ 1522.214695][ T7769] IPVS: ftp: loaded support on port[0] = 21 [ 1522.238456][ T7769] lo speed is unknown, defaulting to 1000 [ 1522.465571][ T7769] chnl_net:caif_netlink_parms(): no params data found [ 1522.583930][ T7769] bridge0: port 1(bridge_slave_0) entered blocking state [ 1522.593027][ T7769] bridge0: port 1(bridge_slave_0) entered disabled state [ 1522.603049][ T7769] device bridge_slave_0 entered promiscuous mode [ 1522.629881][ T7769] bridge0: port 2(bridge_slave_1) entered blocking state [ 1522.637248][ T7769] bridge0: port 2(bridge_slave_1) entered disabled state [ 1522.647477][ T7769] device bridge_slave_1 entered promiscuous mode [ 1522.719585][ T7769] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1522.747890][ T7769] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1522.808886][ T7769] team0: Port device team_slave_0 added [ 1522.827977][ T7769] team0: Port device team_slave_1 added [ 1522.879328][ T7769] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1522.886823][ T7769] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1522.914608][ T7769] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1522.942118][ T7769] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1522.949213][ T7769] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1522.975876][ T7769] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1523.058650][ T7769] device hsr_slave_0 entered promiscuous mode [ 1523.070690][ T7769] device hsr_slave_1 entered promiscuous mode [ 1523.080153][ T7769] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1523.088406][ T7769] Cannot create hsr debugfs directory [ 1523.537958][ T7769] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1523.580586][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1523.589368][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1523.613914][ T7769] 8021q: adding VLAN 0 to HW filter on device team0 [ 1523.639383][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1523.648930][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1523.658644][ T30] bridge0: port 1(bridge_slave_0) entered blocking state [ 1523.666595][ T30] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1523.677037][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1523.695051][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1523.705376][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1523.716528][ T8469] bridge0: port 2(bridge_slave_1) entered blocking state [ 1523.724094][ T8469] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1523.774825][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1523.785143][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1523.796602][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1523.808094][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1523.818707][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1523.829485][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1523.843320][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1523.865515][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1523.874928][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1523.903773][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1523.914367][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1523.933170][ T7769] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1523.976850][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1523.986492][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1524.013696][ T7769] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1524.035460][ T30] Bluetooth: hci4: command 0x041b tx timeout [ 1524.144783][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1524.155153][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1524.206112][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1524.216005][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1524.239528][ T7769] device veth0_vlan entered promiscuous mode [ 1524.248267][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1524.257939][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1524.306202][ T7769] device veth1_vlan entered promiscuous mode [ 1524.381237][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1524.391149][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1524.412427][ T7769] device veth0_macvtap entered promiscuous mode [ 1524.439840][ T7769] device veth1_macvtap entered promiscuous mode [ 1524.476374][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1524.487561][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.497714][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1524.509845][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.520093][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1524.530979][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.542309][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1524.552999][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.563110][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1524.573957][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.586885][ T7769] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1524.596000][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1524.605908][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1524.615649][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1524.625245][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1524.651149][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1524.662941][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.673049][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1524.683766][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.693850][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1524.704522][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.714643][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1524.725314][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.735468][ T7769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1524.746147][ T7769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1524.758578][ T7769] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1524.767653][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1524.778056][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1525.179304][ T3545] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1525.187356][ T3545] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1525.255829][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1525.278602][ T624] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1525.287128][ T624] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1525.318391][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1525.477086][ T8007] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1525.592861][ T8006] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1525.930677][ T3532] tipc: TX() has been purged, node left! [ 1527.550056][ T3532] device hsr_slave_0 left promiscuous mode [ 1527.563561][ T3532] device hsr_slave_1 left promiscuous mode [ 1527.578374][ T3532] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1527.586827][ T3532] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1527.597253][ T3532] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1527.606810][ T3532] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1527.616873][ T3532] device bridge_slave_1 left promiscuous mode [ 1527.624118][ T3532] bridge0: port 2(bridge_slave_1) entered disabled state [ 1527.636272][ T3532] device bridge_slave_0 left promiscuous mode [ 1527.643175][ T3532] bridge0: port 1(bridge_slave_0) entered disabled state [ 1527.663536][ T3532] device veth1_macvtap left promiscuous mode [ 1527.669863][ T3532] device veth0_macvtap left promiscuous mode [ 1527.676500][ T3532] device veth1_vlan left promiscuous mode [ 1527.682576][ T3532] device veth0_vlan left promiscuous mode [ 1530.203219][ T3532] team0 (unregistering): Port device team_slave_1 removed [ 1530.222979][ T3532] team0 (unregistering): Port device team_slave_0 removed [ 1530.246074][ T3532] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1530.265957][ T3532] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1530.345133][ T3532] bond0 (unregistering): Released all slaves [ 1530.426902][ T8028] IPVS: ftp: loaded support on port[0] = 21 [ 1530.449101][ T8028] lo speed is unknown, defaulting to 1000 [ 1530.646048][ T8028] chnl_net:caif_netlink_parms(): no params data found [ 1530.767260][ T8028] bridge0: port 1(bridge_slave_0) entered blocking state [ 1530.775057][ T8028] bridge0: port 1(bridge_slave_0) entered disabled state [ 1530.785215][ T8028] device bridge_slave_0 entered promiscuous mode [ 1530.803056][ T8028] bridge0: port 2(bridge_slave_1) entered blocking state [ 1530.810305][ T8028] bridge0: port 2(bridge_slave_1) entered disabled state [ 1530.820493][ T8028] device bridge_slave_1 entered promiscuous mode [ 1530.901403][ T8028] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1530.928540][ T8028] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1531.003239][ T8028] team0: Port device team_slave_0 added [ 1531.023406][ T8028] team0: Port device team_slave_1 added [ 1531.087859][ T8028] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1531.095342][ T8028] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1531.121600][ T8028] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1531.142478][ T8028] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1531.149564][ T8028] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1531.176347][ T8028] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1531.261233][ T8028] device hsr_slave_0 entered promiscuous mode [ 1531.276771][ T8028] device hsr_slave_1 entered promiscuous mode [ 1531.285884][ T8028] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1531.294568][ T8028] Cannot create hsr debugfs directory [ 1531.703476][ T9499] Bluetooth: hci4: command 0x0409 tx timeout [ 1531.720333][ T8028] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1531.754518][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1531.764165][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1531.784238][ T8028] 8021q: adding VLAN 0 to HW filter on device team0 [ 1531.809269][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1531.818796][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1531.829204][ T8467] bridge0: port 1(bridge_slave_0) entered blocking state [ 1531.836647][ T8467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1531.847759][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1531.866474][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1531.876431][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1531.885937][ T8469] bridge0: port 2(bridge_slave_1) entered blocking state [ 1531.893496][ T8469] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1531.936203][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1531.946357][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1531.958108][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1531.968328][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1531.980176][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1532.000186][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1532.012453][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1532.046551][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1532.056073][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1532.066338][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1532.076896][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1532.095744][ T8028] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1532.140185][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1532.148455][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1532.177884][ T8028] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1532.290485][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1532.301286][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1532.351595][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1532.360966][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1532.383000][ T8028] device veth0_vlan entered promiscuous mode [ 1532.396007][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1532.405902][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1532.449624][ T8028] device veth1_vlan entered promiscuous mode [ 1532.489140][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1532.498580][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1532.556271][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1532.565970][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1532.588088][ T8028] device veth0_macvtap entered promiscuous mode [ 1532.610305][ T8028] device veth1_macvtap entered promiscuous mode [ 1532.652682][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1532.663414][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.673522][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1532.684211][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.694323][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1532.705035][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.715218][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1532.725889][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.736033][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1532.746751][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.759251][ T8028] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1532.769466][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1532.778871][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1532.788597][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1532.798448][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1532.823942][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1532.836587][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.848256][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1532.859079][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.869133][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1532.879823][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.889928][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1532.900615][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.910843][ T8028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1532.921552][ T8028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1532.935786][ T8028] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1532.944406][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1532.954880][ T8467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1533.314076][ T624] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1533.322407][ T624] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1533.330125][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1533.464583][ T624] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1533.472602][ T624] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1533.481194][ T9499] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1533.669325][ T8273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1533.691113][ T8273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1533.782321][ T9499] Bluetooth: hci4: command 0x041b tx timeout 16:30:39 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x848}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:39 executing program 5: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f00000002c0)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x6e}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 16:30:39 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, 0x0, 0x0) 16:30:39 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x37}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000025c0)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xe}}, [@filter_kind_options=@f_route={{0xa, 0x1, 'route\x00'}, {0x3c, 0x2, [@TCA_ROUTE4_ACT={0x38, 0x6, [@m_xt={0x34, 0x1, 0x0, 0x0, {{0x7, 0x1, 'xt\x00'}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0xfffffffe}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x6c}}, 0x0) r3 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000200), 0x4924924924926d3, 0x0) 16:30:39 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) shutdown(r1, 0x1) dup2(r1, r0) 16:30:39 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r0, 0x0, 0xffffffffffffffcc, 0x0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @mcast1}, 0x1c) recvmmsg(r0, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2041, 0x0) [ 1534.016265][ T8273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1534.269961][ T8284] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1534.299006][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 16:30:40 executing program 0: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, @loopback, @local}, "00006371ae9b1c06"}}}}}, 0x0) 16:30:40 executing program 2: syz_emit_ethernet(0x7e, &(0x7f0000000080)={@local, @random="f60044000b00", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010121, @local}, @dest_unreach={0x3, 0x5, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @multicast2, @rand_addr, {[@end, @ra={0x94, 0x4}, @ssrr={0x89, 0xb, 0x0, [@rand_addr, @broadcast]}, @timestamp={0x44, 0xc, 0x0, 0x0, 0x0, [0x0, 0x0]}, @generic={0x0, 0xe, "739cda6dc0ceb4c87eae81c7"}, @ssrr={0x89, 0x13, 0x0, [@private, @loopback, @local, @private]}]}}}}}}}, 0x0) 16:30:40 executing program 5: r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0\x00', 0x2, 0x0) pwritev2(r0, &(0x7f0000000380)=[{&(0x7f0000000100)="9f", 0x1}], 0x1, 0x0, 0x0, 0x3) [ 1534.693255][ T8296] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1534.738194][ T8297] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:40 executing program 3: r0 = socket$inet_sctp(0x2, 0x801, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000040), &(0x7f00000000c0)=0x10) 16:30:40 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x37}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000025c0)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xe}}, [@filter_kind_options=@f_route={{0xa, 0x1, 'route\x00'}, {0x3c, 0x2, [@TCA_ROUTE4_ACT={0x38, 0x6, [@m_xt={0x34, 0x1, 0x0, 0x0, {{0x7, 0x1, 'xt\x00'}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0xfffffffe}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x6c}}, 0x0) r3 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000200), 0x4924924924926d3, 0x0) [ 1535.149407][ T8296] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:41 executing program 0: r0 = syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0x0, 0xa00) ioctl$VIDIOC_DQEVENT(r0, 0x80885659, 0x0) [ 1535.327537][ T8310] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 16:30:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x849}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:41 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x3, 0x5) setsockopt$inet_msfilter(r1, 0x0, 0x8, &(0x7f0000000000)=ANY=[@ANYRES16], 0x1) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @local}, &(0x7f0000000080)=0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x78, 0x24, 0x67e0317e552b57d7, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd}}}]}, 0x78}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 16:30:41 executing program 5: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000"/18, @ANYRES16], 0x28}}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x3a7}, 0x10) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001e005f02", 0x8) sendmmsg$alg(r0, &(0x7f0000000140), 0xcc, 0x0) 16:30:41 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0xc0184908, &(0x7f0000000080)={0x3fb, 0x20daaca6}) 16:30:41 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x37}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000025c0)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xe}}, [@filter_kind_options=@f_route={{0xa, 0x1, 'route\x00'}, {0x3c, 0x2, [@TCA_ROUTE4_ACT={0x38, 0x6, [@m_xt={0x34, 0x1, 0x0, 0x0, {{0x7, 0x1, 'xt\x00'}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0xfffffffe}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x6c}}, 0x0) r3 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000200), 0x4924924924926d3, 0x0) [ 1535.851310][ T8324] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1535.873540][ T9499] Bluetooth: hci4: command 0x040f tx timeout [ 1535.930586][ T8328] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:41 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="900000001000010400"/20, @ANYRES32, @ANYBLOB="30000400000000005c001280090001007866726d000000004c0002800800010001000000080001000300000008000200000000000800010003000000080001003f020000080001000200000008000200040000000804020004000000080001000400000008000a00", @ANYRES32, @ANYBLOB="0a0002"], 0x90}}, 0x0) 16:30:42 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x40080) sendmsg(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000500)='R', 0x7ffff000}], 0x1}, 0x0) 16:30:42 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0xc0184908, &(0x7f0000000080)={0x3fb, 0x20daaca6}) [ 1536.268582][ T8332] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1536.340839][ T8324] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:42 executing program 2: madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x11) [ 1536.488404][ T8339] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 16:30:42 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x900}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:42 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_MODE={0x8}, @IFLA_MACVLAN_MACADDR={0xa, 0x4, @multicast}]}}}]}, 0x48}}, 0x0) 16:30:42 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0xc0184908, &(0x7f0000000080)={0x3fb, 0x20daaca6}) 16:30:42 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r2, 0x0) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) 16:30:42 executing program 4: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1=0xe0000306, @dev={0xac, 0x14, 0x14, 0x29}, @multicast1}, 0xc) [ 1537.219653][ T8354] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1537.278170][ T8354] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:43 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='hugetlbfs\x00', 0x0, 0x0) syz_mount_image$tmpfs(&(0x7f0000000000)='tmpfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x26a6422, &(0x7f0000000400)={[{@nr_inodes={'nr_inodes', 0x3d, [0x6b]}}]}) 16:30:43 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x40080) sendmsg(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000500)='R', 0x7ffff000}], 0x1}, 0x0) 16:30:43 executing program 4: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x2, &(0x7f0000000000)=@rose={'rose', 0x0}, 0x10) [ 1537.678548][ T8354] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:43 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0xc0184908, &(0x7f0000000080)={0x3fb, 0x20daaca6}) 16:30:43 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x63, 0x11, 0x9d}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x102b, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 16:30:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x908}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1537.943775][ T9499] Bluetooth: hci4: command 0x0419 tx timeout [ 1537.992818][ T8370] hugetlbfs: Bad value 'k' for mount option 'nr_inodes' [ 1537.992818][ T8370] [ 1538.090276][ T8376] hugetlbfs: Bad value 'k' for mount option 'nr_inodes' [ 1538.090276][ T8376] 16:30:44 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'team_slave_0\x00', 0x0}) r5 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x5c, r5, 0x1, 0x0, 0x0, {0x1, 0x6c00000000000000}, [{{0x8, 0x1, r2}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}]}}]}, 0x5c}}, 0x0) 16:30:44 executing program 3: sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000333807461c0183a7"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x20040080) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg(r0, &(0x7f00000001c0), 0x400000000000150, 0x0) 16:30:44 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x40080) sendmsg(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000500)='R', 0x7ffff000}], 0x1}, 0x0) 16:30:44 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="1400000010efa8c68d000000000000000000000a2000000002030100000000f787060000000000000900010001"], 0xcc}}, 0x0) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)={0x20, 0x1, 0x3, 0x801, 0x0, 0x0, {}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x6}}]}, 0x20}}, 0x0) 16:30:44 executing program 4: syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="01434430303101004c494e55582020202020202020202020202020202020202020202020202020204344524f4d2020202020202020202020202020202020202020202020202020200000000000000000bf000000000000bf000000000000000000000000000000000000000000000000000000000000000001000001010000010008080018000000000000181400000000000000000000160000000022001c", 0x9f, 0x8000}, {&(0x7f0000000280)="0243443030310100004c0049004e0055005800200020002000200020002000200020002000200020004300440052004f004d002000200020002000200020002000200020002000200000000000000000bf000000000000bf252f", 0x5a, 0x8800}, {&(0x7f0000000300)="88001c0000000000001c00080000000008007809140b2a3a0802000001000001010053500701beef005203050181505824016d4100000000416d03000000000000030000000000000000000000000000000054461a010e7809140b2a3a087809140b2a3a087809140b2a3a0843451c0120", 0x71, 0xe000}], 0x0, &(0x7f0000000080)) [ 1538.650145][ T8382] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:45 executing program 3: sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000333807461c0183a7"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x20040080) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg(r0, &(0x7f00000001c0), 0x400000000000150, 0x0) 16:30:45 executing program 2: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000040)=0x7) mmap$dsp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xb, 0x12, r0, 0x0) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0xb03bb99b2dea6cb1, 0xffffffffffffffff, 0x0) 16:30:45 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000005c0)=ANY=[], 0xa) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(0xffffffffffffffff, &(0x7f0000000180)="2000000012005f0214f9f407000000000a00000000000003", 0x18) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 16:30:45 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000002080)='ns\x00') getdents(r0, 0x0, 0x0) 16:30:45 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x40080) sendmsg(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000500)='R', 0x7ffff000}], 0x1}, 0x0) 16:30:45 executing program 3: sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000333807461c0183a7"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x20040080) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg(r0, &(0x7f00000001c0), 0x400000000000150, 0x0) [ 1540.305289][ T624] tipc: TX() has been purged, node left! [ 1543.359955][ T624] device hsr_slave_0 left promiscuous mode [ 1543.408254][ T624] device hsr_slave_1 left promiscuous mode [ 1543.453357][ T624] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1543.461159][ T624] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1543.525815][ T624] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1543.533686][ T624] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1543.571313][ T624] device bridge_slave_1 left promiscuous mode [ 1543.578256][ T624] bridge0: port 2(bridge_slave_1) entered disabled state [ 1543.617330][ T624] device bridge_slave_0 left promiscuous mode [ 1543.624807][ T624] bridge0: port 1(bridge_slave_0) entered disabled state [ 1543.733160][ T624] device veth1_macvtap left promiscuous mode [ 1543.739281][ T624] device veth0_macvtap left promiscuous mode [ 1543.745755][ T624] device veth1_vlan left promiscuous mode [ 1543.751654][ T624] device veth0_vlan left promiscuous mode [ 1546.077738][ T624] team0 (unregistering): Port device team_slave_1 removed [ 1546.097823][ T624] team0 (unregistering): Port device team_slave_0 removed [ 1546.120974][ T624] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1546.145751][ T624] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1546.223409][ T624] bond0 (unregistering): Released all slaves [ 1546.300935][ T8446] IPVS: ftp: loaded support on port[0] = 21 [ 1546.325211][ T8446] lo speed is unknown, defaulting to 1000 [ 1546.513960][ T8446] chnl_net:caif_netlink_parms(): no params data found [ 1546.646219][ T8446] bridge0: port 1(bridge_slave_0) entered blocking state [ 1546.654625][ T8446] bridge0: port 1(bridge_slave_0) entered disabled state [ 1546.664736][ T8446] device bridge_slave_0 entered promiscuous mode [ 1546.690154][ T8446] bridge0: port 2(bridge_slave_1) entered blocking state [ 1546.698346][ T8446] bridge0: port 2(bridge_slave_1) entered disabled state [ 1546.708472][ T8446] device bridge_slave_1 entered promiscuous mode [ 1546.791267][ T8446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1546.816536][ T8446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1546.879561][ T8446] team0: Port device team_slave_0 added [ 1546.900609][ T8446] team0: Port device team_slave_1 added [ 1546.952191][ T8446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1546.960257][ T8446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1546.987074][ T8446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1547.018225][ T8446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1547.026957][ T8446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1547.053389][ T8446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1547.074056][ T8469] Bluetooth: hci4: command 0x0409 tx timeout [ 1547.139138][ T8446] device hsr_slave_0 entered promiscuous mode [ 1547.150036][ T8446] device hsr_slave_1 entered promiscuous mode [ 1547.161090][ T8446] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1547.170111][ T8446] Cannot create hsr debugfs directory [ 1547.611418][ T8446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1547.640752][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1547.649541][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1547.670063][ T8446] 8021q: adding VLAN 0 to HW filter on device team0 [ 1547.693592][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1547.706036][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1547.715757][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 1547.723177][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1547.766895][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1547.775934][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1547.788254][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1547.797688][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 1547.805605][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1547.815017][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1547.826646][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1547.837279][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1547.848071][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1547.861315][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1547.886169][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1547.896298][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1547.934692][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1547.943989][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1547.954208][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1547.964487][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1547.981226][ T8446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1548.034823][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1548.042931][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1548.070517][ T8446] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1548.186331][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1548.197166][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1548.243293][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1548.253297][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1548.274598][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1548.284367][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1548.299932][ T8446] device veth0_vlan entered promiscuous mode [ 1548.326324][ T8446] device veth1_vlan entered promiscuous mode [ 1548.386453][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1548.397151][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1548.417396][ T8446] device veth0_macvtap entered promiscuous mode [ 1548.440369][ T8446] device veth1_macvtap entered promiscuous mode [ 1548.481336][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1548.492453][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.502595][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1548.513272][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.523795][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1548.535430][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.545621][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1548.556438][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.566505][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1548.577249][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.589847][ T8446] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1548.598595][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1548.608774][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1548.618448][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1548.628874][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1548.652144][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1548.663160][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.673289][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1548.684076][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.694237][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1548.704896][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.715032][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1548.725896][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.736415][ T8446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1548.747105][ T8446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1548.759792][ T8446] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1548.769798][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1548.780176][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1549.142688][ T9499] Bluetooth: hci4: command 0x041b tx timeout [ 1549.189008][ T3547] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1549.200579][ T3547] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1549.290404][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1549.353935][ T3547] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1549.362883][ T3547] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1549.372053][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1549.537707][ T8679] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1549.559233][ T8679] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:55 executing program 5: setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @private1}], 0x1c) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000000)=0x9, 0x4) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000002b000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f0000000100)="b805000000b94a0000000f01c10f00d4b93c0200000f320f0666b80a008ec00f09c4c125d5b370199ca9c7442400a4b9b4edc74424024ddf3ba1c7442406000000000f011c24b8010000000f01c1660f3881530f"}], 0x15555555555555d2, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:30:55 executing program 2: r0 = getpgrp(0x0) r1 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x0) 16:30:55 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xa00}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:55 executing program 0: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001540)='/dev/cuse\x00', 0x2, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000040)={0x28}, 0x28) 16:30:55 executing program 3: sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000333807461c0183a7"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x20040080) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg(r0, &(0x7f00000001c0), 0x400000000000150, 0x0) 16:30:55 executing program 4: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f000001dc00)={0x1b, 0x0, 0x0, 0x2000}, 0x40) mount$9p_fd(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000380)='9p\x00', 0x0, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) [ 1549.882195][ T8679] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:56 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) connect$l2tp6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4d89}, 0x20) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x20) 16:30:56 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f00000000c0)=0x321) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f0000000040)=0x9) [ 1550.453053][ T8702] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:56 executing program 3: r0 = socket(0x40000000002, 0x3, 0x9) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={&(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000001580)=[@ip_tos_u8={{0xd}}], 0x10}, 0x0) [ 1550.513451][ T8703] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:56 executing program 5: setrlimit(0x2, &(0x7f00000000c0)) r0 = socket$netlink(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) mmap(&(0x7f0000532000/0x1000)=nil, 0x1000, 0x403, 0x2000000000032, 0xffffffffffffffff, 0x0) [ 1550.913527][ T8715] mmap: syz-executor.5 (8715): VmData 25616384 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 1550.944947][ T8702] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:56 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f000001c000)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x1, 0x0) faccessat(r0, &(0x7f0000000080)='./file0\x00', 0x2) 16:30:57 executing program 4: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) socket$unix(0x1, 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) epoll_wait(r1, &(0x7f0000000000)=[{}], 0x1, 0x0) 16:30:57 executing program 3: r0 = openat$vimc0(0xffffff9c, &(0x7f0000000080)='/dev/video0\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0x402c5839, 0x0) [ 1551.222541][ T9499] Bluetooth: hci4: command 0x040f tx timeout 16:30:57 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xb00}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:30:57 executing program 5: setrlimit(0x2, &(0x7f00000000c0)) r0 = socket$netlink(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) mmap(&(0x7f0000532000/0x1000)=nil, 0x1000, 0x403, 0x2000000000032, 0xffffffffffffffff, 0x0) 16:30:57 executing program 0: socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x29, 0x5, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x100000005, 0x0, &(0x7f0000000000)) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0x3, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) 16:30:57 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f000001c000)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x1, 0x0) faccessat(r0, &(0x7f0000000080)='./file0\x00', 0x2) 16:30:57 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r0, &(0x7f0000000040)={{0x1b, 0x5b, 0x7, 0x7, 0x3f, 0x0, 0x0, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) [ 1551.906866][ T8724] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:30:57 executing program 3: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r0 = socket$inet6(0xa, 0x8000008000080003, 0x5) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c00000013003586000000030000000007000000", @ANYRES32=r1, @ANYBLOB="00000005000000000c001a00080002c0ffffff"], 0x2c}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r2, &(0x7f0000000140), 0x332, 0x0) 16:30:57 executing program 5: setrlimit(0x2, &(0x7f00000000c0)) r0 = socket$netlink(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) mmap(&(0x7f0000532000/0x1000)=nil, 0x1000, 0x403, 0x2000000000032, 0xffffffffffffffff, 0x0) 16:30:58 executing program 0: socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x29, 0x5, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x100000005, 0x0, &(0x7f0000000000)) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0x3, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) 16:30:58 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f000001c000)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x1, 0x0) faccessat(r0, &(0x7f0000000080)='./file0\x00', 0x2) 16:30:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008000f0fffeffe809000000fff5dd0000001000010009080800418e00000304fcff", 0x58}], 0x1) 16:30:58 executing program 5: setrlimit(0x2, &(0x7f00000000c0)) r0 = socket$netlink(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) mmap(&(0x7f0000532000/0x1000)=nil, 0x1000, 0x403, 0x2000000000032, 0xffffffffffffffff, 0x0) 16:30:59 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='oom_score_adj\x00') writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000000)=' 4', 0x2}], 0x1) [ 1553.522600][ T624] tipc: TX() has been purged, node left! [ 1555.927002][ T624] device hsr_slave_0 left promiscuous mode [ 1555.953083][ T624] device hsr_slave_1 left promiscuous mode [ 1555.966456][ T624] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1555.975712][ T624] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1555.992226][ T624] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1556.000025][ T624] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1556.020842][ T624] device bridge_slave_1 left promiscuous mode [ 1556.030217][ T624] bridge0: port 2(bridge_slave_1) entered disabled state [ 1556.313219][ T624] device bridge_slave_0 left promiscuous mode [ 1556.319976][ T624] bridge0: port 1(bridge_slave_0) entered disabled state [ 1556.406297][ T624] device veth1_macvtap left promiscuous mode [ 1556.412503][ T624] device veth0_macvtap left promiscuous mode [ 1556.418663][ T624] device veth1_vlan left promiscuous mode [ 1556.424874][ T624] device veth0_vlan left promiscuous mode [ 1559.030659][ T624] team0 (unregistering): Port device team_slave_1 removed [ 1559.052474][ T624] team0 (unregistering): Port device team_slave_0 removed [ 1559.075621][ T624] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1559.093804][ T624] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1559.174260][ T624] bond0 (unregistering): Released all slaves [ 1559.249619][ T8806] IPVS: ftp: loaded support on port[0] = 21 [ 1559.271398][ T8806] lo speed is unknown, defaulting to 1000 [ 1559.479703][ T8806] chnl_net:caif_netlink_parms(): no params data found [ 1559.608151][ T8806] bridge0: port 1(bridge_slave_0) entered blocking state [ 1559.616365][ T8806] bridge0: port 1(bridge_slave_0) entered disabled state [ 1559.626579][ T8806] device bridge_slave_0 entered promiscuous mode [ 1559.653522][ T8806] bridge0: port 2(bridge_slave_1) entered blocking state [ 1559.661982][ T8806] bridge0: port 2(bridge_slave_1) entered disabled state [ 1559.672063][ T8806] device bridge_slave_1 entered promiscuous mode [ 1559.743953][ T8806] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1559.765350][ T8806] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1559.831453][ T8806] team0: Port device team_slave_0 added [ 1559.851912][ T8806] team0: Port device team_slave_1 added [ 1559.905726][ T8806] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1559.913147][ T8806] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1559.939487][ T8806] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1559.974221][ T8806] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1559.981435][ T8806] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1560.007681][ T8806] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1560.101990][ T8468] Bluetooth: hci4: command 0x0409 tx timeout [ 1560.118034][ T8806] device hsr_slave_0 entered promiscuous mode [ 1560.135245][ T8806] device hsr_slave_1 entered promiscuous mode [ 1560.146751][ T8806] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1560.154622][ T8806] Cannot create hsr debugfs directory [ 1560.626287][ T8806] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1560.657169][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1560.666584][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1560.689998][ T8806] 8021q: adding VLAN 0 to HW filter on device team0 [ 1560.710250][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1560.719631][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1560.730203][ T8468] bridge0: port 1(bridge_slave_0) entered blocking state [ 1560.737759][ T8468] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1560.768695][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1560.778017][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1560.788534][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1560.797641][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 1560.805065][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1560.820859][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1560.841463][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1560.867837][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1560.877605][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1560.913655][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1560.923420][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1560.934529][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1560.944105][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1560.954111][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1560.972611][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1560.981944][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1561.006969][ T8806] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1561.048304][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1561.056929][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1561.084248][ T8806] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1561.202790][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1561.213188][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1561.261369][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1561.270679][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1561.288917][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1561.299959][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1561.317393][ T8806] device veth0_vlan entered promiscuous mode [ 1561.344962][ T8806] device veth1_vlan entered promiscuous mode [ 1561.410930][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1561.420612][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1561.445257][ T8806] device veth0_macvtap entered promiscuous mode [ 1561.465224][ T8806] device veth1_macvtap entered promiscuous mode [ 1561.503472][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1561.514440][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.524633][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1561.535625][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.545869][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1561.556601][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.566854][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1561.577744][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.588008][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1561.598657][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.611545][ T8806] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1561.620918][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1561.630722][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1561.640476][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1561.650429][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1561.682675][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1561.693426][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.703508][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1561.714086][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.724847][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1561.736300][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.746663][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1561.757304][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.767403][ T8806] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1561.778147][ T8806] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.790944][ T8806] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1561.800546][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1561.810944][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1562.159810][ T3545] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1562.167904][ T3545] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1562.232087][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1562.241867][ T4840] Bluetooth: hci4: command 0x041b tx timeout [ 1562.348700][ T1090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1562.357261][ T1090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1562.368785][ T4840] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1562.493752][ T9040] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1562.518266][ T9040] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1562.841251][ T9040] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:08 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xc00}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:08 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f000001c000)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x1, 0x0) faccessat(r0, &(0x7f0000000080)='./file0\x00', 0x2) 16:31:08 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='hugetlb.2MB.limit_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x40000000011, r0, 0x0) unshare(0x480) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000100)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) 16:31:08 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0xb8}, 0x10) 16:31:08 executing program 0: socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x29, 0x5, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x100000005, 0x0, &(0x7f0000000000)) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0x3, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) 16:31:08 executing program 3: r0 = socket$kcm(0xa, 0x5, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0xe9000) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8910, &(0x7f0000000000)) 16:31:09 executing program 3: mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0xf, 0x4086072, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffc000/0x3000)=nil) 16:31:09 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0xb8}, 0x10) [ 1563.446549][ T9063] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1563.510851][ T9063] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:09 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000100)="5500000018007fd500fe01b2a4a280930a06000000a843089100fe803900080008000c000f0000002d00fc009b7a136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd20652383656d4d24", 0x51}, {&(0x7f0000000180)="ff100000", 0x4}], 0x2}, 0x0) 16:31:09 executing program 2: r0 = socket$inet6(0xa, 0x802, 0x73) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r2) sendmmsg$inet6(r0, &(0x7f0000000a00)=[{{&(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=[@hopopts_2292={{0x18}}], 0x18}}], 0x1, 0x0) 16:31:09 executing program 0: socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x29, 0x5, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) socketpair(0x0, 0x100000005, 0x0, &(0x7f0000000000)) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0x3, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) [ 1563.876269][ T9063] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:09 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, 0x0, &(0x7f0000000500)) 16:31:10 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xd00}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:10 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0xb8}, 0x10) [ 1564.262759][ T16] Bluetooth: hci4: command 0x040f tx timeout 16:31:10 executing program 4: unshare(0x400) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x15, 0x8, 0x3, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, r0, 0x0, 0x3}, 0x40) 16:31:10 executing program 2: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000040)=0x8002) syz_open_dev$sndpcmp(&(0x7f0000000480)='/dev/snd/pcmC#D#p\x00', 0x0, 0x80445) 16:31:10 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x1f4, 0x0, 0x53) 16:31:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r2, &(0x7f0000000180)="f1", 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @rand_addr=0x7}, 0x10) shutdown(r2, 0x1) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)={0xe0000005}) epoll_wait(r1, &(0x7f0000000000)=[{}], 0x1, 0x0) 16:31:10 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0xb8}, 0x10) [ 1564.797069][ T9091] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1564.869114][ T9094] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:11 executing program 4: sendmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000002c0)="9eb25029b955037e1df8788f97b77846855dbbdd8586194df4fd850c8df65379822cb39ff3", 0x25}], 0x1}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000001c0), 0xc, &(0x7f00000006c0)={0x0, 0x410}}, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x20a}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/106, 0x2ce}, {&(0x7f0000000740)=""/73, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/22, 0xa}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) [ 1565.255291][ T9094] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:11 executing program 2: syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f00000013c0)=""/4089, 0xff9}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r1, &(0x7f00000017c0), 0x218, 0x5000000, 0x0) 16:31:11 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x1f4, 0x0, 0x53) 16:31:11 executing program 5: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001500)={0x2, 0x4, &(0x7f0000000040)=@framed={{}, [@alu={0x7, 0x1, 0xb, 0x0, 0x0, 0x0, 0x10}]}, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x40) 16:31:11 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xe00}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r2, &(0x7f0000000180)="f1", 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @rand_addr=0x7}, 0x10) shutdown(r2, 0x1) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)={0xe0000005}) epoll_wait(r1, &(0x7f0000000000)=[{}], 0x1, 0x0) [ 1566.165125][ T9130] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:12 executing program 4: sendmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000002c0)="9eb25029b955037e1df8788f97b77846855dbbdd8586194df4fd850c8df65379822cb39ff3", 0x25}], 0x1}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000001c0), 0xc, &(0x7f00000006c0)={0x0, 0x410}}, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x20a}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/106, 0x2ce}, {&(0x7f0000000740)=""/73, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/22, 0xa}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 16:31:12 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3b, &(0x7f0000000000)='/proc/sys/net/rpv4\x00\x00s/sync_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd11=\x11\xc8\xdd\x15\xcc\xd2\xf1d\'%\x11c\x91l,'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) [ 1566.232169][ T9131] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1566.342645][ T4840] Bluetooth: hci4: command 0x0419 tx timeout [ 1566.591474][ T9131] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:12 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x1f4, 0x0, 0x53) 16:31:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r2, &(0x7f0000000180)="f1", 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @rand_addr=0x7}, 0x10) shutdown(r2, 0x1) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)={0xe0000005}) epoll_wait(r1, &(0x7f0000000000)=[{}], 0x1, 0x0) 16:31:12 executing program 5: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000080)={0x0, @in={{0x2, 0x0, @multicast1}}, 0x0, 0x0, 0x6}, 0x98) 16:31:12 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0xf00}}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:12 executing program 4: sendmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000002c0)="9eb25029b955037e1df8788f97b77846855dbbdd8586194df4fd850c8df65379822cb39ff3", 0x25}], 0x1}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000001c0), 0xc, &(0x7f00000006c0)={0x0, 0x410}}, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x20a}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/106, 0x2ce}, {&(0x7f0000000740)=""/73, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/22, 0xa}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) [ 1567.370240][ T9160] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1567.440893][ T9168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:13 executing program 2: syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f00000013c0)=""/4089, 0xff9}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r1, &(0x7f00000017c0), 0x218, 0x5000000, 0x0) 16:31:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r2, &(0x7f0000000180)="f1", 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @rand_addr=0x7}, 0x10) shutdown(r2, 0x1) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)={0xe0000005}) epoll_wait(r1, &(0x7f0000000000)=[{}], 0x1, 0x0) 16:31:13 executing program 5: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet_dccp(0x2, 0x6, 0x0) r2 = dup2(r0, r1) setsockopt(r1, 0x10d, 0x800000000e, &(0x7f00001c9fff)="03", 0x1) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r0, 0x40002) r3 = socket$inet_dccp(0x2, 0x6, 0x0) accept4$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10, 0x0) connect$inet(r3, &(0x7f0000000340)={0x2, 0x4e23, @empty=0x1700000000000000}, 0x10) 16:31:13 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x1f4, 0x0, 0x53) [ 1567.828956][ T9168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:14 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x2, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:14 executing program 4: sendmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000002c0)="9eb25029b955037e1df8788f97b77846855dbbdd8586194df4fd850c8df65379822cb39ff3", 0x25}], 0x1}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000001c0), 0xc, &(0x7f00000006c0)={0x0, 0x410}}, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x20a}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/106, 0x2ce}, {&(0x7f0000000740)=""/73, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/22, 0xa}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 16:31:14 executing program 0: r0 = openat$kvm(0xffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x14, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc004ae0a, &(0x7f0000000000)=""/193) 16:31:14 executing program 5: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet_dccp(0x2, 0x6, 0x0) r2 = dup2(r0, r1) setsockopt(r1, 0x10d, 0x800000000e, &(0x7f00001c9fff)="03", 0x1) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r0, 0x40002) r3 = socket$inet_dccp(0x2, 0x6, 0x0) accept4$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10, 0x0) connect$inet(r3, &(0x7f0000000340)={0x2, 0x4e23, @empty=0x1700000000000000}, 0x10) [ 1568.744272][ T9188] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1568.797743][ T9188] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1569.169161][ T9188] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040)='ethtool\x00') sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, r1, 0x901}, 0x14}}, 0x0) 16:31:15 executing program 3: r0 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) connect$nfc_raw(r0, &(0x7f0000000080)={0x27, 0x200001}, 0x10) 16:31:15 executing program 4: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4) connect$inet6(r0, &(0x7f0000004540)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000)=0x3, 0x4) sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}, 0x10}], 0x1, 0x400b80b) 16:31:15 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x3, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:15 executing program 2: syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f00000013c0)=""/4089, 0xff9}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r1, &(0x7f00000017c0), 0x218, 0x5000000, 0x0) 16:31:15 executing program 5: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet_dccp(0x2, 0x6, 0x0) r2 = dup2(r0, r1) setsockopt(r1, 0x10d, 0x800000000e, &(0x7f00001c9fff)="03", 0x1) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r0, 0x40002) r3 = socket$inet_dccp(0x2, 0x6, 0x0) accept4$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10, 0x0) connect$inet(r3, &(0x7f0000000340)={0x2, 0x4e23, @empty=0x1700000000000000}, 0x10) 16:31:15 executing program 3: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000004d00)='/dev/vim2m\x00', 0x2, 0x0) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000140)={0x0, 0x0, 0x0, {0x0, @sliced}}) 16:31:15 executing program 0: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vim2m\x00', 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000001980)={0x9, 0x2, 0x2}) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(r0, 0xc044560f, &(0x7f0000000100)={0x0, 0x2, 0x4, 0xe7ffffff, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "7aa65ae7"}, 0x0, 0x2, @userptr, 0x4, 0x0, r1}) [ 1569.912448][ T9208] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1569.937282][ T9208] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:15 executing program 4: syz_emit_ethernet(0x22, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x6c, 0x0, @empty, @multicast1}}}}}, 0x0) [ 1570.308316][ T9208] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:16 executing program 5: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet_dccp(0x2, 0x6, 0x0) r2 = dup2(r0, r1) setsockopt(r1, 0x10d, 0x800000000e, &(0x7f00001c9fff)="03", 0x1) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r0, 0x40002) r3 = socket$inet_dccp(0x2, 0x6, 0x0) accept4$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10, 0x0) connect$inet(r3, &(0x7f0000000340)={0x2, 0x4e23, @empty=0x1700000000000000}, 0x10) 16:31:16 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x4, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x10, 0x0, &(0x7f0000000140)) 16:31:16 executing program 4: syz_emit_ethernet(0x22, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x6c, 0x0, @empty, @multicast1}}}}}, 0x0) 16:31:16 executing program 0: r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x100, 0x0, 0x0, 0x0, 0xffff}) [ 1570.900318][ T9227] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1570.967324][ T9229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:17 executing program 4: syz_emit_ethernet(0x22, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x6c, 0x0, @empty, @multicast1}}}}}, 0x0) 16:31:17 executing program 0: r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x100, 0x0, 0x0, 0x0, 0xffff}) 16:31:17 executing program 2: syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f00000013c0)=""/4089, 0xff9}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r1, &(0x7f00000017c0), 0x218, 0x5000000, 0x0) 16:31:17 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x20141042, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000022c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x4d8, 0x32c, 0x17c, 0x17c, 0x32c, 0x5, 0x410, 0x260, 0x260, 0x410, 0x260, 0x3, 0x0, {[{{@uncond=[0x0, 0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x49, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0x30c, 0x32c, 0x52020000, {}, [@common=@unspec=@bpf1={{0x230, 'bpf\x00'}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}, @common=@unspec=@statistic={{0x38, 'statistic\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@ipv6={@mcast2, @empty, [], [], 'ip6tnl0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa4, 0xe4}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00'}}], {{[], 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x534) [ 1571.661190][ T9240] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:17 executing program 4: syz_emit_ethernet(0x22, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x6c, 0x0, @empty, @multicast1}}}}}, 0x0) 16:31:18 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x580, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @loopback}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000140)=0x8, 0x4) recvmsg(r0, &(0x7f00000000c0)={0x0, 0x3d8, 0x0, 0x0, &(0x7f0000000040)=""/36, 0x24}, 0x2000) 16:31:18 executing program 0: r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x100, 0x0, 0x0, 0x0, 0xffff}) 16:31:18 executing program 5: r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000002940)={&(0x7f0000000040)=@newtaction={0x74, 0x30, 0x53b, 0x0, 0x0, {}, [{0x60, 0x1, [@m_vlan={0x5c, 0x1, 0x0, 0x0, {{0x9, 0x1, 'vlan\x00'}, {0x30, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{}, 0x3}}, @TCA_VLAN_PUSH_VLAN_ID={0x6}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) [ 1573.277526][ T3511] tipc: TX() has been purged, node left! [ 1575.759752][ T3511] device hsr_slave_0 left promiscuous mode [ 1575.774754][ T3511] device hsr_slave_1 left promiscuous mode [ 1575.786148][ T3511] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1575.794665][ T3511] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1575.807972][ T3511] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1575.816330][ T3511] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1575.828385][ T3511] device bridge_slave_1 left promiscuous mode [ 1575.836289][ T3511] bridge0: port 2(bridge_slave_1) entered disabled state [ 1575.859271][ T3511] device bridge_slave_0 left promiscuous mode [ 1575.866268][ T3511] bridge0: port 1(bridge_slave_0) entered disabled state [ 1575.892137][ T3511] device veth1_macvtap left promiscuous mode [ 1575.898234][ T3511] device veth0_macvtap left promiscuous mode [ 1575.904924][ T3511] device veth1_vlan left promiscuous mode [ 1575.910790][ T3511] device veth0_vlan left promiscuous mode [ 1579.942517][ T8467] Bluetooth: hci4: command 0x0409 tx timeout [ 1580.661922][ T3511] team0 (unregistering): Port device team_slave_1 removed [ 1580.681075][ T3511] team0 (unregistering): Port device team_slave_0 removed [ 1580.704186][ T3511] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1580.725515][ T3511] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1580.810296][ T3511] bond0 (unregistering): Released all slaves [ 1580.886181][ T9291] IPVS: ftp: loaded support on port[0] = 21 [ 1580.906572][ T9291] lo speed is unknown, defaulting to 1000 [ 1581.118455][ T9291] chnl_net:caif_netlink_parms(): no params data found [ 1581.315844][ T9291] bridge0: port 1(bridge_slave_0) entered blocking state [ 1581.323867][ T9291] bridge0: port 1(bridge_slave_0) entered disabled state [ 1581.333400][ T9291] device bridge_slave_0 entered promiscuous mode [ 1581.386196][ T9291] bridge0: port 2(bridge_slave_1) entered blocking state [ 1581.394267][ T9291] bridge0: port 2(bridge_slave_1) entered disabled state [ 1581.404636][ T9291] device bridge_slave_1 entered promiscuous mode [ 1581.501042][ T9291] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1581.522308][ T9291] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1581.594111][ T9291] team0: Port device team_slave_0 added [ 1581.614701][ T9291] team0: Port device team_slave_1 added [ 1581.678699][ T9291] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1581.686322][ T9291] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1581.712601][ T9291] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1581.730637][ T9291] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1581.738386][ T9291] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1581.765086][ T9291] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1581.840693][ T9291] device hsr_slave_0 entered promiscuous mode [ 1581.853111][ T9291] device hsr_slave_1 entered promiscuous mode [ 1581.862816][ T9291] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1581.870423][ T9291] Cannot create hsr debugfs directory [ 1582.032656][ T5] Bluetooth: hci4: command 0x041b tx timeout [ 1582.248755][ T9291] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1582.278496][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1582.288635][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1582.309808][ T9291] 8021q: adding VLAN 0 to HW filter on device team0 [ 1582.330553][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1582.340370][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1582.350639][ T16] bridge0: port 1(bridge_slave_0) entered blocking state [ 1582.358088][ T16] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1582.387584][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1582.397807][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1582.407903][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1582.417937][ T16] bridge0: port 2(bridge_slave_1) entered blocking state [ 1582.425561][ T16] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1582.434336][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1582.457027][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1582.496074][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1582.506444][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1582.517146][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1582.527910][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1582.540728][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1582.560533][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1582.570699][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1582.601231][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1582.611278][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1582.633900][ T9291] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1582.680089][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1582.689036][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1582.729245][ T9291] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1582.845334][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1582.855698][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1582.909312][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1582.919410][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1582.931552][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1582.940714][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1582.963928][ T9291] device veth0_vlan entered promiscuous mode [ 1582.990964][ T9291] device veth1_vlan entered promiscuous mode [ 1583.050036][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1583.059817][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1583.082904][ T9291] device veth0_macvtap entered promiscuous mode [ 1583.104224][ T9291] device veth1_macvtap entered promiscuous mode [ 1583.149449][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1583.161019][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.173946][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1583.184933][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.195349][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1583.206147][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.216354][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1583.227054][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.237314][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1583.248152][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.260876][ T9291] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1583.271132][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1583.280678][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1583.290690][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1583.300863][ T8469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1583.321307][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1583.332248][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.342700][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1583.353441][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.363700][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1583.374428][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.384522][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1583.395179][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.405276][ T9291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1583.416043][ T9291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1583.428543][ T9291] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1583.438718][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1583.448691][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1583.977183][ T3511] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1583.985253][ T3511] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1583.993217][ T2976] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1584.119684][ T5] Bluetooth: hci4: command 0x040f tx timeout [ 1584.220624][ T624] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1584.229195][ T624] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1584.242096][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1584.419835][ T9536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1584.458130][ T9536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:30 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x5, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:30 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a80)=ANY=[@ANYBLOB="5001000010000307ebfff40606c6000040041200", @ANYRES32=0x0, @ANYBLOB="00fffbffff00000008000a000d000000250012000800010076657468"], 0x200}}, 0x0) r0 = socket(0x10, 0x800000000080002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x6815, 0xd2efff7f00000000, &(0x7f0000000100), 0xa, &(0x7f0000000100)}], 0x492492492492a3e, 0x0) socket(0x2, 0x3, 0x100000001) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) pipe(&(0x7f0000000240)) 16:31:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r2, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180)='nl80211\x00') sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) 16:31:30 executing program 2: syz_mount_image$udf(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='bpf\x00', 0x10450, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='mounts\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000400)=""/126, 0x7e}], 0x1, 0xffffffff, 0x0) 16:31:30 executing program 0: r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x100, 0x0, 0x0, 0x0, 0xffff}) 16:31:30 executing program 5: syz_emit_ethernet(0x4e, &(0x7f0000000000)={@multicast, @random="572d3d5b09fa", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f2f2f1", 0x18, 0x3a, 0xff, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2]}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x26, 0x1, "a78c000004ff"}]}}}}}}, 0x0) [ 1584.776488][ T9536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1585.095663][ T9548] netlink: 256 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1585.106217][ T9548] netlink: 25 bytes leftover after parsing attributes in process `syz-executor.3'. 16:31:31 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xf, 0x4, 0x4, 0x3}, 0x40) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000000c0)={'veth1\x00', &(0x7f0000000200)=ANY=[@ANYRES32]}) bpf$BPF_GET_MAP_INFO(0x2, &(0x7f00000000c0)={r0, 0x28, &(0x7f00000003c0)}, 0x30) [ 1585.271855][ T9548] bridge0: port 3(veth9) entered blocking state [ 1585.279238][ T9548] bridge0: port 3(veth9) entered disabled state [ 1585.310305][ T9548] device veth9 entered promiscuous mode 16:31:31 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000080)={0x0, 0x0, 0x37}) 16:31:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000)='batadv\x00') ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x1c, r2, 0x331, 0x0, 0x0, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) [ 1585.549722][ T9560] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1585.610351][ T9561] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:31 executing program 0: prctl$PR_MCE_KILL(0x21, 0x0, 0x0) [ 1585.788673][ T9552] netlink: 256 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1585.798590][ T9552] netlink: 25 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1585.826007][ T9552] bridge0: port 4(veth11) entered blocking state [ 1585.832727][ T9552] bridge0: port 4(veth11) entered disabled state 16:31:31 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000300), 0x6) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000500)) [ 1585.937969][ T9552] device veth11 entered promiscuous mode [ 1586.007974][ T9560] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:32 executing program 4: syz_mount_image$tmpfs(&(0x7f0000000040)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={[{@mpol={'mpol', 0x3d, {'interleave', '', @void}}}, {@mpol={'mpol', 0x3d, {'local', '', @void}}}]}) [ 1586.193095][ T2976] Bluetooth: hci4: command 0x0419 tx timeout 16:31:32 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x6, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:32 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a80)=ANY=[@ANYBLOB="5001000010000307ebfff40606c6000040041200", @ANYRES32=0x0, @ANYBLOB="00fffbffff00000008000a000d000000250012000800010076657468"], 0x200}}, 0x0) r0 = socket(0x10, 0x800000000080002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x6815, 0xd2efff7f00000000, &(0x7f0000000100), 0xa, &(0x7f0000000100)}], 0x492492492492a3e, 0x0) socket(0x2, 0x3, 0x100000001) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) pipe(&(0x7f0000000240)) 16:31:32 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40104593, &(0x7f0000000040)={0x0, 0x0, 0x0, {0x4}, {}, @rumble}) 16:31:32 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000080)={0x0, 0x0, 0x37}) 16:31:32 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000300), 0x6) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000500)) [ 1586.712472][ T9589] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1586.780745][ T9591] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:32 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40104593, &(0x7f0000000040)={0x0, 0x0, 0x0, {0x4}, {}, @rumble}) [ 1586.942332][ T9594] netlink: 256 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1586.952590][ T9594] netlink: 25 bytes leftover after parsing attributes in process `syz-executor.3'. 16:31:32 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{}]}, 0x10) getsockopt$packet_int(r0, 0x107, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4) 16:31:32 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000080)={0x0, 0x0, 0x37}) [ 1587.205144][ T9589] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:33 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000300), 0x6) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000500)) [ 1587.541439][ T9594] bridge0: port 5(veth13) entered blocking state [ 1587.549151][ T9594] bridge0: port 5(veth13) entered disabled state [ 1587.576313][ T9594] device veth13 entered promiscuous mode 16:31:33 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40104593, &(0x7f0000000040)={0x0, 0x0, 0x0, {0x4}, {}, @rumble}) 16:31:33 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x0, 'pids'}]}, 0x6) write$cgroup_subtree(r0, &(0x7f0000000000)={[{0x0, 'cpu'}]}, 0x5) perf_event_open$cgroup(&(0x7f0000000580)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc028660f, &(0x7f00000005c0)=0x400000000) 16:31:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000080)={0x0, 0x0, 0x37}) 16:31:33 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x7, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a80)=ANY=[@ANYBLOB="5001000010000307ebfff40606c6000040041200", @ANYRES32=0x0, @ANYBLOB="00fffbffff00000008000a000d000000250012000800010076657468"], 0x200}}, 0x0) r0 = socket(0x10, 0x800000000080002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x6815, 0xd2efff7f00000000, &(0x7f0000000100), 0xa, &(0x7f0000000100)}], 0x492492492492a3e, 0x0) socket(0x2, 0x3, 0x100000001) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) pipe(&(0x7f0000000240)) 16:31:34 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000300), 0x6) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000500)) [ 1588.328013][ T9625] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1588.390439][ T9626] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22}, 0x10) listen(r0, 0xffd7) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @random="ccc1dc056b1b", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @remote={0xac, 0x28}, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x7, 0x2, 0x0, 0x0, 0x0, {[@exp_fastopen={0xfe, 0x5, 0xf989, "1c"}]}}}}}}}, 0x0) 16:31:34 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40104593, &(0x7f0000000040)={0x0, 0x0, 0x0, {0x4}, {}, @rumble}) 16:31:34 executing program 4: r0 = openat$ttyS3(0xffffff9c, &(0x7f0000000140)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541e, &(0x7f0000000180)) [ 1588.766764][ T9626] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:34 executing program 5: unshare(0x6c060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000080)={'security\x00', 0x0, [0x6300]}, &(0x7f0000000100)=0x54) [ 1588.853035][ T9636] netlink: 256 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1588.863042][ T9636] netlink: 25 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1589.014377][ T9636] bridge0: port 6(veth15) entered blocking state [ 1589.022055][ T9636] bridge0: port 6(veth15) entered disabled state [ 1589.051805][ T9636] device veth15 entered promiscuous mode 16:31:35 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, &(0x7f00000000c0)={0x0, 0x1}) 16:31:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x8, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a80)=ANY=[@ANYBLOB="5001000010000307ebfff40606c6000040041200", @ANYRES32=0x0, @ANYBLOB="00fffbffff00000008000a000d000000250012000800010076657468"], 0x200}}, 0x0) r0 = socket(0x10, 0x800000000080002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x6815, 0xd2efff7f00000000, &(0x7f0000000100), 0xa, &(0x7f0000000100)}], 0x492492492492a3e, 0x0) socket(0x2, 0x3, 0x100000001) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) pipe(&(0x7f0000000240)) 16:31:35 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000019140)={&(0x7f0000019340)=@newlink={0x50, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_MODE={0x8}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x50}}, 0x0) [ 1589.420501][ T9649] IPVS: ftp: loaded support on port[0] = 21 16:31:35 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x40001) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="0b874634240000004a881d1cc9c698e7c7348147d1b0198165c4448a737090de6d2953efd130c8ca5025843bbcad6ddf", 0x30}, {&(0x7f0000000200)="53000000b74d76d42fdb6d84ad966df4e9628f83a430eef36b015ff49b14cb1b37c1ae7ebbea2c0b058bde75a808fc38e6d6605b5adc52271915b7c6b0b7d5601b6a847152ed5516d913bcd849af1f6594fbaed68fecbb87", 0x58}], 0x2) [ 1589.649166][ T9649] lo speed is unknown, defaulting to 1000 [ 1589.905188][ T9677] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1589.973726][ T9681] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1589.988795][ T9683] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1590.025866][ T9682] netlink: 256 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1590.036578][ T9682] netlink: 25 bytes leftover after parsing attributes in process `syz-executor.3'. 16:31:36 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x3}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 16:31:36 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000019140)={&(0x7f0000019340)=@newlink={0x50, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_MODE={0x8}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x50}}, 0x0) 16:31:36 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x7fe, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x7fe, 0x4) [ 1590.621807][ T9682] bridge0: port 7(veth17) entered blocking state [ 1590.629491][ T9682] bridge0: port 7(veth17) entered disabled state [ 1590.660960][ T9682] device veth17 entered promiscuous mode [ 1590.767399][ T9697] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 16:31:36 executing program 2: r0 = syz_open_dev$dmmidi(&(0x7f0000001cc0)='/dev/dmmidi#\x00', 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x80045700, 0x0) 16:31:36 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x9, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:36 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000019140)={&(0x7f0000019340)=@newlink={0x50, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_MODE={0x8}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x50}}, 0x0) [ 1591.484900][ T9706] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1591.522177][ T9707] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1591.547813][ T9708] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1591.925678][ T9706] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:38 executing program 5: unshare(0x6c060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000080)={'security\x00', 0x0, [0x6300]}, &(0x7f0000000100)=0x54) 16:31:38 executing program 0: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendmsg$sock(r0, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@mark={{0x10}}, @txtime={{0x14, 0x1, 0x2}}], 0x24}, 0x0) 16:31:38 executing program 2: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002"], &(0x7f0000004600)=""/200, 0x3e, 0xc8, 0x8}, 0x20) 16:31:38 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x1a7610}], 0x1) 16:31:38 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000019140)={&(0x7f0000019340)=@newlink={0x50, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_MODE={0x8}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x50}}, 0x0) 16:31:38 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0xa, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1592.360545][ T624] tipc: TX() has been purged, node left! 16:31:38 executing program 2: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002"], &(0x7f0000004600)=""/200, 0x3e, 0xc8, 0x8}, 0x20) [ 1592.608451][ T9721] BPF:[1] Invalid kind:0 [ 1592.620952][ T9723] BPF:[1] Invalid kind:0 [ 1592.665001][ T9725] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1592.666356][ T9724] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1592.753501][ T9727] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1592.793185][ T9729] IPVS: ftp: loaded support on port[0] = 21 16:31:38 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x7}, 0x8) close(r0) [ 1593.085421][ T9729] lo speed is unknown, defaulting to 1000 [ 1593.250696][ T9739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1593.269490][ T9741] BPF:[1] Invalid kind:0 16:31:39 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x1a7610}], 0x1) 16:31:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x1a7610}], 0x1) 16:31:39 executing program 2: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002"], &(0x7f0000004600)=""/200, 0x3e, 0xc8, 0x8}, 0x20) 16:31:39 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0xb, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1594.225169][ T9767] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1594.315407][ T9768] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1594.317403][ T9769] BPF:[1] Invalid kind:0 [ 1594.719939][ T9767] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1595.554078][ T624] tipc: TX() has been purged, node left! 16:31:41 executing program 5: unshare(0x6c060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000080)={'security\x00', 0x0, [0x6300]}, &(0x7f0000000100)=0x54) 16:31:41 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74) 16:31:41 executing program 2: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002"], &(0x7f0000004600)=""/200, 0x3e, 0xc8, 0x8}, 0x20) 16:31:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x1a7610}], 0x1) 16:31:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x1a7610}], 0x1) 16:31:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0xc, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1595.842155][ T9781] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1595.844019][ T9782] BPF:[1] Invalid kind:0 16:31:41 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507040000000000000000000010", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001400)=ANY=[@ANYBLOB="380000002400070500ee304f7c00000000a2a300", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x48, 0x28, 0x417, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x0, 0xffffffff}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9, 0x1, 'veth\x00'}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x2}}}}}}]}, 0x48}}, 0x0) [ 1595.947683][ T9787] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1596.257997][ T9793] IPVS: ftp: loaded support on port[0] = 21 [ 1596.355330][ T9787] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:42 executing program 0: clone(0x4412c504, 0x0, 0x0, 0x0, 0x0) [ 1596.415616][ T9796] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1596.557284][ T9793] lo speed is unknown, defaulting to 1000 16:31:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x1a7610}], 0x1) [ 1596.677819][ T9822] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 16:31:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x1a7610}], 0x1) 16:31:42 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0xd, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1597.004876][ T9825] IPVS: ftp: loaded support on port[0] = 21 16:31:43 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, 0x0, &(0x7f0000000680)) [ 1597.156673][ T9825] lo speed is unknown, defaulting to 1000 [ 1597.679512][ T9842] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1597.704526][ T9849] IPVS: ftp: loaded support on port[0] = 21 [ 1597.737098][ T9855] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1597.855645][ T9849] lo speed is unknown, defaulting to 1000 [ 1598.143278][ T9842] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1599.199833][ T624] tipc: TX() has been purged, node left! 16:31:45 executing program 5: unshare(0x6c060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000080)={'security\x00', 0x0, [0x6300]}, &(0x7f0000000100)=0x54) 16:31:45 executing program 0: syz_emit_ethernet(0x52, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "001700", 0x1c, 0x2c, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}, @local, {[@fragment={0x6, 0x0, 0x0, 0x1}], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 16:31:45 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000400)={0x1c, r1, 0x209, 0x0, 0x0, {}, [@FOU_ATTR_IFINDEX={0x8}]}, 0x1c}}, 0x0) 16:31:45 executing program 3: r0 = epoll_create1(0x0) r1 = openat$uinput(0xffffff9c, &(0x7f0000000540)='/dev/uinput\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000200)) 16:31:45 executing program 4: mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080)='/dev/fuse\x00', 0x42, 0x0) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002100)='fuse\x00', 0x0, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) setxattr$trusted_overlay_redirect(&(0x7f0000000100)='./file0/../file0/file0\x00', 0x0, 0x0, 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000000000)={0x50, 0x0, r1}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000004340)="9eda438838743bd4e9720bee57093515dc189a5ea685e9556c1c2c3cfc4df50d66d31a48aa312663b68d18c5826b5b55fb738208863dac0f10f423aee7a5d8ddc45ebdfeb7424bae859d7c37ecfc4b63914d5a56d91017dd22bc84f759a15969951aef9d5c88c96560896988fa18cd946cfcc3a0f1c993348377904eac32c980bdf7976ebca2b499cab63c4e841514277fc71d4620e29a92523402485de0e82896484c0ae497a4d686df23ca7b68c3fd5e624d3510d7f94838e54af877ca58a00c5a672bba11f5aa1ed1980dfef47b9973d0bf456ded5e72f1702b3dc5197fce39cba53a038d8dc0ec783ce70577107dc5e8b299e64a0b7f1191f0926bd25762370191710bab2f44e9069f55f8a3f87e4cb488a2fb3348c0bf3b3874291f83e4776b160ea73aafa3919c7c069c73c0052173a63158db8b65541d161f9c964926ad7f06bdd6cb6a32135b04e35701c2e13c49c1f75dc7a25d623378860692d172ec3f1e1f2d9dc77c015c13721efcb101c2390abb847e871132f472a37cc0163b39b1d575a5444e246a08a1afb1a696cabab29498a314429a3b9f44c43ba29f71fac1fbe0d01c3c16d22730932704bcfb0c1b7a432bc51dd3f5dd5afc3b342cbe6a6ff899039e28f9a51881b1d46fdcf31767cb6f5c5c69ab3c80615d77c4d1664fc4ec831b8cea2e752bbb7a9ce79df875b29f1e232751daf32a1a0c4ff8bd0688e2b8e2d668b8a77e20a9eb6ec2e2c23b94e507baeacbcfa31fb6e1ca3343668f43e3aa6d85e7c29bf0bb4dbdabddc92be7f4a6f5d21b19e6da17bfb6cc926e3847532fae29c7b62fb909130ec372d3c16cfe6aaf3ce2af0fe7610fde7aad61bc80d2f96b999c8ccf6d22cf903ca8ae8b879ec4a416f334982e9810c0140a18d4dc81b5edaae23e9f4abaf40ed71512aebbba5bb251545e188db789558a845a2877b14bdaeec3c738b7d730c0860531bf5517d4f0e8f95ed3571f8a35816d5116fcb8d7cbf42b7d5d5e65541508c898bb2e0fe96297d2ab7135662de39df099ebaed5871111f5346278cee5728cec512e6c0a0d65b51e3d627873195b84103341c2bc83b6c8fdd8ba17f5957413f61c69d618c9b9d0b1f08dc81921b6c662ee1da3bfa019b095e9a03c2db4d645ccb7364e895098cbf7d932c72d80663c7a1694d122f7348393079223c11d36c64a5856eae0397ab9a9d948204b74e56525a9d552dd0916de81cbb5af3c59b3d7f8f9154423ce2cb45a5bc808e24bef13212019a19545fe54ba84d01534358380192b8c7b0eda907810375bb66a578a58fec392b47991271c8367b91d710e8a176bc1a4e96f0e137d4c25fbb03eddc392f9f170dd744472b864fbbae7c93d86e682308b21b73c5652065d72cf02e1152b44024a90a3b52eb0bb3cb412e518d37a68aa4c7f46789c54ab30d3a73d0a8712fde612294cda2aa1ccf164930b9b1d17801d4fbb06e849d39bf2b5141330caa0d2618b616f1c67e1ca57080e79ed9092ba7a55e8121cfc825cd26a0199a479a7ab1b7b23d2a4dd82fa6d04ee41ca680435efc934f0451e865e8632ac2f1115f4cdd33b0fccb7a2326127faf20cba37c828613dba5a98f4e1ad25eb6b91078cf73d873df9ef91531476f64b83559ff7ccdc4c070d478b18196ea05fe8d4ea0216ee5273dfabbd04582f40f064c9781afd2cbf30901f28cd09cc934f1b2d50883778274177e3dba8af0a1b931d80ce1a6c4085780ea2195b65ecfd2953f78a5290fe560d0cd6a5e73890a5a82dc410b92a3ef2be05ec5607820fd4ca6b9c3aa258d59022fdcb21665f1ce4e8aad8fd918c43bd3c2afe3dc223ff9f48831d401c8b6996190793d1dd7551f8511b69283992398d8f9b4bd2b3398d3b8c6f3c5d8b802ca5282b70242df2b7be4b38e70c3065f8da888631375afcc05ce578089c4f783776b286b7a60d1b5e189e2742a3240c1036a953d886885422eef01413c38099b64505fd5a73488acb4e611820674c58ae74d6c64a885d4beda9bd7903bcdc71e3711e2a057c0eab2100c321050ab14c6e453c53182577ad3178603cd9afde40a701120e9a36074fd582428c74e02781318e6c65450f8f020bd22475696fe13b8c59260e53a06d16eabd135e887a0a6bbc8ad21be7661df76fec5b13844f68b8eed1a7379713738beac9f23c7a26520e19797a910cde9fb285179526889b908b7eb49bb06f70f6271fba8712c1a4269ebcf4b7d043e924e3d2c4c753fd7e547d95841e335179836f76424e728810d7f32b78256ea30c79d9238a6588426e1f2d4c0b03d5605bd826ed24f0f11326b4cf958632b86e017aa80e142db1580c44f76d9c98196f3f6852ab2bfc6a01a3553a130c2d171957f5a45c3550fbbc990ef8742a98a86b280a57b9f198ff436bc01161ada50e6f23026c3254adf2321bff7e20aa54080bbb57d8d52c6a6df6107706a2e5bc6da68f17b474c0edd39401d765086e885cf7992405f856557915603cbe8894676e996bbadbb649a5e7498b91f9bd2f697dd9ebbe4d386050258b9f4c94781e61c660651c3f1e3ae51f8c035eca365bf15d6db48ea9ce183515f4a208d010f7c23dcacbd6e225490d7e9c133525f5c9018d752b21b4897bf18b64b6a9936f538a0a8958fc934440aeeaad2b68ac844d76f0900a6c95bd0b353d85d4fb62eb88360112237fd8c636a80e3130b21d66ae8ec58a4b76cba0602f96da919f7e84fd37e3ec2379f58e389a39c78d2482e03c379e3c4649ad63a76e3707ecff07d2fcb0c9dfc524cab49e69a09c92e4f88714335cb57d3f6184d07bef9657280fb5c9fd2d8f940f7ac6c5407e3077aa2e4ba8e217e0ee19e302d6d90e3be05a86dade35d2e454e511afb5cf5936f1d11f2fa6be6ceaa817dbdc7a6aabf2fad8ff3efa8382a25099f0c5989d2ad56ae0f4968b2cfcfc67b4f1c161c75900b4848f59a3c0376dfcb7997bf28e9e85d6dd942a360516de38e1c1a038a796f9a77ff2b0c7e5e8f4932391a0e58e76dacc6f9764178a211dfde3e75d367d2911ff398126ffdf83cf2fbdf1ad5232bed9155f7a168638a572094a9e934d4969b358cf6e121d7fd2aeae2f499068b42c152f0e3403a230885d6f92f038ddaa23499f804ffb06abdbabb51f6c38c92fb1a6271a4b13d6d11125b8ec12efa5907dc65062797fb9cca15e2f254e76b182d3fcdb4e96ac4de36d6df7e7bba5c32f422286b1be3b79bffb6fd693761952d195a84ad9ceb07287a0fbefab9e0347b513c5f60233ccd4b52d90ec144a2f896d9dc7f279f8aa93038f3efa286e1c3006933a4d7183d952f8d28b141b28b2af355b5bd8198dfde1ffb8d09202aff0d16ca3fec194662892a49f829813970a4520f1228aa03d211a45bed3b2e05bf1f10b1a152761e7b6c6ddea863a3c02224256092c70ca70dc185c4c385dd98b09e2682661e1e66f71d9c4037048eb70e8a1cbe57de87ec43713abf5fdcf63b9c482f318e3bec37e878dadbae15a02d731e6c8574eb14c059d72f73be5174add786d06b585a28a06d349d8e434a491b34897b3c1ad786ec8280d7f57edd4fbc6aea5485d659b59d393e331cf91e6ed76f340fcf7cf460892fa7318fc42b883f61d888ad982a751accb613c66661fba5f3d6de751a6a9ef8a4700316aaad04e991aab7903f4ef012ec2a8c092234e74ef335daf360ae47bbd2bbc6ad8c1a4f81efe8bbd703cb55ef36b32b4e30cb5a3b165c02ba295d0e1c40ce6ff8f479a74f01275f113ebfa8ade37a59ce70e6ca2a6f48f1be085f61bf772e2c2da523a2cfe63e99c57bdb1ff23139d4fca49eff7547e9880eefd3f7511a677efa23b52098ba89037c48dfcda2e8c1cfb9f892161049e53f8cee55256279512aecab8c441600dae0fd957883273047cf5c66ba209f830aa2ce0cbe41ca08c0cef4aed7f4324009200661a7ce680e5a8df2d051c1d8b2f63d25d8d74d05c75c46c8f3f24d625539e63459650960498a54ec3b16225bbbf4d3930009df265839d72611f5332a904cdebada108236e4414a2909ad01ec44b9d7f75de4385ad7ca5152e890a0919b3639fd1bcbca3b737ebb8d9ae541b1271cf2166ba15830e66f3d3afd3b754a7f81ad4f0999704ae99c114907c5be4a4797f13b80564f234723a34dbe137dabfd7fa23562df679f54a6ab54def6d63deae9844f72fd73efd0413551f5c4b9ee826eb3b7faf92a59ea34a16723b4fea14d1c8815a4e2d39fc48d1dbce526a7c53f5a96d0ef6463a0cee73fd3505f5c764a264b83c4a21f80e8b61c82d24442d13da99d18dc1b2538e7a510f6093d9ef2bc5cc777d4f98411e93919eddfd69d6e20d227cb61c50f358ea227f4de941fb080c1cf6b1f6e25533768fe133dbfc3f9d29c603bed38aa3c5af5b81a706b0067b40b88f992610d04c7cc36b8f649697cd6a93fae51138161891ae75a7147780fc59af5a6e18c54f9d2a4fe7fa92314b399afba9a40d0cc24f70a2593acf8d179215e06b7a9a88224bafcb2cbf60caf5fe4ff38208a70793b5dc33cd572956260e1c86312d3ba9b3a4b2b44376f2e78c616a6c0880ac8dcbaa30b9f761d500fd03a8518dd0509157b184a2d95e0caf3ffc8ac2db6c54d80c71a1e5b9ea3bf51071e2118af204123daceeb04e4f6f31f32a4d3fbb76ee49440cabda2c121c1b99acab5b87cecc37c3f9066af34ab29d6598bbfd91047a2ac7ce3a8f3027ff5e6d743506f161087278896a98ed37122ba208b61cf54d3929555ab06b564cd5e4f46f4755a6cfa2ef2b30d29ea66f2749d4060d411fa9160c91b6f55cf071ac8222c6313df18759e2958cddfe3db4cbeb9cd39abcf5f0beaecae8437813995cb7ed0b87d42ca942ff7245ece204798d01361c5f008e0d82bdf76660515bc78f7f8f409ccf68614b2cb50f5af2615661326fd971bc57eeeade60ea906b8df1cb0dfafd318cd2c396309c329d0469ca192aa8f51d7c4227685440f073983255baf054b97b9d7be1d1470d7eabd5c09b2116b4e86b0567b7e97e088717a4fe3dbdd310a1c39136ea4d2c47492001f9885dba03bf97e7da376171d666441cdc2f999db137603d57df32b4260fa0165e82917bb1631ea314e7a7437e66fc68cef22cda8f456d6e583f6e3237e0bc79987a9103f7cf0918e26881f67ea582e1ff3a49177599d385bf6e42572a2547933aeddb826530e9adf30dd84c3a7fae5c4c26f6c6f3a9f0906decd314e2407825abef959c5416d18a92ff34e6c521a16e8a0a29937c77d4ee99b41d530a732acbe0bf5d274df9d496b47a9a624546bdcf9976cde12ec989cb2a70b33a7c8a3a77652023164695f9db30dfcf587f0cd4f73e385730bcbdd688f6dcb08ba0efbb9f579220afefa4acfea522e864fce9b1782ce9f14824d16e9d33a2609c23ba3c5a1af02549357a0dcc12e37819d778021762cf895abeac1125b744c8b8225a091e7be9ded9993cfa3ca9abb83e25c8f559009977a2ed9374a89619fae5ef6d164bb73d242004dc8428e44689b33ee3bbe88bb4962ab0a32a90e7aea044f08410752cb2d7aeaf3196648a3a99092665b478bb394b48f79b36db0efc7f50d6a5179c945f5298cfaac5e5dea715296f92abce7281d48a0c9c6b785a35ef5f1697c047ddb254fe9a8ab9f498b0c1ae09ffd01a3d8d427fee7e36c51e0e5c2fee2245fb8464626ab5c9857ebce91f7d22bf024d10c2d71021cd69268472de419e6cefd970cc3a8e4d1bbe6496799aa7f100411766e712aff08b731460f14f9d7356db12cf8e1c6121968dc68b1d81c086b325ca4ce6fe1f476707e08fa913144b757c6be17cf93150db29544d207f09a896f33b7335d9339215da751e7af2c6bdd19db6f521af2c8a5998dc607f97026d07111488741134c1c86eba123273d1fd5ee4b471e86f9ae9478a04c7482076ab34a1eca5c64f89e5106eed44bceec019c67c12fb4db4fdac153f4ac3b63ffeb6d30de58ec039e2dd3c181e254cd94d0a2b0b44490384cc5915b54ee1db2b6d059879bf8126c9ca976d0f7862da07ecd350930a081810a7afd72b2ad3f65b96ae9c7f91227a2b5513a559f36b90fe01be9ae5ad3ca65e2c26f358fc26b858a3633fda7ae49a5fb705220a5819b3cca41b1ccc21d7c40f5fa9c422288efa5394e4312675899d704a2aab62b8363f58fd4bc12a8bea6ffc45b4414237bf5f019321206dbba439acb5ef26641f30fdac20f964354bce94e4c9d73e137f9806deefaf6f4acaa0e76ad4fef9f6cb7fc01bbabda9612c05adbe46afcf94819e8a4b4b49ff764784fa432d47fb6d4230900043d1b4521cd6839fe8c5df4d1899fdfb13880e207cac73f0a29020bdd563bd9c2f6bcd1ec523b3e03ebf6164fc65af001830c51396f9df2d346f83a59cfc82201cf1150ea57259d579fc2ed199b3fbe42d5188c84e4354610743e5b23a265246313cc63913f17412fa00d98b379b80b96d936969572e11316bc8926cb23115186f3b2387b82c3898fa41bf16a308da62d5a3eb3609af1943fddde08a4036eb2a41b7292caad9eb082614b02a1fa255bc7abd4d0e3b4ec1801e131e68c7aa9da1a0ff10f9de87dec8fad1ad8bfa99caa49e203a7b9c33e044d4544a537471e7a452468b821959bc488c6b8cbf81e90081a26de273ad1203cc06adb6af242ab19f96c1c66b58c37e2c9309704fba63af99a8d9c5efc651afb631fe9f546b938cc3b8e526c4159e5c9f7afb29fd1d55fabf09367ce2a63a35e7a2062d1c772ed981fd77157a847f687a177cf9886ce41df8cc509302b46bc1e2ba896b1c1656a1bbfdf4cd9ac39cf8510d1c823075f16550fd044aacc8d42a56f03718f7b18475cdc3999faeb25ab3dd8a807ee04d8e5d831d08b4e309dff50330685138797e10c6362636f53f22bfc1f3d5090a5d369282d9de36bb4e2505411ccc6ea395afa1567b15a2fb4be2adeea7126b1a8e80034105e0d98bdd78e796ce1cdc06a4ae666fc0baec5c52614340ed997673e26ec47c88846c000bb7c9077337cd44f5c041fdcc64986e5e1c0f488148f0ee6f842c44c0b72e82109270341bba6e9080b70fcf930d0f10be5a36798e70111fed72727b72282ff164fc08319d74f1f57cde71b57cb397a9e753f87b97729bafba017a24cbfdee5dfe7fc296c112e93bb8fce560ca80a3afd8370baaa79ad783b51352b5440b144a47378c9ae22eda5794328e95bcca220fd07bb56915529b155c61858efe89ad36a79288e74c0e251addcfaf797432175a5562b46eff5e3aebeb74623e18beef85389383c604d8884431b07dc4bea0174aadc337ff41f558a63f16690feae47efa2a5d1318b7397e1e4ba398727d286791b71610e1d78d32800e7e113c12abf0f60b6ca4401ecd23b7aacd990633b2b017daf6bfef1b2361ece74b7dbcbb1a73d4bc1f9d2e5c9fb0b7980d25cc44d1b10c09ef5a6a05c84669294a5cadf0cd88ab449f9f0bcdd8c48590d416c5c1feaa494a2145949c2a3373df7c6014225f2745bbeb20ff294d22c0d96ca111e6926946207cab56a03162a49e68968e398f70690188ee3ca847ef421742d60b9a6ad029e8a3d607950b2bf8ad8ff297cb39acc94905635770436e134435e28205140331b5100d9f64469792fffac87bca0835cbc617446ff86a7b50418c305f32e658b32130e491e38709fd3697017ac8084cdf1ed81a28375aed092ab4e32ca88a933154dd3a9e99351acbada926b67b310c7070ac1a414a28c5abfe1f45476249a12f18ca2d981528d881ed3c5072e46a6eff3cdf37dcbc89c7f79c88a1f8d15d15beb66a0e4440c7b93e379c4e2bac1d5c8e85f1852887e2cfeb178fba1c67dc2adb0c87df8ca4444ca7f455509f492effb5001328b8cc696e2933207a2d78bbce8562ca34a248193c914406b161c8141479d891b0c6110ec1e25cad38299b489f2ec437017cadba67dcb58abd4933c95b3526f1d4747b8701a7d71e446e4b62e2941d4281faca0cf22914be5aad80f47100000000ceb24e82508fe55a92fb6db70d03d1c1ec09cfee31639341756a4630a0eaaecac7bfbddf9d30c42cbd45eb181d5bd341307ad26f496bb042e2b655c03ac3dcc587acbf50f79b5c239be9938b62d3251b199f8413b020605d5d0552cfd9c39c9132719d6d0a326b000e12fcb51bc274df79d11430060d05978cdd50583f1bca82c57dbee605e2d00fcb5414af13a596d35cb5ba62de6a28cbccc857d23547b1c7fd5ac8fbf6758d5b8451fa46d9acc00344dc2e565674b1dd3547eb8f8aa5fff99042f8d1d59e6ad2f53379211e6832fcb68f5777eb2db85b28f724f4e4ce6342cf55713ff7b0cb4f7f47dd12a6566b86709eaefae024373267ce72a89e7f3e42ab48edcccc96b5d0403fe93a927e5ccf470014f220b8257393226cd7b996f20e6a34f81206733a9fdce03b701943c1b560d3eab68c2c225cf7f7f2b56123be2bb173e9e5b37f4d3348f6b987764ad07c2acd44514ff264d7eda31e5e517a179414841ad4553d51c08f435e05f10aa82d74b97a9ba3a133e6c9175fdcd4f3dc9c16d3be1d5bbaf13240177081ac1d56681bfa988a93af09868afd608520c0bfd71d857a6661fdaf6f2e166987eb007449dd26334ae932c5003fefc0f983b9e49cbfcea325f2de16a9ae935caa46f5b3433957fb370971ed957f138f08a60fed5b84995e428e7ae7d5c22021ff016baef0e713a118344c016a99ad469313ba7f2452da0dd82e019f64aa229cf80a69b3e08ac5847f10d247179855546313232f23e055c2f74ecef14e0fdcc29a9bf0976fbb249bd5c7903183d2a53c70960a183630e7d4928daa7091a85ad987d2a4a5b8f6be6612fa72d9fbb33c67bb38eff19f2e784f94e0354cf6d35a5b2c62233c039de3734b38e97ec72bd673fef09fd56fec329818cc68cdf12cb52f7d37a8350c16e94208880bfcd3e895d7aa4489e3dd15db4a9026f0d2a46f1e89c35845dbd976a1992b87c15a0c7580e6424b8792a7bb7b933d7c5433d4133ba4dbbcf7995d6ed3feaa32f876a287feeb9cc6107778c1f83e0119d980b9e994c2a3ae3de24a103efb3cacb746b49d1ad85746b233ab4aaf0e988ec2a786bc93f32040d3bdc3008031634cdfded5ac95b2279e096243228296591e7ba53c4a127772cc4620e6b238ccad250629194533d0a669ff3366c52d64928693e0b0cbb0b8e2c6029089d4dfe2b4b6c5dcd85f1a02770611e65001e48a32a8b0431a3b9d77fa3a95be38a0436a704c05a8e0183f3214c25531a63796f679bf72885aa766468d42b2543542d7e82544efc5c5e81e6a91a0f5d4e68000cff687d63e45c9a11d4ef515050daa592c9a828ac7c0488e7cdb3d6fdaef5e9176ee68d981ea50d386d74df3b40660351736deb03bfceb721878cf9894b0302df15964242ab6b9f77f98ba1c7993735983d2b022600ab74a19e3636e1400d08ba45d3a5c2774cb06a1c358bbfc11d27efaf7ca53c2e7757c8c76da24707d91a4a5244262898d68083ff91c514d9b9b1ebaa0cb0b10254fda1b1e82b9a1a47f117b5b280ddbec1f6732d11117ef1a7a674699df87fe795d1243cb9c4527e364e2b711b6562a87fafc130ce0baf1701686639b05f0c8dc708f008b1e6ab89e8d623bb83f3d54b7bcdbdacd055ac4eccbd36bbe0af0f65a00e3d6dd985ae8851d176976cfb5816d1fc2a63d3546aecaa4e712ca6961d1f181315d553de6b53485faed0dcfcf819a1ba3badffe797377d3d1ddaed8e7a0acc0c3d277762262a139f94de49faca167b11bf04f2104a5ab9a73367a6461f7124c91a2c4229ef98e6ebde9aac283c7d029400d71293f488ba169b62c1e94689cf5b248ed4aea62b88d65bb764cfe27d5231a58486e7381df518f4ed81cb905108c54a5050a94ca0e94da20d3794bc5fab9127dc95b6404b1e27b4e28136fc27806f7be798444c33aca88ffd45b860eba0d5033839f5a092863954604f1952bd61dad23b11643fe14f3ade08116aa2c13eee701ccd13e506bd65a1060bf69579aea8c8143cd38c0891a3065f251eba0c20ab9c69ddf28e3bd6400cc203bac8de1882239ad4e1b97b0ae2f1abb7bac7c0d8ef82b97ebfb1f5577f06a3a1377b09ada4db87d342f20ab0eca4b9c206042471307511429cb57a578211f92d3647189861cad9145f5eb26ab696abe50a2a6c1b469df97da28aba4e79b586c348a430f5ea61c4be1032fa61d18581f05a07fb8707c8996e0fff1c3eda59b992687fa12483b9327e10224b20d42e8b3fc4670bf070ced602283273d6818acd1f6da567c44d3f5e1377065d43d87d889843ae48e7fa8ba1634815695b8c480ca271e6e833799c70da80fd79acc09b989667a2294de5da73f0363df9a33ad4dab8d27cf7bed0a06838672e3d07d52b6396e9b5576021d5e925abd533bf161c944795065fdd44e8462e3070c479f1c118276653488dd9b2f1a673f8cad3612ca1fab4388ec9c8f834a01a499adb7b3a9a977672f6d75b41bbdd7f91ceb7e7a88568d17bb432be9e4e96e115075bce197ef4754d2914c2c59e2d7f4c08f0dbe34d31f229428f211bf1d7e8f5c319ed4a8273cb6255eb318851ac4557b0278fac63107a54d407c42f300b843a12abd3b893b46c7efac2e388ab42b87aebe2543bd4c15f459bc50aad10ffe1c1196fb52c26e54bdaa7fbd52451f207ffb073ef4b3f71eedd7da40c89505019739e3fa733bcdc84ff4919e8fe2358129ef28291be1d6426b8bafe88463b1d3cd7273745381c7f65221898e6ad361e88b24c54ccc7ac9a830145b6dc096e2d71ef71ec4f03524cb870b724e08d223bdec2f6fdde6200217a13b5136004d455d66547f5a1793e0cad85677d49e5c558852107007c8136812cf021afaf6f7e8f59883371be46cda412dd9c6fcf187c31252ceb5758901d39cd5355ab386d9a7fe6ea46ebf277aaf809c3023211ea9aa189de4d422080ebb9fec50ffab6b95ba4ae5018accc497e79149ed6047ce561ccc10e9194cdccd5c9fb75175c8dbc9d0a916ad59288f010defbbb50d263041ab37aac0f93253bef6f898cd0825d99d27224f26181f9713b8979da64756c95e7505f25a2688960d6155c3613dcc31b6c337a6dbfc6b12cfde1db22b93bbd5e48534fb0bda8b212577a14dcf665c834b0bd24e5f624d2455fe048dbe930328d7cb632db3b0e244bb5d43390b420b15157a339487fc78976f867d3a361aafdd3f50a93c01882da7c220089a544381db22e2c86b228dc2be01820468460437588952a549d37498e529e62aa62bad1580546bcb1e9a6ed1870b7838d05d12f6e3a041e78b1bdb80894626f20889ccb3a468aa4fb24b9c87cbb28623ce59c6b3c6286db366d08004551a25fe4d8d194a2bb7c52e1c85a5fbe4cb15b171489da121bea1c469a6bb185d63213084e3a81ee54dc03a94dc5ecdda7bfaad1df68021aaf4627c9d529f13e5c81b5ee4dd228949ca16b9a61d186211d153294470907557e5e14ae665013f285fe4d3766e7b3d8ce5e2a14692072d4d8f79354bcc8db8a2a36c8bcd", 0x2000, &(0x7f00000069c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000066c0)={0x90}, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0x0, 0x0}) sendmmsg(r3, &(0x7f0000008600)=[{{0x0, 0x7f, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x11}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0/../file0/file0\x00'}, 0x32, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) dup3(r2, r0, 0x0) 16:31:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0xe, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1599.810732][ T9896] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1599.832549][ T9899] IPVS: ftp: loaded support on port[0] = 21 16:31:45 executing program 2: r0 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f0000fcb000), 0x4) close(r0) [ 1599.896197][ T9900] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1599.974895][ T9899] lo speed is unknown, defaulting to 1000 16:31:46 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@deltaction={0x18, 0x31, 0x9e427aa8fa93af65, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x4}]}, 0x18}}, 0x0) 16:31:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ipv6_route\x00') r1 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x822b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x35000) sendfile(r1, r0, 0x0, 0x2fbb) 16:31:46 executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x87, 0x31, 0x8d, 0x40, 0xdb0, 0xd64, 0xb0d8, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xee, 0x72, 0x90}}]}}]}}, 0x0) [ 1600.353991][ T9896] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:46 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = eventfd(0x0) r3 = socket$inet6(0xa, 0x2, 0x0) io_submit(r1, 0x2, &(0x7f00000007c0)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r0, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x1, r2}]) 16:31:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0xf, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1600.962548][ T16] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1601.320072][ T9942] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1601.330612][ T16] usb 1-1: New USB device found, idVendor=0db0, idProduct=0d64, bcdDevice=b0.d8 [ 1601.340776][ T16] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1601.390411][ T9943] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1601.432631][ T16] usb 1-1: config 0 descriptor?? [ 1601.497029][ T16] usb 1-1: unknown interface protocol 0x90, assuming v1 [ 1601.504210][ T16] usb 1-1: cannot find UAC_HEADER [ 1601.509842][ T16] snd-usb-audio: probe of 1-1:0.0 failed with error -22 [ 1601.680850][T10207] usb 1-1: USB disconnect, device number 2 [ 1601.800314][ T9943] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1602.375986][ T3525] tipc: TX() has been purged, node left! [ 1602.462206][ T8467] usb 1-1: new high-speed USB device number 3 using dummy_hcd 16:31:48 executing program 2: r0 = socket(0x40000000002, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f00000000c0)=0x3f365342, 0x4) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000080)=0x800, 0x4) 16:31:48 executing program 4: r0 = openat$dlm_plock(0xffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x0, 0x0) poll(&(0x7f00000005c0)=[{r0}], 0x1, 0x0) 16:31:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ipv6_route\x00') r1 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x822b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x35000) sendfile(r1, r0, 0x0, 0x2fbb) 16:31:48 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x10, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1602.823619][ T8467] usb 1-1: New USB device found, idVendor=0db0, idProduct=0d64, bcdDevice=b0.d8 [ 1602.832996][ T8467] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1602.920366][ T8467] usb 1-1: config 0 descriptor?? [ 1603.009099][ T8467] usb 1-1: unknown interface protocol 0x90, assuming v1 [ 1603.016369][ T8467] usb 1-1: cannot find UAC_HEADER [ 1603.022190][ T8467] snd-usb-audio: probe of 1-1:0.0 failed with error -22 [ 1603.058261][ T9963] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1603.110248][ T9972] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1603.172461][T10209] usb 1-1: USB disconnect, device number 3 16:31:49 executing program 4: syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "3cceb6", 0x38, 0x3a, 0x0, @private1, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, [], {0x0, 0x6, "9d50de", 0x0, 0x6c, 0x0, @local, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [], "95963e5551052818"}}}}}}}, 0x0) 16:31:49 executing program 2: syz_usb_connect$uac1(0x0, 0x8a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000406b4997014000010203010902780603010000010904000000010100000a24010200000201020524040600052405000009040100000102000009040101010102000009050109000000000007250100000000090402000001"], 0x0) 16:31:49 executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x87, 0x31, 0x8d, 0x40, 0xdb0, 0xd64, 0xb0d8, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xee, 0x72, 0x90}}]}}]}}, 0x0) 16:31:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ipv6_route\x00') r1 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x822b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x35000) sendfile(r1, r0, 0x0, 0x2fbb) [ 1603.552348][ T9963] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:49 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000200)) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000040)={0x11}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000001c0)={0xfffbffff80000013}) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r2, &(0x7f00000003c0)) epoll_pwait(r1, &(0x7f0000dc7fc4)=[{}], 0x1, 0x0, 0x0, 0x0) 16:31:49 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x11, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:50 executing program 4: syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "3cceb6", 0x38, 0x3a, 0x0, @private1, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, [], {0x0, 0x6, "9d50de", 0x0, 0x6c, 0x0, @local, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [], "95963e5551052818"}}}}}}}, 0x0) [ 1604.212132][T10207] usb 3-1: new high-speed USB device number 33 using dummy_hcd 16:31:50 executing program 5: r0 = inotify_init() ioctl$FS_IOC_SETFLAGS(r0, 0x40044900, 0x0) [ 1604.313576][T10209] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1604.326525][ T9994] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1604.376333][ T9995] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1604.614997][T10207] usb 3-1: config index 0 descriptor too short (expected 1656, got 120) [ 1604.623792][T10207] usb 3-1: config 1 has an invalid interface number: 6 but max is 2 [ 1604.632244][T10207] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1604.642661][T10207] usb 3-1: config 1 has no interface number 1 [ 1604.648947][T10207] usb 3-1: config 1 interface 6 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 1604.674242][T10209] usb 1-1: New USB device found, idVendor=0db0, idProduct=0d64, bcdDevice=b0.d8 [ 1604.683597][T10209] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 16:31:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ipv6_route\x00') r1 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x822b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x35000) sendfile(r1, r0, 0x0, 0x2fbb) [ 1604.769221][T10209] usb 1-1: config 0 descriptor?? [ 1604.803287][ T9994] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1604.844874][T10209] usb 1-1: unknown interface protocol 0x90, assuming v1 [ 1604.852097][T10209] usb 1-1: cannot find UAC_HEADER [ 1604.857726][T10209] snd-usb-audio: probe of 1-1:0.0 failed with error -22 16:31:50 executing program 4: syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "3cceb6", 0x38, 0x3a, 0x0, @private1, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, [], {0x0, 0x6, "9d50de", 0x0, 0x6c, 0x0, @local, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [], "95963e5551052818"}}}}}}}, 0x0) 16:31:50 executing program 5: io_setup(0x7, &(0x7f0000000180)=0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x48a01) io_submit(r0, 0x1, &(0x7f0000000100)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) [ 1605.083601][ T8469] usb 1-1: USB disconnect, device number 4 [ 1605.103477][T10207] usb 3-1: New USB device found, idVendor=496b, idProduct=0197, bcdDevice= 0.40 [ 1605.113082][T10207] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1605.121468][T10207] usb 3-1: Product: syz [ 1605.127244][T10207] usb 3-1: Manufacturer: syz [ 1605.132361][T10207] usb 3-1: SerialNumber: syz 16:31:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x12, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1605.703792][T10022] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1605.767935][T10207] usb 3-1: USB disconnect, device number 33 [ 1605.781042][T10030] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:51 executing program 4: syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "3cceb6", 0x38, 0x3a, 0x0, @private1, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, [], {0x0, 0x6, "9d50de", 0x0, 0x6c, 0x0, @local, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [], "95963e5551052818"}}}}}}}, 0x0) [ 1606.208854][T10022] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1606.415721][T10207] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1606.802356][T10207] usb 3-1: config index 0 descriptor too short (expected 1656, got 120) [ 1606.810986][T10207] usb 3-1: config 1 has an invalid interface number: 6 but max is 2 [ 1606.819429][T10207] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1606.829870][T10207] usb 3-1: config 1 has no interface number 1 [ 1606.836303][T10207] usb 3-1: config 1 interface 6 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 16:31:52 executing program 2: r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x60, r0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0xa, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @dev}}, {0x14, 0x2, @in={0x2, 0x0, @empty}}}}]}]}, 0x60}}, 0x0) 16:31:52 executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x87, 0x31, 0x8d, 0x40, 0xdb0, 0xd64, 0xb0d8, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xee, 0x72, 0x90}}]}}]}}, 0x0) 16:31:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000380)='ethtool\x00') sendmsg$ETHTOOL_MSG_FEATURES_GET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)={0x20, r1, 0xa23f19f29c7d7dfd, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x6}]}]}, 0x20}}, 0x0) 16:31:52 executing program 5: r0 = socket(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c00000024000b0f00000000e4ff000000000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000b00010064736d61726b00000c0002000600010020"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000800)=@newtfilter={0x24, 0x2a, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3}}, 0x24}}, 0x0) 16:31:52 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x13, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:52 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_PROTO={0x5, 0x9, 0x89}]}}}]}, 0x3c}}, 0x0) [ 1607.132258][T10207] usb 3-1: New USB device found, idVendor=496b, idProduct=0197, bcdDevice= 0.40 [ 1607.141494][T10207] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1607.150184][T10207] usb 3-1: Product: syz [ 1607.154689][T10207] usb 3-1: Manufacturer: syz [ 1607.232782][T10207] usb 3-1: can't set config #1, error -71 [ 1607.241255][T10207] usb 3-1: USB disconnect, device number 34 [ 1607.344842][T10063] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 1607.384108][T10062] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1607.400370][T10068] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 1607.411221][T10066] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1607.425996][T10069] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1607.577935][T10076] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1607.589406][T10076] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1607.599247][T10076] tipc: Invalid UDP bearer configuration [ 1607.599320][T10076] tipc: Enabling of bearer rejected, failed to enable media [ 1607.618773][T10075] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1607.632521][ T5] usb 1-1: new high-speed USB device number 5 using dummy_hcd 16:31:53 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r0, 0x10f, 0x84, &(0x7f0000000380), &(0x7f00000003c0)=0x4) 16:31:53 executing program 3: syz_mount_image$udf(&(0x7f0000000000)='udf\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000280)={[{@unhide='unhide'}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@umask={'umask', 0x3d, 0x100000000}}]}) [ 1607.842829][T10069] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1607.875157][T10084] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1607.885015][T10084] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1607.896283][T10084] tipc: Invalid UDP bearer configuration [ 1607.896348][T10084] tipc: Enabling of bearer rejected, failed to enable media [ 1608.033636][ T5] usb 1-1: New USB device found, idVendor=0db0, idProduct=0d64, bcdDevice=b0.d8 [ 1608.042974][ T5] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 16:31:53 executing program 2: r0 = socket(0x10, 0x80002, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x3d2}}, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800500180000000000050017"], 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00'}) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924924924923aa, 0x0) 16:31:54 executing program 5: syz_emit_ethernet(0x6e, &(0x7f0000000340)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0x0, @dev, @mcast2, {[], @param_prob={0x4, 0x2, 0x0, 0x0, {0x0, 0x6, "9d3999", 0x0, 0x2f, 0x0, @private0, @dev, [@routing]}}}}}}}, 0x0) [ 1608.144704][ T5] usb 1-1: config 0 descriptor?? [ 1608.202384][ T5] usb 1-1: unknown interface protocol 0x90, assuming v1 [ 1608.209575][ T5] usb 1-1: cannot find UAC_HEADER [ 1608.215518][ T5] snd-usb-audio: probe of 1-1:0.0 failed with error -22 16:31:54 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x25, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) [ 1608.470020][ T5] usb 1-1: USB disconnect, device number 5 16:31:54 executing program 4: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af21, &(0x7f0000000080)) 16:31:54 executing program 3: syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f0000000440), 0x8400, &(0x7f0000000480)={[{@uni_xlate='uni_xlate=1'}, {@rodir='rodir'}, {@fat=@check_relaxed='check=relaxed'}], [{@appraise_type='appraise_type=imasig'}]}) [ 1608.780852][T10109] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1608.837049][T10111] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:55 executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x87, 0x31, 0x8d, 0x40, 0xdb0, 0xd64, 0xb0d8, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xee, 0x72, 0x90}}]}}]}}, 0x0) 16:31:55 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x4}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r3, &(0x7f0000000240)={&(0x7f00000001c0), 0x10, 0x0}, 0x0) sendmsg$tipc(r3, &(0x7f0000000240)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x0, 0x4}}, 0x10, 0x0}, 0x0) 16:31:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = memfd_create(&(0x7f0000000100)='#\'%nodev\x00', 0x0) write(r1, &(0x7f0000002000)='/', 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r1, 0x0) getsockopt$inet_opts(r0, 0x0, 0x4, 0x0, &(0x7f0000000000)) 16:31:55 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) setsockopt$inet_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000100)=@gcm_256={{}, "3f930bb872521829", "7326e25305dc0e39bbee7033c3d2ef119f92e6d7097e94e053385c5919882d7b", "d9b14bba", "336c1a77369b52f7"}, 0x38) [ 1609.227321][T10109] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 16:31:55 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x7) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e20, @remote}, 0x10) getsockopt$inet_int(r1, 0x10d, 0xc4, &(0x7f0000000100), &(0x7f0000000080)=0x4) 16:31:55 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x48, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) 16:31:55 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x82, &(0x7f0000000080)={@multicast, @random="e0d35b1004bb", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010101, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x3, 0x0, 0x0, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @broadcast, {[@timestamp_prespec={0x44, 0x44, 0x0, 0x3, 0x0, [{@broadcast}, {@multicast2}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@multicast2}, {@multicast2}, {@loopback}, {@loopback}, {@private}]}]}}}}}}}, 0x0) 16:31:55 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='9p\x00', 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@afid={'afid'}}], [], 0x6b}}) 16:31:55 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000018c0)=""/246) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f00000003c0)=0x17642c4) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000080)) [ 1609.998961][T10144] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1610.002302][ T8467] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 1610.041002][ T31] audit: type=1800 audit(1603816315.886:148): pid=10145 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=16367 res=0 errno=0 16:31:56 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="b4000000020000006600000000000000730135000000000095000000000000004bb5eea0a6ec9fcd4b0a008a8443f22772d945c7e6dd329e4a0587536a9669924c8341ea7244ddb07b7e9912e0dd1a59541f7cbb1548ee5bd627f5b0b8ec77bd6d5f7b543f9aafaabe53339b12fbbe7decc4aa61b8aad0359083bdd61543fbeee8d560bb4b5925fae801f4c91e31674b124a1b3b000000bc4da4a9b3d5cc9e0000f6a7a72900997320a3f6da9f010d41ac79fdd84abbec7d96629491727375b853d34344c60f0061fbe0131f3c7a026d8f00000800000000000000000bd724e9fc3cc004a1097fddc65c1b1b328277ff85ed56b9261eb7bcee28ec2d3616689ab3f31f849eebce6f21e6302003c0467844e000000000db0700bd694a09b253a1c6c7863d3b9cd506231b40a7ab7069790d5b8f7ab45184ca6d9bee429bc7e2e4d219e1d7ebeb51511d9df85a648b1b85f93cb6cd21f93d5ea3da2b31657c065d052d9b9ee00320c9f97ebac25b929b3c15e33be6e7d54e6229427ee8d181d2f18d772fb5c58a936620ba1f5fbb48703ab211f442697edc165b449db2e3c221fbf270a6db414516949b976e459c9b96a1cbe81a38a23f03bd7c1a3e60c2e294f828e0e7e42cb70328f151f949e387aae9d7d2800c8eeae093c05adc9086d3f143a7b87d06838c6525cafdc01820a8912a1641b38333ce1c8456a467b0d9d033edc9da00c8a2b42e8adfeff69fce7a35f79748e3e5b235269310988a05bf7c4e4cef3d1aa550c83d6328eb8fcadb364a02ef99ed50"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x21e, 0x10, &(0x7f00000002c0), 0xfffffffffffffd02}, 0x48) 16:31:56 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100)='devlink\x00') sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x44, r1, 0x3, 0x0, 0x0, {0x1c}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd, 0x87, 'l2_drops\x00'}}]}, 0x44}}, 0x0) 16:31:56 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='9p\x00', 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@afid={'afid'}}], [], 0x6b}}) [ 1610.390219][T10141] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1610.401846][ T8467] usb 1-1: New USB device found, idVendor=0db0, idProduct=0d64, bcdDevice=b0.d8 [ 1610.411001][ T8467] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1610.471933][ T8467] usb 1-1: config 0 descriptor?? [ 1610.520515][ T8467] usb 1-1: unknown interface protocol 0x90, assuming v1 [ 1610.527729][ T8467] usb 1-1: cannot find UAC_HEADER [ 1610.533574][ T8467] snd-usb-audio: probe of 1-1:0.0 failed with error -22 [ 1610.732824][ T31] audit: type=1800 audit(1603816316.586:149): pid=10167 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=16367 res=0 errno=0 [ 1610.798343][ T8469] usb 1-1: USB disconnect, device number 6 16:31:57 executing program 4: syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010101, @local}, @time_exceeded={0xb, 0x1, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @empty}}}}}}, 0x0) 16:31:57 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='9p\x00', 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@afid={'afid'}}], [], 0x6b}}) 16:31:57 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000000000f3280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffffff000000090001006866736300010000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x84, 0x2c, 0xe27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0x3}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x54, 0x2, [@TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7, 0x1, 'ct\x00'}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_ACTION={0x6}, @TCA_CT_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x84}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 1611.700481][ T31] audit: type=1800 audit(1603816317.556:150): pid=10188 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=16381 res=0 errno=0 16:31:57 executing program 0: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x1) 16:31:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000001c0)=ANY=[@ANYBLOB="0200000014800000010000000066"]) [ 1612.194754][T10189] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1612.299414][ T624] tipc: TX() has been purged, node left! [ 1612.316874][T10192] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1614.938669][ T624] device hsr_slave_0 left promiscuous mode [ 1614.948047][ T624] device hsr_slave_1 left promiscuous mode [ 1614.965723][ T624] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1614.974157][ T624] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1614.987725][ T624] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1614.995631][ T624] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1615.013767][ T624] device bridge_slave_1 left promiscuous mode [ 1615.020517][ T624] bridge0: port 2(bridge_slave_1) entered disabled state [ 1615.037029][ T624] device bridge_slave_0 left promiscuous mode [ 1615.044030][ T624] bridge0: port 1(bridge_slave_0) entered disabled state [ 1615.079891][ T624] device veth1_macvtap left promiscuous mode [ 1615.086324][ T624] device veth0_macvtap left promiscuous mode [ 1615.092829][ T624] device veth1_vlan left promiscuous mode [ 1615.098728][ T624] device veth0_vlan left promiscuous mode [ 1619.062258][T10207] Bluetooth: hci4: command 0x0409 tx timeout [ 1619.915584][ T624] team0 (unregistering): Port device team_slave_1 removed [ 1619.930955][ T624] team0 (unregistering): Port device team_slave_0 removed [ 1619.953689][ T624] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1619.978794][ T624] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1620.055328][ T624] bond0 (unregistering): Released all slaves [ 1620.134680][T10237] IPVS: ftp: loaded support on port[0] = 21 [ 1620.157597][T10237] lo speed is unknown, defaulting to 1000 [ 1620.377732][T10237] chnl_net:caif_netlink_parms(): no params data found [ 1620.454256][T10361] Kernel panic - not syncing: kmsan_in_runtime: -1 [ 1620.460778][T10361] CPU: 0 PID: 10361 Comm: wg-crypt-wg1 Not tainted 5.9.0-rc8-syzkaller #0 [ 1620.461805][T10361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1620.461805][T10361] Call Trace: [ 1620.461805][T10361] dump_stack+0x21c/0x280 [ 1620.461805][T10361] panic+0x4c8/0xea7 [ 1620.461805][T10361] ? kmsan_report+0x1e0/0x1e0 [ 1620.491819][T10361] ? find_next_and_bit+0x421/0x530 [ 1620.491819][T10361] __msan_instrument_asm_store+0x12d/0x130 [ 1620.491819][T10361] _raw_spin_lock_irqsave+0x5a/0x110 [ 1620.491819][T10361] load_balance+0x23f5/0x5030 [ 1620.491819][T10361] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 1620.491819][T10361] newidle_balance+0x477/0x12e0 [ 1620.491819][T10361] pick_next_task_fair+0x49d/0x1250 [ 1620.491819][T10361] pick_next_task+0x18e/0x6b0 [ 1620.491819][T10361] __schedule+0x24b/0x590 [ 1620.491819][T10361] schedule+0x260/0x330 [ 1620.491819][T10361] schedule_preempt_disabled+0xe/0x10 [ 1620.491819][T10361] kthread+0x421/0x560 [ 1620.491819][T10361] ? rcu_free_pwq+0x70/0x70 [ 1620.491819][T10361] ? kthread_blkcg+0x110/0x110 [ 1620.491819][T10361] ret_from_fork+0x1f/0x30 [ 1620.491819][T10361] Kernel Offset: disabled [ 1620.491819][T10361] Rebooting in 86400 seconds..