fffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:53:37 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.self_freezing\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:37 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {0x0}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:37 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)}], 0x4) 03:53:37 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) pwritev(r1, &(0x7f00000004c0), 0x3, 0x803fffe, 0x7f) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @private=0xa010102}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="01000000", @ANYRES32=0x0], &(0x7f000095dffc)=0x8) r5 = socket(0xa, 0x1, 0x0) close(r5) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={r4}, &(0x7f0000000140)=0x8) sendmmsg$inet_sctp(r5, &(0x7f0000003580)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="300000000000000084000000010000000000a75474"], 0x30}], 0x1, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x74}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:37 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="14040002094000000000000000000000000000006187ac10e8c8344f85ea53e1284ef7897cb48da4f052b3ac7322e35e30975a00b3374806d174bc31072b66203c0aeda3198eebc370384529e1f5ba02ac5601ade73dd5f3776f57d5ab31c6eee0a812beec60a2206d6cb373bde170a4"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:37 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {0x0}], 0x4) 03:53:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x75}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:37 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {0x0}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:37 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14deffff060600008000"/20], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:37 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:38 executing program 2: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x76}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:38 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:38 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) pwritev(r1, &(0x7f00000004c0), 0x3, 0x803fffe, 0x7f) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @private=0xa010102}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="01000000", @ANYRES32=0x0], &(0x7f000095dffc)=0x8) r5 = socket(0xa, 0x1, 0x0) close(r5) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={r4}, &(0x7f0000000140)=0x8) sendmmsg$inet_sctp(r5, &(0x7f0000003580)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="300000000000000084000000010000000000a75474"], 0x30}], 0x1, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) (async) pwritev(r1, &(0x7f00000004c0), 0x3, 0x803fffe, 0x7f) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @private=0xa010102}], 0x10) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="01000000", @ANYRES32=0x0], &(0x7f000095dffc)=0x8) (async) socket(0xa, 0x1, 0x0) (async) close(r5) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={r4}, &(0x7f0000000140)=0x8) (async) sendmmsg$inet_sctp(r5, &(0x7f0000003580)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="300000000000000084000000010000000000a75474"], 0x30}], 0x1, 0x0) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:53:38 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:38 executing program 2: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {0x0}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 492.871945][T16340] syz-executor.3: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 492.941869][T16340] CPU: 1 PID: 16340 Comm: syz-executor.3 Not tainted 5.16.0-rc5-syzkaller #0 [ 492.950672][T16340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 492.960741][T16340] Call Trace: [ 492.964030][T16340] [ 492.966973][T16340] dump_stack_lvl+0xcd/0x134 [ 492.971582][T16340] warn_alloc.cold+0x87/0x17a [ 492.976271][T16340] ? zone_watermark_ok_safe+0x290/0x290 [ 492.981813][T16340] ? __kmalloc_node+0x62/0x390 [ 492.986593][T16340] ? __vmalloc_node_range+0x574/0xab0 [ 492.991965][T16340] __vmalloc_node_range+0x883/0xab0 [ 492.997171][T16340] ? vfree_atomic+0xe0/0xe0 [ 493.001677][T16340] ? rcu_read_lock_sched_held+0x3a/0x70 [ 493.007223][T16340] ? kernel_clone+0xe7/0xab0 [ 493.011813][T16340] copy_process+0x926/0x75a0 [ 493.016403][T16340] ? kernel_clone+0xe7/0xab0 [ 493.020990][T16340] ? lock_chain_count+0x20/0x20 [ 493.025835][T16340] ? lock_chain_count+0x20/0x20 [ 493.030686][T16340] ? find_held_lock+0x2d/0x110 [ 493.035450][T16340] ? __cleanup_sighand+0xb0/0xb0 [ 493.040384][T16340] ? lock_downgrade+0x6e0/0x6e0 [ 493.045246][T16340] ? __lock_acquire+0x162f/0x54a0 [ 493.050282][T16340] ? kernel_clone+0x314/0xab0 [ 493.054971][T16340] kernel_clone+0xe7/0xab0 [ 493.059383][T16340] ? create_io_thread+0xf0/0xf0 [ 493.064230][T16340] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 493.070225][T16340] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 493.076217][T16340] ? find_held_lock+0x2d/0x110 [ 493.080984][T16340] __do_sys_clone+0xc8/0x110 [ 493.085568][T16340] ? kernel_clone+0xab0/0xab0 [ 493.090239][T16340] ? lock_downgrade+0x6e0/0x6e0 [ 493.095099][T16340] ? syscall_enter_from_user_mode+0x21/0x70 [ 493.100998][T16340] do_syscall_64+0x35/0xb0 [ 493.105412][T16340] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 493.111319][T16340] RIP: 0033:0x7f95fb85e2c1 [ 493.115748][T16340] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 493.135361][T16340] RSP: 002b:00007ffca88667e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 493.143790][T16340] RAX: ffffffffffffffda RBX: 00007f95fa0a9700 RCX: 00007f95fb85e2c1 [ 493.151757][T16340] RDX: 00007f95fa0a99d0 RSI: 00007f95fa0a92f0 RDI: 00000000003d0f00 [ 493.159720][T16340] RBP: 00007ffca8866a30 R08: 00007f95fa0a9700 R09: 00007f95fa0a9700 [ 493.167689][T16340] R10: 00007f95fa0a99d0 R11: 0000000000000206 R12: 00007ffca886689e [ 493.175660][T16340] R13: 00007ffca886689f R14: 00007f95fa0a9300 R15: 0000000000022000 [ 493.183639][T16340] 03:53:39 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="14040002094000000000000000000000000000006187ac10e8c8344f85ea53e1284ef7897cb48da4f052b3ac7322e35e30975a00b3374806d174bc31072b66203c0aeda3198eebc370384529e1f5ba02ac5601ade73dd5f3776f57d5ab31c6eee0a812beec60a2206d6cb373bde170a4"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:53:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x77}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:39 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726", 0x2}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:39 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000100)="5ce38f7c3810d2a76d7b55ce758ca2ff0b95cdd5e0918e65143f5ce8c0925842450c25ce881fc9f39de31c7835800f7c5f1bfc115aec804bf7e79ab57726ffc686b38538360aa4db1c0e4a1d8caa6de44530b4da28863e53c935d58cb4404e165fd6f8e6e213a3f615db9a08e8f7ff6d226d547afdba02d456a6456f0310819bc254", 0x82}, {&(0x7f00000003c0)="ff7c3eeb8c3948630256fa5ede69cf1c82aa6456d0f564f378379ef84bb06bdade7d96832fa0f18894992e7fa47e18e7976f15663bd0af6706c78161f963d23ec567eb89f8e724d0b86a720d05d1d1376bcc6f2bda4a77264fd9b687f53edf8f5c5562af589dd514996beab24105453d54980062d0a89ffe0f2f941d60268290692e739baaa749a4aeda886a2e8e45e1b0b05654db0b7a67560ec067ccbf0b2339d28a262a090b94effdabd14b6c499c5d287836f686ea1d0b258c52b6de118b", 0xc0}, {&(0x7f0000000600)="520c1d23388656403d77ddc9570d9cdfe304cdcfc6b973e7054e10812134414087d7fc02321c2ae9d930a26aefb74a3cd7be51c8f90aea7d92c5371d427fe7ac8b89dd1329f48c482254e9e6c8775598f7399e8bac13c0ace5b0f83e2a83d0d8d882baac50e05325f9497f0045963548ecf3563c2310e7591cfec04b3a7f90a3b381d7f1e8adc76392063c228f6426764266997f454574c3f670725ae15e4d", 0x9f}], 0x3, &(0x7f00000001c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @multicast1}}}], 0x40}, 0x24008800) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) preadv(r3, &(0x7f0000000280)=[{&(0x7f0000000840)=""/187, 0xbb}], 0x1, 0x9, 0xfffffffa) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000000746000300000000000000cd48c04100"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$DCCPDIAG_GETSOCK(r5, &(0x7f0000000500)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000900)={0x3b0, 0x13, 0x20, 0x70bd2b, 0x25dfdbfc, {0xa, 0xf7, 0x5, 0x1f, {0x4e22, 0x4e24, [0x5, 0x9, 0x7, 0xffffff7f], [0xffff, 0x4, 0x1], r4, [0xffffffe1, 0x1]}, 0x0, 0x6}, [@INET_DIAG_REQ_BYTECODE={0x96, 0x1, "ae7ba47eea0258285466641636501d1a91f084e9844b0a3f4fc7a352f9b5e2b07a1594fdb735692239f845c1667ad1875b65bd33e038ee406959dac8b7292d771683a08c615436b1910dfb78ffd3477b47d9e963d4ec71952d085f0caa59f3dc9a60e5a8e5d3951d06d06e62d8585dc5d488507bcefe0c9d7e88eacb1c533bb3e3d3922c2d0a116a9f2fef2f7792b9b638bd"}, @INET_DIAG_REQ_BYTECODE={0xf5, 0x1, "806d9aaec68914b10ff59c25f07cdcf7b8ab47282a23a5061b106376ae71a388187a1b9d5d310deea9dd2da01df745162f81c9cc37499984c126e8d290cb1233798bfe5bba214b12047267705fc95ba3d599ad7a9a5e6b76584adefd46ea7fb07d77ceb88faacdcfe5599f490d9c5a8301fa3c5b786dfcca36705b8cf6cc707fd281cd4d666a7d75b4735ea801d8002bcf3ad24d3146f41034a3d0a08efb6d15a6fe083c65e9858f3579b11a60561baeb0a19b28a0b102daa909eaac5b6722601272782282c965be0aedb15e778415a93712d224b27fe111d90623504e4cffb4613efebc5d88a57549ef99059a4beb4aa9"}, @INET_DIAG_REQ_BYTECODE={0xf3, 0x1, "40db21d5703b0c19cec34b372065a4c885dd93afbcdd5a5529a960e730e07489e82b83f7f0afe8f8ec6cca2bd7f991a39ab22057dd6070ce947f754a9b87d2852b3df2a2dec8e53dc22294cca3a0a2aeec0f48f8720777b72b1a66b90c614bb9bf5511e519d6881d825cabf36522188103eb1cbabb292c23630ba7a7a6aecb3243447d2c4cca25a224f8dece9e7db190f040d59eef463008af9d46c27d7932cc5c40b45ae01a26489a379458f47b9764bea63e2fc6da00bd930f53dfa780f9f305f1ef9b3ffc3c30c2687de7e2540f44b1564d87d5afb48f76c67788af729fe3f7ae8ed735a981c46471db64cbda95"}, @INET_DIAG_REQ_BYTECODE={0xdf, 0x1, "85b76e39aca70064372f1001db0723793d888b55a483ab9a081d5106c37bad36c471beabdbbfc337f3ac200f5fc6f684a94ff08332086c928ad4512448112cdcc44506ffbdda2c042f56567723039b25dc6d0d4d1c6a4167eec28668ffd01ed0e8d94fddf212c443365959e6aa9fc43dcf8f693899b5157f9675fdc8b4f137d696b280d52da4d31d88c81e9d134e92682ccdb53bde274505d7bcb9dc21721e4943103bd1a6c2ab05e81635511728a82fbb5964823b9ca27c9ec444d1cea825b9aa75c91d34e40ef252e70ebc08843c75b159b13b0ade0c6e514ec8"}]}, 0x3b0}}, 0x20000010) accept(r0, &(0x7f00000006c0)=@pptp={0x18, 0x2, {0x0, @multicast2}}, &(0x7f0000000480)=0x80) 03:53:39 executing program 5: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 493.584795][T16340] Mem-Info: [ 493.590282][T16340] active_anon:891 inactive_anon:82637 isolated_anon:0 [ 493.590282][T16340] active_file:8045 inactive_file:36119 isolated_file:0 [ 493.590282][T16340] unevictable:768 dirty:36 writeback:0 [ 493.590282][T16340] slab_reclaimable:20266 slab_unreclaimable:118390 [ 493.590282][T16340] mapped:28033 shmem:2553 pagetables:741 bounce:0 [ 493.590282][T16340] kernel_misc_reclaimable:0 [ 493.590282][T16340] free:1335310 free_pcp:10021 free_cma:0 03:53:39 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726", 0x2}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x7a}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:39 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) write$binfmt_script(r0, &(0x7f00000003c0)={'#! ', './file0', [{0x20, 'memory.events\x00'}], 0xa, "576c8e198e37b4537edcd53f058c96208b30db47514a4d709e36ba0a4024bea72301fbc6307d9177bb3925d41010bf9deff971f60afd1b5c4511bf742e9bfa28c84f8a9ae595d028a42030f17be9fe26ace2334cd1687fef66d663843cf28752c30762fe70fdd981056e5162db73c34db0019d4fe3b6687c527c0bc9c1039c8d4860c9840dd52fb94247ea8e0d4c847179d53086717a6ab18eca6b9b9f97a19de6d08e70b91123947c4afdd107d85051cdb4f4820f4be98ad4a44c2fc7343ce69f6fdab351e485945367509f38930ac16cd31d1030f699dd7020353e80f09754d46587b3ab"}, 0xff) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000000000080006400000000100"/28], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x0) bind$vsock_stream(r0, &(0x7f0000000100)={0x28, 0x0, 0x0, @my=0x0}, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:53:39 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726", 0x2}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 493.857926][T16340] Node 0 active_anon:3552kB inactive_anon:331692kB active_file:32108kB inactive_file:144476kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:112132kB dirty:140kB writeback:0kB shmem:7744kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 372736kB writeback_tmp:0kB kernel_stack:11320kB pagetables:3060kB all_unreclaimable? no [ 494.049149][T16340] Node 1 active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:2468kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:4kB all_unreclaimable? no [ 494.160651][T16340] Node 0 DMA free:15360kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 494.217490][T16340] lowmem_reserve[]: 0 2645 2645 2645 2645 [ 494.230553][T16340] Node 0 DMA32 free:1335820kB boost:0kB min:35676kB low:44592kB high:53508kB reserved_highatomic:0KB active_anon:3552kB inactive_anon:329612kB active_file:32108kB inactive_file:144476kB unevictable:1536kB writepending:140kB present:3129332kB managed:2716752kB mlocked:0kB bounce:0kB free_pcp:12296kB local_pcp:4652kB free_cma:0kB [ 494.300332][T16340] lowmem_reserve[]: 0 0 0 0 0 [ 494.311282][T16340] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 494.372907][T16340] lowmem_reserve[]: 0 0 0 0 0 [ 494.385278][T16340] Node 1 Normal free:3947756kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:288kB local_pcp:288kB free_cma:0kB [ 494.471842][T16340] lowmem_reserve[]: 0 0 0 0 0 [ 494.491663][T16340] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 494.534261][T16340] Node 0 DMA32: 1229*4kB (UME) 1445*8kB (UME) 909*16kB (UME) 1100*32kB (UME) 717*64kB (UME) 312*128kB (UME) 119*256kB (UME) 31*512kB (UME) 3*1024kB (UM) 2*2048kB (ME) 269*4096kB (M) = 1307372kB [ 494.585166][T16340] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 494.627634][T16340] Node 1 Normal: 117*4kB (UE) 29*8kB (UE) 27*16kB (UME) 184*32kB (UE) 86*64kB (UME) 24*128kB (UME) 8*256kB (U) 6*512kB (UE) 1*1024kB (E) 3*2048kB (ME) 957*4096kB (M) = 3947756kB [ 494.664391][T16340] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 494.681942][T16340] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 494.695591][T16340] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 494.712980][T16340] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 494.723923][T16340] 18332 total pagecache pages [ 494.735464][T16340] 0 pages in swap cache [ 494.741068][T16340] Swap cache stats: add 0, delete 0, find 0/0 [ 494.756917][T16340] Free swap = 0kB [ 494.761828][T16340] Total swap = 0kB [ 494.765636][T16340] 2097051 pages RAM [ 494.770219][T16340] 0 pages HighMem/MovableOnly [ 494.775028][T16340] 384518 pages reserved [ 494.779862][T16340] 0 pages cma reserved 03:53:40 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async, rerun: 32) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) (async, rerun: 32) pwritev(r1, &(0x7f00000004c0), 0x3, 0x803fffe, 0x7f) (async, rerun: 32) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 64) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) (rerun: 64) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @private=0xa010102}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="01000000", @ANYRES32=0x0], &(0x7f000095dffc)=0x8) (async, rerun: 32) r5 = socket(0xa, 0x1, 0x0) (rerun: 32) close(r5) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={r4}, &(0x7f0000000140)=0x8) sendmmsg$inet_sctp(r5, &(0x7f0000003580)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="300000000000000084000000010000000000a75474"], 0x30}], 0x1, 0x0) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x7e}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:40 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3", 0x3}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:40 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="14040002094000000000000000000000000000006187ac10e8c8344f85ea53e1284ef7897cb48da4f052b3ac7322e35e30975a00b3374806d174bc31072b66203c0aeda3198eebc370384529e1f5ba02ac5601ade73dd5f3776f57d5ab31c6eee0a812beec60a2206d6cb373bde170a4"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="14040002094000000000000000000000000000006187ac10e8c8344f85ea53e1284ef7897cb48da4f052b3ac7322e35e30975a00b3374806d174bc31072b66203c0aeda3198eebc370384529e1f5ba02ac5601ade73dd5f3776f57d5ab31c6eee0a812beec60a2206d6cb373bde170a4"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:53:40 executing program 2: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726", 0x2}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 494.833800][ T25] kauditd_printk_skb: 35 callbacks suppressed [ 494.833817][ T25] audit: type=1804 audit(1640058820.440:3553): pid=16390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/421/memory.events" dev="sda1" ino=1176 res=1 errno=0 [ 494.952274][ T25] audit: type=1800 audit(1640058820.490:3554): pid=16390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1176 res=0 errno=0 [ 495.026839][ T25] audit: type=1804 audit(1640058820.490:3555): pid=16390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/421/memory.events" dev="sda1" ino=1176 res=1 errno=0 03:53:40 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3", 0x3}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:40 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 495.083559][T16401] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 495.120919][T16401] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db 03:53:40 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}}}, 0x24}}, 0x0) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000600)={0x14, 0x0, 0x100, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8b098f7c1fc4afd4}, 0x10880) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000008dc0)={{{@in6=@initdev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@initdev}}, &(0x7f0000008ec0)=0xe8) sendmsg$can_j1939(r0, &(0x7f0000008fc0)={&(0x7f0000008f00)={0x1d, r5, 0x2, {0x1, 0x0, 0x4}}, 0x18, &(0x7f0000008f80)={&(0x7f0000008f40)="312f130b7752d70b2cf847", 0xb}, 0x1, 0x0, 0x0, 0xe9e126fb15b8ec29}, 0x4000004) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) sendfile(r2, r0, 0x0, 0x100000004) [ 495.186464][ T25] audit: type=1804 audit(1640058820.490:3556): pid=16396 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/408/memory.events" dev="sda1" ino=1181 res=1 errno=0 03:53:40 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = accept4$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000040)=0x1c, 0x80800) pread64(r2, &(0x7f0000000100)=""/217, 0xd9, 0x9f9) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14f8fff6060605b251c26a9e2066008000000008"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r4, r0, 0x0, 0x100000004) [ 495.286523][ T25] audit: type=1800 audit(1640058820.490:3557): pid=16396 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1181 res=0 errno=0 03:53:41 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3", 0x3}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:41 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'syztnl0\x00', 0x0, 0x4, 0xc0, 0x5, 0x5, 0x41, @private0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x10, 0x0, 0x1, 0x6}}) ioctl$TUNSETIFINDEX(r5, 0x400454da, &(0x7f0000000240)=r6) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) socketpair(0x2b, 0x6, 0xef, &(0x7f0000000280)={0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_RES_GET(r7, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)={0x60, 0x1409, 0x10, 0x70bd25, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000804}, 0x26004045) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) [ 495.358368][ T25] audit: type=1804 audit(1640058820.490:3558): pid=16397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/408/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 495.451523][ T25] audit: type=1804 audit(1640058820.500:3559): pid=16397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/408/memory.events" dev="sda1" ino=1181 res=1 errno=0 03:53:41 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) r5 = socket$isdn_base(0x22, 0x3, 0x0) sendfile(r5, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x400) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000008, 0x11, r3, 0x4f036000) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000070600"/17], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$nl_generic(0x10, 0x3, 0x10) sendfile(r2, r0, 0x0, 0x100000004) [ 495.524686][ T25] audit: type=1804 audit(1640058820.520:3560): pid=16397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/408/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 495.624793][ T25] audit: type=1804 audit(1640058820.520:3561): pid=16397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/408/memory.events" dev="sda1" ino=1181 res=1 errno=0 03:53:41 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x3) [ 495.654926][ T25] audit: type=1804 audit(1640058820.530:3562): pid=16397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/408/memory.events" dev="sda1" ino=1181 res=1 errno=0 03:53:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:41 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x3) 03:53:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x2}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:41 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x3) 03:53:41 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {0x0}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x3}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:42 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}}}, 0x24}}, 0x0) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000600)={0x14, 0x0, 0x100, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8b098f7c1fc4afd4}, 0x10880) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000008dc0)={{{@in6=@initdev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@initdev}}, &(0x7f0000008ec0)=0xe8) sendmsg$can_j1939(r0, &(0x7f0000008fc0)={&(0x7f0000008f00)={0x1d, r5, 0x2, {0x1, 0x0, 0x4}}, 0x18, &(0x7f0000008f80)={&(0x7f0000008f40)="312f130b7752d70b2cf847", 0xb}, 0x1, 0x0, 0x0, 0xe9e126fb15b8ec29}, 0x4000004) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}}}, 0x24}}, 0x0) (async) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000600)={0x14, 0x0, 0x100, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8b098f7c1fc4afd4}, 0x10880) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000008dc0)={{{@in6=@initdev, @in6=@loopback}}, {{@in6=@empty}, 0x0, @in6=@initdev}}, &(0x7f0000008ec0)=0xe8) (async) sendmsg$can_j1939(r0, &(0x7f0000008fc0)={&(0x7f0000008f00)={0x1d, r5, 0x2, {0x1, 0x0, 0x4}}, 0x18, &(0x7f0000008f80)={&(0x7f0000008f40)="312f130b7752d70b2cf847", 0xb}, 0x1, 0x0, 0x0, 0xe9e126fb15b8ec29}, 0x4000004) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:53:42 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = accept4$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000040)=0x1c, 0x80800) pread64(r2, &(0x7f0000000100)=""/217, 0xd9, 0x9f9) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14f8fff6060605b251c26a9e2066008000000008"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r4, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) accept4$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000040)=0x1c, 0x80800) (async) pread64(r2, &(0x7f0000000100)=""/217, 0xd9, 0x9f9) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14f8fff6060605b251c26a9e2066008000000008"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r4, r0, 0x0, 0x100000004) (async) 03:53:42 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {0x0}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:42 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = accept4$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000040)=0x1c, 0x80800) pread64(r2, &(0x7f0000000100)=""/217, 0xd9, 0x9f9) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14f8fff6060605b251c26a9e2066008000000008"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r4, r0, 0x0, 0x100000004) 03:53:42 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) recvmsg$kcm(r2, &(0x7f0000000780)={&(0x7f0000000300)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000500)=""/57, 0x39}, {&(0x7f0000000600)}, {&(0x7f0000000640)=""/24, 0x18}], 0x3, &(0x7f00000006c0)=""/150, 0x96}, 0x12025) getsockname$packet(r1, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x4}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:42 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {0x0}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:42 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}}}, 0x24}}, 0x0) (async) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000600)={0x14, 0x0, 0x100, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8b098f7c1fc4afd4}, 0x10880) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000008dc0)={{{@in6=@initdev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@initdev}}, &(0x7f0000008ec0)=0xe8) sendmsg$can_j1939(r0, &(0x7f0000008fc0)={&(0x7f0000008f00)={0x1d, r5, 0x2, {0x1, 0x0, 0x4}}, 0x18, &(0x7f0000008f80)={&(0x7f0000008f40)="312f130b7752d70b2cf847", 0xb}, 0x1, 0x0, 0x0, 0xe9e126fb15b8ec29}, 0x4000004) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:53:42 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async, rerun: 64) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (rerun: 64) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = accept4$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000040)=0x1c, 0x80800) pread64(r2, &(0x7f0000000100)=""/217, 0xd9, 0x9f9) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14f8fff6060605b251c26a9e2066008000000008"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async, rerun: 64) sendfile(r4, r0, 0x0, 0x100000004) (rerun: 64) 03:53:42 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0x28a6b5c3}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000000000000000007aa9e44a00"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:42 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:42 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0x28a6b5c3}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000000000000000007aa9e44a00"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:53:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x5}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:42 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:42 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0x28a6b5c3}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000000000000000007aa9e44a00"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0x28a6b5c3}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000000000000000007aa9e44a00"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:53:43 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) recvmsg$kcm(r2, &(0x7f0000000780)={&(0x7f0000000300)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000500)=""/57, 0x39}, {&(0x7f0000000600)}, {&(0x7f0000000640)=""/24, 0x18}], 0x3, &(0x7f00000006c0)=""/150, 0x96}, 0x12025) getsockname$packet(r1, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x5000000, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x6}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:43 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000100)=0x3, 0x2) 03:53:43 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:43 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, 0x3, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4010}, 0x4000000) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[@ANYBLOB="281e000007060101000000000000000003000000"], 0x28}}, 0x40008881) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000000340)={&(0x7f0000000300)={0x2, 0x4e24, @private=0xa010100}, 0x10, &(0x7f0000000980)=[{&(0x7f00000003c0)="1e8b4bf829aee5e4f064c523e34b8573e2b591775ad6522eb2ccfbccd1c2f3676431ee945c90f92440176d03200b55d454de0b7a89d309432db3d72568cfef17c8716b9465711c214c9394f2a8733edcab333eca653023e7a58797f058460c69fd36c57698cb8a63961cfe838cde0e076a680140ab20d57c4704bf713c4911bade8670f56448887260072989a43ebdcc76f2b2d8afdf6e396b", 0x99}, {&(0x7f0000000600)="485ad525c965b0ab3c85ade4073ca685f6ce7bddd1f345ef5831d1ef1e476a3669ee31f007d92dcde5e447ac7a91dee537274336868eb338340773b9919e8c5eea866c0abfa32857bb2238296485da8876e0c2192c16e4aa1361c6fd506506c29e9b524b8138fd1e9b914dcf3a2b0299449cc6551483dae63465fa67d68c486e81acda0e7262b0c1a95e4a3177d1dd0e553b424d0b6ffbc975a5ce00c5b2600effb75f8dcea159600a9ac17d02b5a143182b3efad729ca9d22cca81c5f", 0xbd}, {&(0x7f00000006c0)="79eb9a71b0288b8da20b69b03c619ff6f6d43d0009ff036fc2e13eb3cc6a385fd7f2ae7fd9fcc5b2599ab4ed698a5b76ab827ce0f442556bf4e292b29bb00deb76949790bbd2ac633b1d4c61a8e5328c24486edd55b9b43b562ee109095b721495e1cd1d592bd7225899ec7035962d0977cae0bfc5d3b1905ea56c5b36a32f436e956328fe28499d7c5f1852a187e13302c03910a3c06d0cec4f1fcb67910778fa47d22918abe305", 0xa8}, {&(0x7f0000000780)="4c3e763adfa73ce0c2db2eb89f95314dada5af4ef2bb83a88079c2132a0ada1513147e06f6061f330017c83ad39ebb59fbb751bec12b13ecf9c0bede19ef934e67eb7a67363d0bf44731b9ba216bf4bca959442d43746dc55c862221f44b07b0998024a661f4fe5e7d2741a0e563f53a1c7d382e71b8e93ba232f7945fffbb067ecb396d596b2cc7035de4774e8562dde2a041afc4459b9a44525fd6bbdd1003df452fa2b55fb57043c3f99c12935e05f1e83fd58ad231b26c131a2f4c07e192772508dffef3a3e938865a6b82432e163374f5076a528884bf4535c815d8e717cc62602cd3822c61da1bb000", 0xec}, {&(0x7f0000000880)="98839b9a44298dd8e50275536baa929a3426080d17fe477624a31d5d9a3c37b9dc0a93a9aca3ced92ce89b09fc9d83ddddc73e8394851affb92e0e2cfb48327d94a6b2a0ddf17c7329f3a44020f5f6d7e4bd8092da34a1ee2d1810a468f27ab5919fccf13c05d1905776802fd855b2b8c3f7d55cdd72e03ac3d9e061095659466e8725c893270ece0cd0dfd8034a44ad27b1ed5a4684adfb3646122ec10a05cdbccb312c486c11cbba95a4b74581e946dfdf974284c8ef8495716d1dfcf887852d6262c3d81ca1fa26206b4f873f1dfd0f41538836cc5e1032bb6c168af12e45945ee15e68b6f0a223c2", 0xea}], 0x5}, 0x10) sendfile(r4, r1, 0x0, 0xffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000240)) 03:53:44 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227ee", 0x16}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x7}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:44 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:53:44 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='hugetlb.2MB.usage_in_bytes\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x84000080}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@ipv6_getaddr={0x48, 0x16, 0xd09c1b616d310d07, 0x70bd26, 0x25dfdbfb, {0xa, 0x40}, [@IFA_CACHEINFO={0x14, 0x6, {0x38, 0x101, 0x0, 0x7}}, @IFA_FLAGS={0x8, 0x8, 0x5e2}, @IFA_CACHEINFO={0x14, 0x6, {0x7, 0x40, 0x8}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20008041}, 0x4004000) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:53:44 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227ee", 0x16}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x8}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 498.867920][T16555] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 03:53:44 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000f80)='pids.events\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001000), r0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000006800000008000300", @ANYRES32=r7, @ANYBLOB="564dff00000000000000000500002643586519de8bd6"], 0x34}}, 0x0) sendmsg$NL80211_CMD_SET_MCAST_RATE(r2, &(0x7f00000010c0)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001080)={&(0x7f0000001040)={0x30, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x6f, 0x56}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000041}, 0x24048854) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r9 = openat$cgroup_ro(r8, &(0x7f0000000180)='cpuacct.stat\x00', 0x7a05, 0x1700) pwritev(r9, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r10 = socket$kcm(0x29, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$int_in(r10, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r10, r1, 0x0, 0x100000004) 03:53:44 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB="9feb01001800000000000000620100006201000007000000060000000000000700000000000000000700000d000000000f000000020000000d000000040000000d0000000300000009000000020000000c000000050000001000000004000000070000000500000007000000000000010000000075206601000000000000000300000000040000000400000007000000050000000000000100000000670049f1722fa6ad44031904000000000700000d000000000e000000020000000800000001000000050000000300000007000000040000000c000000030000000f000000050000000e00000003000000020000000400000f02000000040000000600000004000000010000000104000009000000020000000010000022ed0000010000000000000006000000bfe904000000000000083a000000000000000800000d000000000b0000000500000010000000040000000400000001000000100000000800000008000000050000000e00000003000000090000000300000002000000020000000000005f0061303000acd717d9e0a3d2895aaf0924889aab6169b0f243e02a78e1ee78cc562a8d66f6c3ec226649ec6aaf39f4f96b87bd960f575ba1d4fd4ce9045780589d815da4debcb21fe5ca49c3e6ebed8907a87c49e05d84547a1539946e266e75cdf2651210ff953592e3751350f7e1822c5846a6837590a5f726a45bd859d70f3faabce322a28af00b4ce0ae2ea376d2892c97773ae319a03f8df87bfc9b36dd820d0c1c528ab73771060ca80ff66fe8ddcd7c2704f0fb466141a138b3346d5fc299469809d56ca1093b"], &(0x7f0000000100)=""/174, 0x183, 0xae, 0x1}, 0x20) r3 = openat$cgroup_ro(r0, &(0x7f00000001c0)='cgroup.freeze\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x9) r4 = socket$kcm(0x29, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r5, 0x8912, 0x400308) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000000, 0x11, r5, 0x214fa000) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) r6 = openat$cgroup_int(r0, &(0x7f0000000240)='cpu.max\x00', 0x2, 0x0) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r6, 0x6628) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r4, r0, 0x0, 0x100000004) 03:53:44 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227ee", 0x16}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x9}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:44 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, 0x3, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4010}, 0x4000000) (async, rerun: 64) r3 = socket$kcm(0x29, 0x2, 0x0) (rerun: 64) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[@ANYBLOB="281e000007060101000000000000000003000000"], 0x28}}, 0x40008881) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000000340)={&(0x7f0000000300)={0x2, 0x4e24, @private=0xa010100}, 0x10, &(0x7f0000000980)=[{&(0x7f00000003c0)="1e8b4bf829aee5e4f064c523e34b8573e2b591775ad6522eb2ccfbccd1c2f3676431ee945c90f92440176d03200b55d454de0b7a89d309432db3d72568cfef17c8716b9465711c214c9394f2a8733edcab333eca653023e7a58797f058460c69fd36c57698cb8a63961cfe838cde0e076a680140ab20d57c4704bf713c4911bade8670f56448887260072989a43ebdcc76f2b2d8afdf6e396b", 0x99}, {&(0x7f0000000600)="485ad525c965b0ab3c85ade4073ca685f6ce7bddd1f345ef5831d1ef1e476a3669ee31f007d92dcde5e447ac7a91dee537274336868eb338340773b9919e8c5eea866c0abfa32857bb2238296485da8876e0c2192c16e4aa1361c6fd506506c29e9b524b8138fd1e9b914dcf3a2b0299449cc6551483dae63465fa67d68c486e81acda0e7262b0c1a95e4a3177d1dd0e553b424d0b6ffbc975a5ce00c5b2600effb75f8dcea159600a9ac17d02b5a143182b3efad729ca9d22cca81c5f", 0xbd}, {&(0x7f00000006c0)="79eb9a71b0288b8da20b69b03c619ff6f6d43d0009ff036fc2e13eb3cc6a385fd7f2ae7fd9fcc5b2599ab4ed698a5b76ab827ce0f442556bf4e292b29bb00deb76949790bbd2ac633b1d4c61a8e5328c24486edd55b9b43b562ee109095b721495e1cd1d592bd7225899ec7035962d0977cae0bfc5d3b1905ea56c5b36a32f436e956328fe28499d7c5f1852a187e13302c03910a3c06d0cec4f1fcb67910778fa47d22918abe305", 0xa8}, {&(0x7f0000000780)="4c3e763adfa73ce0c2db2eb89f95314dada5af4ef2bb83a88079c2132a0ada1513147e06f6061f330017c83ad39ebb59fbb751bec12b13ecf9c0bede19ef934e67eb7a67363d0bf44731b9ba216bf4bca959442d43746dc55c862221f44b07b0998024a661f4fe5e7d2741a0e563f53a1c7d382e71b8e93ba232f7945fffbb067ecb396d596b2cc7035de4774e8562dde2a041afc4459b9a44525fd6bbdd1003df452fa2b55fb57043c3f99c12935e05f1e83fd58ad231b26c131a2f4c07e192772508dffef3a3e938865a6b82432e163374f5076a528884bf4535c815d8e717cc62602cd3822c61da1bb000", 0xec}, {&(0x7f0000000880)="98839b9a44298dd8e50275536baa929a3426080d17fe477624a31d5d9a3c37b9dc0a93a9aca3ced92ce89b09fc9d83ddddc73e8394851affb92e0e2cfb48327d94a6b2a0ddf17c7329f3a44020f5f6d7e4bd8092da34a1ee2d1810a468f27ab5919fccf13c05d1905776802fd855b2b8c3f7d55cdd72e03ac3d9e061095659466e8725c893270ece0cd0dfd8034a44ad27b1ed5a4684adfb3646122ec10a05cdbccb312c486c11cbba95a4b74581e946dfdf974284c8ef8495716d1dfcf887852d6262c3d81ca1fa26206b4f873f1dfd0f41538836cc5e1032bb6c168af12e45945ee15e68b6f0a223c2", 0xea}], 0x5}, 0x10) (async) sendfile(r4, r1, 0x0, 0xffffffff) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async, rerun: 64) sendfile(r3, r1, 0x0, 0x100000004) (async, rerun: 64) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000240)) 03:53:44 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) (async, rerun: 32) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000100)=0x3, 0x2) [ 499.479189][T16585] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 03:53:45 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) (async) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000100)=0x3, 0x2) 03:53:45 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f2178", 0x21}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:45 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000c1707e80b3c7aa7acc43173d4d1eb5ab"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0xe}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:45 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f2178", 0x21}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0xf}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:45 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f2178", 0x21}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:46 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='cgroup.freeze\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="0e0000000706050000000000000000000000eb294272319e33f0056e8a69"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@ipv6_deladdrlabel={0x4c, 0x49, 0x400, 0x70bd2d, 0x25dfdbfd, {0xa, 0x0, 0x1f, 0x0, 0x0, 0x6}, [@IFAL_LABEL={0x8, 0x2, 0x5}, @IFAL_ADDRESS={0x14, 0x1, @private2}, @IFAL_ADDRESS={0x14, 0x1, @mcast2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4040084}, 0x20004011) sendfile(r2, r0, 0x0, 0x100000004) 03:53:46 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5000000", 0x27}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:46 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, 0x3, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4010}, 0x4000000) (async) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[@ANYBLOB="281e000007060101000000000000000003000000"], 0x28}}, 0x40008881) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000000340)={&(0x7f0000000300)={0x2, 0x4e24, @private=0xa010100}, 0x10, &(0x7f0000000980)=[{&(0x7f00000003c0)="1e8b4bf829aee5e4f064c523e34b8573e2b591775ad6522eb2ccfbccd1c2f3676431ee945c90f92440176d03200b55d454de0b7a89d309432db3d72568cfef17c8716b9465711c214c9394f2a8733edcab333eca653023e7a58797f058460c69fd36c57698cb8a63961cfe838cde0e076a680140ab20d57c4704bf713c4911bade8670f56448887260072989a43ebdcc76f2b2d8afdf6e396b", 0x99}, {&(0x7f0000000600)="485ad525c965b0ab3c85ade4073ca685f6ce7bddd1f345ef5831d1ef1e476a3669ee31f007d92dcde5e447ac7a91dee537274336868eb338340773b9919e8c5eea866c0abfa32857bb2238296485da8876e0c2192c16e4aa1361c6fd506506c29e9b524b8138fd1e9b914dcf3a2b0299449cc6551483dae63465fa67d68c486e81acda0e7262b0c1a95e4a3177d1dd0e553b424d0b6ffbc975a5ce00c5b2600effb75f8dcea159600a9ac17d02b5a143182b3efad729ca9d22cca81c5f", 0xbd}, {&(0x7f00000006c0)="79eb9a71b0288b8da20b69b03c619ff6f6d43d0009ff036fc2e13eb3cc6a385fd7f2ae7fd9fcc5b2599ab4ed698a5b76ab827ce0f442556bf4e292b29bb00deb76949790bbd2ac633b1d4c61a8e5328c24486edd55b9b43b562ee109095b721495e1cd1d592bd7225899ec7035962d0977cae0bfc5d3b1905ea56c5b36a32f436e956328fe28499d7c5f1852a187e13302c03910a3c06d0cec4f1fcb67910778fa47d22918abe305", 0xa8}, {&(0x7f0000000780)="4c3e763adfa73ce0c2db2eb89f95314dada5af4ef2bb83a88079c2132a0ada1513147e06f6061f330017c83ad39ebb59fbb751bec12b13ecf9c0bede19ef934e67eb7a67363d0bf44731b9ba216bf4bca959442d43746dc55c862221f44b07b0998024a661f4fe5e7d2741a0e563f53a1c7d382e71b8e93ba232f7945fffbb067ecb396d596b2cc7035de4774e8562dde2a041afc4459b9a44525fd6bbdd1003df452fa2b55fb57043c3f99c12935e05f1e83fd58ad231b26c131a2f4c07e192772508dffef3a3e938865a6b82432e163374f5076a528884bf4535c815d8e717cc62602cd3822c61da1bb000", 0xec}, {&(0x7f0000000880)="98839b9a44298dd8e50275536baa929a3426080d17fe477624a31d5d9a3c37b9dc0a93a9aca3ced92ce89b09fc9d83ddddc73e8394851affb92e0e2cfb48327d94a6b2a0ddf17c7329f3a44020f5f6d7e4bd8092da34a1ee2d1810a468f27ab5919fccf13c05d1905776802fd855b2b8c3f7d55cdd72e03ac3d9e061095659466e8725c893270ece0cd0dfd8034a44ad27b1ed5a4684adfb3646122ec10a05cdbccb312c486c11cbba95a4b74581e946dfdf974284c8ef8495716d1dfcf887852d6262c3d81ca1fa26206b4f873f1dfd0f41538836cc5e1032bb6c168af12e45945ee15e68b6f0a223c2", 0xea}], 0x5}, 0x10) sendfile(r4, r1, 0x0, 0xffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) (async) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000240)) 03:53:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x60}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 500.558788][ T25] kauditd_printk_skb: 69 callbacks suppressed [ 500.558832][ T25] audit: type=1804 audit(1640058826.170:3632): pid=16618 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/414/memory.events" dev="sda1" ino=1178 res=1 errno=0 03:53:46 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) r4 = accept$packet(r0, &(0x7f0000005100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000005140)=0x14) getsockname$packet(r4, &(0x7f0000005180), &(0x7f00000051c0)=0x14) [ 500.726812][ T25] audit: type=1800 audit(1640058826.200:3633): pid=16618 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1178 res=0 errno=0 [ 500.797575][ T25] audit: type=1804 audit(1640058826.330:3634): pid=16627 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/415/memory.events" dev="sda1" ino=1178 res=1 errno=0 [ 500.855863][ T25] audit: type=1800 audit(1640058826.330:3635): pid=16627 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1178 res=0 errno=0 03:53:46 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='rdma.current\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000fa00"/20], 0x14}}, 0x0) sendfile(r2, r0, 0x0, 0x100000004) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) setsockopt$TIPC_MCAST_REPLICAST(0xffffffffffffffff, 0x10f, 0x86) sendfile(r1, r4, 0x0, 0x928b) r5 = accept$inet6(r1, &(0x7f0000000280)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000300)=0x1c) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000340), &(0x7f0000000380)=0xc) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={0x0, 0xa4, 0x3ba0, 0x1, 0x400, 0x7}, &(0x7f0000000140)=0x14) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000180)={r6}, &(0x7f00000001c0)=0x8) 03:53:46 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000006c0)={r2}) sendmsg$kcm(r3, &(0x7f0000001d40)={&(0x7f0000000700)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512-generic\x00'}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000780)="ef7ec8277ba9cd80c1a67e9c07139222785154feb57eee85cc", 0x19}, {&(0x7f00000007c0)="9dcae449c51752e5bb6b8a582896fd8054aa1f82369052184421c409fe00e8ffe71db679ec30605809238776601550e3d8b92c2d478f626704f1f822207e18e976e34dcb7d419ab81c85a2467377e323aec4a3d079965ff683d145e01bbae508f29bc10b9e5cebf097dce79cea241360e23beebc", 0x74}], 0x2, &(0x7f0000000880)=[{0x58, 0x101, 0x3, "d361170ebdaebf189b2b708f1b82c5f2fa595456e24468cfb25995b6ed5c58b75a711e3c522ee6e8f1a66b816bc6359c7d30723e5452c548643b23bfe46cf23e39"}, {0xf0, 0x103, 0x1, "9ece106c61c768723177ecb2f34c959e047c44129175089162ace8041a4337bd24d15106bfbf1fead5f69c7de83deadfa46394a2da22d2831ece894f407eac931fe9c92916c19f11f848638b3a1c7aff94b99ba77cedb1495dbab92b80f941285766112cdcb8d5a655d12bd9971785ec70a1f860dfba8e099664f5a2bb22c98716d2904cd243f51e8a2b18c52632631cefd8e5deeb3081b0d0fbadd38c36e4d05f5f39f27a3520bc904023e85ed245997a617ed003b7fed6550a96395568300fd31b19bf6327ea72f799ee0fc8277f68b256081c6e6f4223470999d5feeeae"}, {0x60, 0x3a, 0x7, "e58d8dda34c66bedc6626d3c6ca20e4b1914793975fe7039bf3570e74ea3704528e05bda5f706c92a4e0967e0ba0bea048f8e99d59121216b2642298cdb8a1c50b22cec6f38606ec54d5451ed88aa131"}, {0xe0, 0x29, 0x9, "d456a9e679d2e005b84bdabc1afb9f79462fcc41828c086b083e4312add2fcd8da69216de824d119844da7d96ef7ab0ef4a3fdd2c4251ef8a68264974792ee3eff7372dd075aea63ab21a9a8958c72472d16b78dba35dc10d330b08a8cb2ed5839890bb2b7412314f1f4503fe2d1485e210f31ae0cecf1982c0ce649a6afcb4456892fe44665b8719a2a4d8a508eec0490a2b1f367b491520b946b6df2e09579b6e1113fbcbaa7ff1da744cecae0805600020d24593d3cd52469c1d0b190002645a82b28331a37e2d4a278579e"}, {0x108, 0x3a, 0xf9e, "06cfff88146ad291d760f6a0e5b1c79cf7efc800730a1b7c0aebf4f4f3f10ac06d5f0872b28972c34e4ac9f584ef0d2c290eab94a7910b0e6a3a72acb4414234dbba5ae90c0bdb0d983f73f978ba5f54d3e11729160f694f71b3cf940cd633c78564fd3f49b2cdb4c3e7a7bbc29be1e36d443caa2690192246f5fcd5e33aa429cd3cc77f569b5eefb6c8850299684af0abb01f454e94d5263a541071fa4e94eb36799648e3743bd9e5d804dd17ca2f4492d2b947a72b241118387baa5b5b2dbdf4d5a1231e38d7d397d07e92cc56783df8875dcbc57464e763c110b8677a8c538c152e291a73d03623c9b599602533f7af5b4b120ed1"}, {0x98, 0x29, 0x7f, "2ab9c7cf129e2ebb5d4b1c02b01f766f81569031d842d4fba8003abbb0b54b1d8b150fda563437ea3cda8281cb3f87d84cced420c6df655d96e20afe29832a99476bc918785ab2db7f9b8d101ca1a4484cffc9a38ae7ae56e0bcf16158b966e6f7c98d39a837081378dab7db9c264e8b5152158ed0a63e6419d0808989cccf1d7fda78fbe6c208bf"}, {0x78, 0x3a, 0x8, "f99ccb2b3138548e6ea1a68e0358821b1d29fdf7942378e28b7e9c3bc4a4704256d81838aba9fd23d6be4d94dbd965a886a69f96ee2093660e067cd6658962146a4c4f8e6152065ba3a08729c7843a4a23fffd709a1b0233cc596fdc926ee777883b8202e42fb5"}, {0x1010, 0x0, 0x6, "655b59e0ed6637af4b9b85c8231616be5771c4929670ef9e27971b8d694f17cf4713ea8190b54fff5762f48415fd0c6b10dd6358902779afa6ea8d1039694cf419c8f1089877cdc5dea1a1dac9465719405cc1c06409728385062371a4d161699c346147a5f7c56db9fe50a82fe76bd3a9b6b222fd086cccc29c0a8556fd04dc87521ff1075a9ec08eb6b2da7bb1266b840a51fd7b6c7d1d1cd061393fd14473d4a9636aa532cc48cdf5796f1a82992b87796eaa63b885b8bf4621a0c2e4b9f5248cdc205364bfbeb8a1bad917848b399fc8e58cebf576a0b22f4a132d09b8b0c93c0556e7559fc3ee9132d9e6ca89def92538c4ab8cfd826044a55629b7caebc31567dae90dcc7162d1c4ecfa9db1427c7673925c98c192dc088f5a6946354f952a099410293d45166590a3ea34158b342f76ac91481dca8caaee0ab23e177f3c46002d0e29889fe39d9ae85b4b771e1e1670f386d6273efd1b742904830d262cdf8b7d1db0257534a57c92f3fa619242de085defa531801d6f496d3444f6452added9c5fd78aed980123e3d125d224a267b77c87ea649ce911e04c21e67b3fe4debc2c7c16f98d3abe74a9853f9be8fdbb58ba4a61232ea1865c5f67e310d2d3be8182223e6f6055e594adf214fa48c5cbcb413924e549488471d858f2fc871f62d1a554c7d012263114324b9402557cf46e3eab75c340697c948b5b02e8b2dcf0b95b3d8d187c1e9c084ac66c0ea204fcc011d80ce48abff6ad9d51a22358e112659325c2a6c80fb26d19bc7eb1819e238c5b9a6bccdecd3f2c14dd35581489a4c991afc5157639693d5df129c652013f2b30e2b45b15d1fddeeff272a3dc7978f65d5abe8572da82e497401b416498f07121ee0c4e4d0d4f33e6e20acaa9a52d5f99133fa588e312f35e6a40b006238d367dc4d98730d826115c4c1e1aebed946f50f455b0433d8aeba9927900bb9ba59f2035ef997f935d2f187be6a9371c5f02fdb110cedd2df12f8b47d3b7b98885e17f8a8f0b31fc5f6bebaaf6f0829ae5bcd29bd7e474fffa5fec897f5d8091715f4c11d1e5ede3876a54049007d7fedf5e137078be9136e2ecaf0df42d702b4a9a1d14c246d7c2403dcb2f8061332ee11d147697cb9d2c7acfc522dddbc221c69f50899c6259f759c59a23752e7abea47a73b0392eba6f001813df6713513ac169741eac4776badfbf6714bb158a686919143daf26bde795e9d88ca4b41f53ed0a53f61b51627a69dc4dde756bd68fa184814a2b5265b29df31e1af796fed91bd9f1e230093133d21ca69c82bfec4c23bb44a64c786ace720f6da8c33d38025d88f5261c93ad5fb2b4f02ca0a02d9a2623bdd15b65ce2510f02313dc79eb1625bcf2a2e290ec4d765e63d03d18e19775214156147ca43220433d117c1a93e9516244bd0074cd85e04780d205be425f4e9ddc630b5e1fab5731ef939f780492579aa97594a75f18924253921dc6002fadcdbd5c83239cbd57ed30e029c827fef92257385ce113219e5228b71e65fb25f26cf3175aaf888a0c8c112e26caaa6f2ce225e874799736048b7415c819ef41f41da70236286612c32986d3235e1a86287af121223ae6b494333b7bb0fc9532b8802f159ce46014e88399cc8ff709f91bfd1eed160920a4dfb2d153720b1fa3a2ac88b6f7a6439a702f0ed063d5c12c77539ef902624968ac6102df4ca0b6b1f8bae2b4ac8f6e2f4349f40c6e04391d0b4811ca20a9731e58f7d22ddd861e1876becf31476b74fe40d5c9a480433c6fcef2e61ade4555cb447d8f5c2b68082858a256996d43b258718ad9fad3c05ae8fe6ed3ccfd8af27ddb70acd63cd7946395544bb94371d451481e892649d74f85112c574c68b41ffb29439826d1ab630cbbccbe2f1cd0e10e818adca8159ff66c843f7ec5fd479210f46090a136fdc98acd3f529ea605b07a22b399694338453adc113169490eeba6508f580635568dfba33df189edbf67618459551856731d5cd1090acc77f5dbb9da82a60ffa0ab5ae748fae581bd17921bdf2923867c446e10c17ca35fe6d61225ad844c9e6ed3d2a458c914e20c049df5185eea6936bf3a3bb4cb1fe050e0ad70c91286a774494daa28d933d1d855b11117711c9c3dc5f3af267a1ff3b799e461be7714c636d905f2a129933924813c7dab1255399646a65b14ec8732d1ba3640c62b7799a005b810bbc402f32cbaf036dfe84894f28edba2087f62e4a30be4aafabeec73f2a6ec4a752836cc90ce7403f675414416594b56eff8abea3e956c155015de16757fe450a61a389241df3ea42e3f430193b8f202476b4e745061e42bd7646b7304467f308996eb58de5cb4394806f81cf5c54861dfa754d6b00e106b3ad10747d529810c9c521647b0080e745ebb1ccdaa479e190997722d2b3077ead32085a5257053affb41a015e6580254be0ab6728007466a537adb3890774de128d009ea2299eab24eb614de26523f25ba65db761813eafd8c17aa9463d2a3bc4e2cb84d5e37f02e67a1e99a67e140f7529b8d522249907b3c80c9c95dbb0bf29dc9072f350156320930275029b4be6ae016f257ed31d67ca1d8660d8a5e908fa3f2c61106e406479efb93e9abe2fff20794f6e0a7b993cb78d6c61b11fd72bbdcec37f7d498dec57c598f8025542c74c2ffb30a2c23ffdb3de2da014179acf5befba3108ae9e25756f30f85819576660479d908e7fca78205fe6d66aade1f5862ca7402d32690f53dc29911d4c0f62909056261374bf1c4f478a1eac0e117448d58ce7c9a32f4720e3371e28822d2a31469b4c929892e24c311e630f4a0bd1b4a4e6e1bdb5fc17a396c19b72f068f93768a55711c0866fb42eb7d943bd1efe7501b657c2162fb23f8619967bc05ee72d561a33481bc48c1ab1b01d0607a06ee7baf39ec35f4fdf9444172d5cdfba0244178224dee6f3d0afd19107840c735777d66be66912aec0f45d5aa3e534b7fb7f0c09f03e70a833cc1aeff4b839054ae792c5b3db9bdbc44f51c1ffaac4e6b2dce3215ce3e8ae3e3a2038c613a5b94f2a03a99631fd434bbaf40d606cc31b08cddf790a59f668bfad6c9e7a29176407114f0eddbafd4471cba4ccb0e351ed205cda41e8a5c1e8d70fde9acd7b730e6564ee72bd7d12b9c97ef2d1ae3b9ff854583d06a62259c453bdd5ca7d2546c5eba178fdcb90fa8b9b7cbae6ab48db8d9f512326b53d123c1a1219e32d9b53f61ca648dc23a9a9d05034d59333dac3a564e926ce90fc3bf7c04cb7a9eb49833e0b1a36b06d8a4e56c34034b30e82872dec4f93211b9f37c6f41742f7a034d0bdcd8f45b6254e7c9218bc111f746ca7ffcefed58dcd68a8c287816f07a1e00f6f7bdd4a90dfd3be728fadeab39573cc487b749f67e7d875a38e8d5ced56da5b84108e6d5515adf94cced23c953b615e8c6750992827694f640e694054e50556cb1547fa4189789a5ae1af66aa38385817848061bd1959543afbff38057dd0bb7daaee1f5abf3133ae3f9ca8d69d22be3b5a955f1f1480bd106da8ab93e5c6d66e5444126e0e54c17f39c3edce23967cac26323e088c4a5a73acfa6391505829d114ccf86453e8a6228ff63cab0179abb687acfc6ef09869c61f98bef43f41eb38ee39760e98342b8218a384d5d16e77ad7052b58243051d30a2f45f97c3588e58e1913674ded19b4f698bd8dd6a919ccaf536359cc8e5d5eb474773ea63328ba674cfb42c50e3985a010d9b0582623ff79dd1f87ed9fb974a8c415e08ba9d143b3035673e2a47275437d3a4894936955dc928119133fca0c9fca064441948d4b6043ebc809239180f596bc3e33a1abc514b2251ea7ff920cd26fc9e5b63713ea3fe16461599b43419894dc037b042b66d5a8d107c3ea7df72e860d56eea43dc0d655e3ef65012c408ca61b50bffa8e1de3c33bd1cc804bd802ca56268f73afb83be75411bc3898ecc3e50c61375a245492def0de00a14d07e316e9109277488111a761ebaec0251334412696d2fde3a40902b401d30f2f97f40ee6e01fb1833624ee85081123d90b8ac5ddb0ae09fe62da905b7ebb2f10db561836e0579be88b8703d13594672b625201ddaa7c426d8ef909b9e45298bdb58a6b8b7874f05a04b12d382650828515b8bc1f46d8a41ca008bc45683dd610d1c6b79ca44bd1af463ed0ede36e0b08fb8850ebfd8b1c147a3b4d9cc8ae83afc9f91c97265c44a89382e96b330bd3e6caf7b11b034ce30bab9179e7e2eed0e57c3a6e63a17120bc6c7fcc8e3262937f4ae4425f510cf48cf445dfe8665609f76d2710ab69b115574f72536754794635e9f3093509aa14f51800420335a7417c38acb765544e43120f0384d49cc123dc2101bd9442e2ce5afe3a67a95333aa913bfdbf0a54e34064d8e84a29a4e72f27132432ebc919877c459958df0dccb6db13cb310ee2b620a70faf9a26a0ad459139dac9e2e707f24740f656cac04f1af38d5bddf121ae8b05ec62907a93679550ef4fc2b8e88f5c7b3109dc755c56a2658f34fea59b7c51899ac91c139355479b077a7445635d55ae4e99a23aba71cb59bd600f9f8220a3c67bc7269061c6d8094fdad2ccff4c80442260926148c2b5589f9f0da196ad2e26cebee7edca87514638f964b6f844ea86990ef0d591622ca01f14ea9690f58a4ffd4821a7e189f78afd03d35eef0b5cea6c0197720f541b531859cceeeb40cdff250964b35cc0fa9314dd78cad05869a9e7a7e49ca8773f1b0ab70f0472e7108f21541e570e645feb1dd2090fca4f715e489c141bf63532f739dd8a596b4cc93fb82ced6a8b3665a39ef8c7a2364cea8539ee90783741fa5d8440b3da755e407368e858426980643e27de8264c42f922f0eff26924da2872d44ee26a2c89a1282902f9ee486803fbdf05502af53956ac4643b148adec26622f12fa1649cff35d135527ae7df119d2dabbf4daa0bc49e22cf75811ae2fa849d83bb664b41ffa684f54fa8b8c1db47cb014bae547a3ac9ce3f7af4501b90a8330ce0861902d9e420c579fce443ac7b18387ff0e811ad1a047b4ad4ea467529c18409aaf9bb33a3f06d557cca7de33ad65ad964c03bde4c6980aee157922db676cd83312a4c0114c619b42616ff4bf68a0f5d065001777414d5013c74ad086bcd023e8d62c0efa6c0c09bf378854c7b2cfa331293f37041e1300a301311dcb29e50466e2be0895ee998ceb33d395b2e1b5f31e506bd43a94eadc081bb860411a02be6d8d75804846b074918db896cd99a5187d9ffcc4016582bf8fe9ca14d5b43792153f565843c6a640e61b53814539ffdbb02886c9f4676d79c1d3b26ea052a8989a06f4896da8a955ff02472884b63dd56644eda9e6ad79ed1b5051f6440d7000ff149c0dbb454875b8e97a5532bbfbd8125f966588832ca67a4a7561ef62888380f7308c57385cba1eb36b12e8e799c56d69a463b77c6510fb6b59d334bca65687afb6d5a050b28788cabdef363ef60323a396f2687add51a89c7892bec05aef9e3a7559bc7715d06a92e0ea49358d0d59d7c7e1dda02d2581e02cc90af8376b721fdd4c16f76eaa4bd8ce41c6fc77bc9114e844a2346917d5b5bb4787628d25e3657edddc2ca92cc27801fd5ff3f8224e6a326d962ccf72b651f00cc640377ebd1354c958fce85096379d316f0ea4c40d39a42501976590476a9072261e7e0b18587e6bd02af6f3fde86bb8b183cf91bfe748edac5d979bbf23dc709b5905203f93ce8ed210af72db64b854f22313c1"}], 0x14b0}, 0x20008000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r0, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendfile(r2, r0, 0x0, 0x100000004) [ 500.888047][ T25] audit: type=1804 audit(1640058826.330:3636): pid=16627 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/415/memory.events" dev="sda1" ino=1178 res=1 errno=0 03:53:46 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000c1707e80b3c7aa7acc43173d4d1eb5ab"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:46 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5000000", 0x27}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 500.943951][ T25] audit: type=1804 audit(1640058826.550:3637): pid=16630 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir075148786/syzkaller.skI3GT/664/memory.events" dev="sda1" ino=1157 res=1 errno=0 [ 501.061113][ T25] audit: type=1800 audit(1640058826.550:3638): pid=16630 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=1157 res=0 errno=0 03:53:46 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='rdma.current\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000fa00"/20], 0x14}}, 0x0) sendfile(r2, r0, 0x0, 0x100000004) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) setsockopt$TIPC_MCAST_REPLICAST(0xffffffffffffffff, 0x10f, 0x86) sendfile(r1, r4, 0x0, 0x928b) r5 = accept$inet6(r1, &(0x7f0000000280)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000300)=0x1c) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000340), &(0x7f0000000380)=0xc) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={0x0, 0xa4, 0x3ba0, 0x1, 0x400, 0x7}, &(0x7f0000000140)=0x14) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000180)={r6}, &(0x7f00000001c0)=0x8) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='rdma.current\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000fa00"/20], 0x14}}, 0x0) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) setsockopt$TIPC_MCAST_REPLICAST(0xffffffffffffffff, 0x10f, 0x86) (async) sendfile(r1, r4, 0x0, 0x928b) (async) accept$inet6(r1, &(0x7f0000000280)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000300)=0x1c) (async) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000340), &(0x7f0000000380)=0xc) (async) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={0x0, 0xa4, 0x3ba0, 0x1, 0x400, 0x7}, &(0x7f0000000140)=0x14) (async) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000180)={r6}, &(0x7f00000001c0)=0x8) (async) 03:53:46 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5000000", 0x27}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 501.124523][ T25] audit: type=1804 audit(1640058826.600:3639): pid=16630 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir075148786/syzkaller.skI3GT/664/memory.events" dev="sda1" ino=1157 res=1 errno=0 [ 501.160351][ T1230] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.166675][ T1230] ieee802154 phy1 wpan1: encryption failed: -22 03:53:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x2}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:46 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='rdma.current\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000fa00"/20], 0x14}}, 0x0) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async, rerun: 64) setsockopt$TIPC_MCAST_REPLICAST(0xffffffffffffffff, 0x10f, 0x86) (async, rerun: 64) sendfile(r1, r4, 0x0, 0x928b) (async) r5 = accept$inet6(r1, &(0x7f0000000280)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000300)=0x1c) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000340), &(0x7f0000000380)=0xc) (async) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={0x0, 0xa4, 0x3ba0, 0x1, 0x400, 0x7}, &(0x7f0000000140)=0x14) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000180)={r6}, &(0x7f00000001c0)=0x8) [ 501.300327][ T25] audit: type=1804 audit(1640058826.690:3640): pid=16639 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir411123904/syzkaller.EJ9sGJ/631/memory.events" dev="sda1" ino=1184 res=1 errno=0 03:53:47 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e8000", 0x2a}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 501.406845][ T25] audit: type=1800 audit(1640058826.690:3641): pid=16639 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="memory.events" dev="sda1" ino=1184 res=0 errno=0 03:53:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x3}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:47 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) r4 = accept$packet(r0, &(0x7f0000005100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000005140)=0x14) getsockname$packet(r4, &(0x7f0000005180), &(0x7f00000051c0)=0x14) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r3, r1, 0x0, 0x100000004) (async) accept$packet(r0, &(0x7f0000005100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000005140)=0x14) (async) getsockname$packet(r4, &(0x7f0000005180), &(0x7f00000051c0)=0x14) (async) 03:53:47 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000100)=0x10, 0x4) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000070600271f00000e26b6bafa6c2483004c98f52df5ee4ae0e2ca0fbb684013cbf3"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:47 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0xfcffffff, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:47 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000c1707e80b3c7aa7acc43173d4d1eb5ab"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:47 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e8000", 0x2a}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x4}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:47 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) r4 = accept$packet(r0, &(0x7f0000005100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000005140)=0x14) getsockname$packet(r4, &(0x7f0000005180), &(0x7f00000051c0)=0x14) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r3, r1, 0x0, 0x100000004) (async) accept$packet(r0, &(0x7f0000005100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000005140)=0x14) (async) getsockname$packet(r4, &(0x7f0000005180), &(0x7f00000051c0)=0x14) (async) 03:53:48 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e8000", 0x2a}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:48 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) openat$cgroup_ro(r2, &(0x7f0000000180)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$NL80211_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, r0, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) sendfile(r3, r1, 0x0, 0x100000004) 03:53:48 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000700)={0x0, ""/256, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000000600)={"40627ac3e44fc33b3f445dd6b37966e9", 0x0, r0, {0xb64, 0x9}, {}, 0x200, [0x240000000, 0x1, 0x80000001, 0xe55b, 0x0, 0xfffffffffffffffb, 0x600000000, 0x2, 0x1, 0x0, 0x2, 0x7, 0xfeb, 0x7f, 0x6]}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000003c0)={"d75dc3dc997b426d4e085b65711afb4f", 0x0, r0, {0x93, 0x1}, {0x6, 0xffffffff}, 0x75ef, [0x400, 0xfd, 0x200, 0xedd, 0x6665e2de, 0x40, 0x9, 0xfff, 0x7f, 0x8, 0x8, 0x1f, 0x8, 0x400, 0x2, 0xff]}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x13, r1, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='blkio.bfq.io_serviced_recursive\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0, 0xffffff04}, {&(0x7f0000000040)="db", 0xfffff000}], 0x3, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x2, 0x0) setsockopt$inet_group_source_req(r4, 0x0, 0x2e, &(0x7f0000000140)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) setsockopt$inet_group_source_req(r4, 0x0, 0x2e, &(0x7f0000000140)={0x3, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast1}}}, 0x108) setsockopt$inet_group_source_req(r4, 0x0, 0x2f, &(0x7f0000000140)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast1=0xe0000002}}}, 0x108) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r3, 0xffffffffffffffff, &(0x7f0000000000)=0xa35, 0x1) r5 = socket$kcm(0x29, 0x2, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x800) ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0xae) 03:53:48 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x5}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:48 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e800008", 0x2b}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:48 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl(r3, 0x6faa, &(0x7f0000000140)="5cc229f95331cc6c43cc40afc11feedf71d191cda93fedb9465c7df450165f921ceb93e6eb6c2d12edff01cab30708c1eff0ce6d06a461fa236a22b24e9b3ecfbee07447aa7d8c16514eb56e2fef70e4aacf7debe3f8b9fa3d720be4923e9d97059789195972d20b717939cb22111e10f9d3f860c2c88c93a0064c93456060a9ecd24a61bcb19570a2cfa7e2950f4972aa733646ebe2750d90ba77169643a483b2") r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000240)) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) r5 = accept(0xffffffffffffffff, 0x0, &(0x7f0000001ac0)) getsockopt$CAN_RAW_RECV_OWN_MSGS(r5, 0x65, 0x4, &(0x7f0000001b00), &(0x7f0000001b40)=0x4) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x402) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400008c90060000000000000000211bbff1fc5538fb41c82da5991dc4cda224d52cae824b3854610e743c9005a9fb990629db8328d967b420644e681143ddd0b8f0dce5fb783e0d6164fa41e210fce2d5dd691c663f531dd78ff4b21134e9cd12d1bfadd62b6d15de7aa8646dfbc881bc0c0081167396b2128b7f437e0d714285fa85a1c6fd6e3b69b1de7659bca3d4c3e799788a4c8ca807d0f27adce875e61610e08a3061080ee43c41c6ec9aa97c48caf3b3b691961efbcc0597200a"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:48 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000100)=0x10, 0x4) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000070600271f00000e26b6bafa6c2483004c98f52df5ee4ae0e2ca0fbb684013cbf3"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:53:48 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e800008", 0x2b}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:49 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000100)=0x10, 0x4) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000070600271f00000e26b6bafa6c2483004c98f52df5ee4ae0e2ca0fbb684013cbf3"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:49 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x6}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:49 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e800008", 0x2b}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:49 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x3) 03:53:49 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async, rerun: 64) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async, rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) openat$cgroup_ro(r2, &(0x7f0000000180)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) (async, rerun: 32) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 32) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$NL80211_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, r0, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) (async) sendfile(r3, r1, 0x0, 0x100000004) 03:53:49 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x7}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:49 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x3) 03:53:49 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) openat$cgroup_ro(r2, &(0x7f0000000180)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$NL80211_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, r0, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) sendfile(r3, r1, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) openat$cgroup_ro(r2, &(0x7f0000000180)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$NL80211_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, r0, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) (async) sendfile(r3, r1, 0x0, 0x100000004) (async) 03:53:49 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x3) [ 504.217756][T16768] warn_alloc: 1 callbacks suppressed [ 504.217772][T16768] syz-executor.3: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 504.302461][T16768] CPU: 0 PID: 16768 Comm: syz-executor.3 Not tainted 5.16.0-rc5-syzkaller #0 [ 504.311264][T16768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 504.321330][T16768] Call Trace: [ 504.324618][T16768] [ 504.327560][T16768] dump_stack_lvl+0xcd/0x134 [ 504.332179][T16768] warn_alloc.cold+0x87/0x17a [ 504.336877][T16768] ? zone_watermark_ok_safe+0x290/0x290 [ 504.342436][T16768] ? __kmalloc_node+0x62/0x390 [ 504.347237][T16768] ? __vmalloc_node_range+0x574/0xab0 [ 504.352633][T16768] __vmalloc_node_range+0x883/0xab0 [ 504.357864][T16768] ? vfree_atomic+0xe0/0xe0 [ 504.362389][T16768] ? rcu_read_lock_sched_held+0x3a/0x70 [ 504.368040][T16768] ? kernel_clone+0xe7/0xab0 [ 504.372648][T16768] copy_process+0x926/0x75a0 [ 504.377261][T16768] ? kernel_clone+0xe7/0xab0 [ 504.381868][T16768] ? lock_chain_count+0x20/0x20 [ 504.386731][T16768] ? lock_chain_count+0x20/0x20 [ 504.391603][T16768] ? find_held_lock+0x2d/0x110 [ 504.396388][T16768] ? __cleanup_sighand+0xb0/0xb0 [ 504.401337][T16768] ? lock_downgrade+0x6e0/0x6e0 [ 504.406302][T16768] ? __lock_acquire+0x162f/0x54a0 [ 504.411346][T16768] ? kernel_clone+0x314/0xab0 [ 504.416032][T16768] kernel_clone+0xe7/0xab0 [ 504.420461][T16768] ? create_io_thread+0xf0/0xf0 [ 504.425321][T16768] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 504.431402][T16768] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 504.437418][T16768] ? find_held_lock+0x2d/0x110 [ 504.442201][T16768] __do_sys_clone+0xc8/0x110 [ 504.446808][T16768] ? kernel_clone+0xab0/0xab0 [ 504.451494][T16768] ? lock_downgrade+0x6e0/0x6e0 [ 504.456375][T16768] ? syscall_enter_from_user_mode+0x21/0x70 [ 504.462312][T16768] do_syscall_64+0x35/0xb0 [ 504.466744][T16768] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 504.472655][T16768] RIP: 0033:0x7f95fb85e2c1 [ 504.477087][T16768] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 03:53:50 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000100)=0x10, 0x4) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000070600271f00000e26b6bafa6c2483004c98f52df5ee4ae0e2ca0fbb684013cbf3"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:50 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl(r3, 0x6faa, &(0x7f0000000140)="5cc229f95331cc6c43cc40afc11feedf71d191cda93fedb9465c7df450165f921ceb93e6eb6c2d12edff01cab30708c1eff0ce6d06a461fa236a22b24e9b3ecfbee07447aa7d8c16514eb56e2fef70e4aacf7debe3f8b9fa3d720be4923e9d97059789195972d20b717939cb22111e10f9d3f860c2c88c93a0064c93456060a9ecd24a61bcb19570a2cfa7e2950f4972aa733646ebe2750d90ba77169643a483b2") r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000240)) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) r5 = accept(0xffffffffffffffff, 0x0, &(0x7f0000001ac0)) getsockopt$CAN_RAW_RECV_OWN_MSGS(r5, 0x65, 0x4, &(0x7f0000001b00), &(0x7f0000001b40)=0x4) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x402) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400008c90060000000000000000211bbff1fc5538fb41c82da5991dc4cda224d52cae824b3854610e743c9005a9fb990629db8328d967b420644e681143ddd0b8f0dce5fb783e0d6164fa41e210fce2d5dd691c663f531dd78ff4b21134e9cd12d1bfadd62b6d15de7aa8646dfbc881bc0c0081167396b2128b7f437e0d714285fa85a1c6fd6e3b69b1de7659bca3d4c3e799788a4c8ca807d0f27adce875e61610e08a3061080ee43c41c6ec9aa97c48caf3b3b691961efbcc0597200a"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:50 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x8}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 504.496705][T16768] RSP: 002b:00007ffca88667e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 504.505135][T16768] RAX: ffffffffffffffda RBX: 00007f95fa046700 RCX: 00007f95fb85e2c1 [ 504.513119][T16768] RDX: 00007f95fa0469d0 RSI: 00007f95fa0462f0 RDI: 00000000003d0f00 [ 504.521103][T16768] RBP: 00007ffca8866a30 R08: 00007f95fa046700 R09: 00007f95fa046700 [ 504.529082][T16768] R10: 00007f95fa0469d0 R11: 0000000000000206 R12: 00007ffca886689e [ 504.537063][T16768] R13: 00007ffca886689f R14: 00007f95fa046300 R15: 0000000000022000 [ 504.545059][T16768] 03:53:50 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.current\x00', 0x0, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000070600000000b889ae4454895af0000009ee2943388b84df5f8ae6eb4c30df82b5f410d3cec9200a5621ada5ef4db60a3a5e9392536f1e9f149f75fe9e00dea6e1698e703afd69d062b8675f64dd76ea12721ed59fccc2611048b7079766129d65598eccbc672acadf2e587155766a9a291daa961fdb0c6f0011942dbad954dd31b0edccc05831"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:50 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{0x0}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:50 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x9}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 505.171404][T16768] Mem-Info: [ 505.174816][T16768] active_anon:894 inactive_anon:81590 isolated_anon:0 [ 505.174816][T16768] active_file:8113 inactive_file:36119 isolated_file:0 [ 505.174816][T16768] unevictable:768 dirty:37 writeback:0 [ 505.174816][T16768] slab_reclaimable:20394 slab_unreclaimable:119424 [ 505.174816][T16768] mapped:28029 shmem:2556 pagetables:744 bounce:0 [ 505.174816][T16768] kernel_misc_reclaimable:0 [ 505.174816][T16768] free:1314087 free_pcp:5475 free_cma:0 03:53:51 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{0x0}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 505.346543][T16768] Node 0 active_anon:3564kB inactive_anon:331776kB active_file:32380kB inactive_file:144476kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:112116kB dirty:144kB writeback:0kB shmem:7756kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 372736kB writeback_tmp:0kB kernel_stack:11356kB pagetables:3172kB all_unreclaimable? no 03:53:51 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0xe}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 505.449852][T16768] Node 1 active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:2468kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:4kB all_unreclaimable? no [ 505.563434][T16768] Node 0 DMA free:15360kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 03:53:51 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{0x0}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 505.669290][T16768] lowmem_reserve[]: 0 2645 2645 2645 2645 03:53:51 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0xf}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 505.696982][T16768] Node 0 DMA32 free:1265772kB boost:0kB min:35676kB low:44592kB high:53508kB reserved_highatomic:0KB active_anon:3568kB inactive_anon:329812kB active_file:32396kB inactive_file:144476kB unevictable:1536kB writepending:144kB present:3129332kB managed:2716752kB mlocked:0kB bounce:0kB free_pcp:24792kB local_pcp:2768kB free_cma:0kB [ 505.836611][T16768] lowmem_reserve[]: 0 0 0 0 0 [ 505.850052][T16768] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 506.001534][T16768] lowmem_reserve[]: 0 0 0 0 0 [ 506.017549][T16768] Node 1 Normal free:3947756kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:288kB local_pcp:0kB free_cma:0kB [ 506.051250][T16768] lowmem_reserve[]: 0 0 0 0 0 [ 506.065943][T16768] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 506.079045][T16768] Node 0 DMA32: 2788*4kB (UME) 3223*8kB (UME) 1438*16kB (UME) 781*32kB (UME) 277*64kB (UME) 272*128kB (UM) 124*256kB (UME) 32*512kB (UME) 2*1024kB (M) 4*2048kB (ME) 271*4096kB (M) = 1305864kB [ 506.108043][T16768] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 506.129061][T16768] Node 1 Normal: 117*4kB (UE) 29*8kB (UE) 27*16kB (UME) 184*32kB (UE) 86*64kB (UME) 24*128kB (UME) 8*256kB (U) 6*512kB (UE) 1*1024kB (E) 3*2048kB (ME) 957*4096kB (M) = 3947756kB [ 506.154856][T16768] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 506.164634][T16768] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 506.181131][T16768] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 506.195203][T16768] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 506.214385][T16768] 18403 total pagecache pages [ 506.221920][T16768] 0 pages in swap cache [ 506.226220][T16768] Swap cache stats: add 0, delete 0, find 0/0 [ 506.239780][T16768] Free swap = 0kB [ 506.244235][T16768] Total swap = 0kB [ 506.252043][T16768] 2097051 pages RAM [ 506.256339][T16768] 0 pages HighMem/MovableOnly [ 506.265111][T16768] 384518 pages reserved [ 506.297617][T16768] 0 pages cma reserved 03:53:51 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000100)='veth0\x00') r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000003880)=@newtaction={0x284, 0x30, 0x1, 0x70bd2a, 0x25dfdbff, {}, [{0x270, 0x1, [@m_gact={0x4c, 0xa, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x0, 0x94e, 0x5}}]}, {0x11, 0x6, "70347465ba0fa17aea5b2971de"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_ife={0xc0, 0xd, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_TYPE={0x6}, @TCA_IFE_METALST={0x14, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0x7}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}, @TCA_IFE_SMAC={0xa}]}, {0x6e, 0x6, "66b9a2488162a86ca283da5eaa48333846082e1e137f27391551bc40dc75f217ed78975ad8a541a7993bef7f34bd9ef277f07bce84320048b99c786bc208939b0f9c24ecd43e1313c7efe767e0bb7d4c6d48a369a887c660043f8e321c0ec691c38be35dfae335f67c49"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0x160, 0x8, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x200, 0x4, 0x0, 0x8, 0x6c7b}, 0x2}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1ff, 0x8, 0x6, 0x5, 0x2c}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x1f, 0x5, 0x4, 0xffffff80}, 0x20}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4acd, 0x9, 0x4, 0x4, 0x80000001}, 0x800}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0xc20, 0x10000000, 0x9, 0x7}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0x0, 0x10000000, 0x9, 0x8}, 0xff00}}]}, {0x87, 0x6, "034a8f7e96941c52650c778f18372a033694ad3b93d1850951f98d7f2605653300c20362d786d78463c3298fd652d968076ca7fa16e1346f5b03a562c286706f7844f20c4c793567bceb38bc11491b8f907e3cfb7b3f71897ce04153794e2f41028210c09bd6b8af138e3ced63f850296668e44f92e027de998f0f6595fff9d22102cf"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x284}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f0000000240)=@ethernet={0x6}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000600)="8af003f5f059f5b587793a921dff2db99b8eb9c1a9effb036c0169ed019999114fe9db90002a385b686041ef77329e5dbc7b0a0c86655a916c7dbf670f5414a566509973f893d29e71cdcfcd45395194ac7e5fa6501d1454b6c87a2df98569b02746dc8836e98dd602fa44acfe1633700be691d6649ca08ac9ca91f775473fb4ef66cbcb79c724f2a2fd243bee85237bd088a0de6e555d1149fa1e7715652ea0d6b0a45cfdc7c88ea881cf6762780d175684248c2ed13a17b5390c301c0d82a60d11ebd9efd20610dfc45e97eb5abef7cb0023cb28d7b7d1e3456c8d55f634c724af35c0f6021f433f6d9d78b8f5dbe6ee371c075866ff08bdd85a4618fd5027c99d9f0ecf4fe6ae9af85594736c01b2350a7f105bb6f827ccfaeb8e3818c908184c9fa5a9fba0ced76b1d7bbf46040907480c1483e1755e6fbe48b544699a25b9257d2c9bc1025b814978520521079db364c9d6ffcbb03efa101adbe525f5afb89b2e29faf27de25c9ceb8c4648ebbd3e80ce2e8b61206dabb15ff29dc598ddaadb48e3d113b9d517204846c5d68823facd3c40bb8280a9973709f769dbf9d81cf74199bd482e6da8e098a6e0d403c4f1fe99e5c033e051676bee0d3404e956bb1319decd2593b717a526f1d3c51413e5f6f467fc5399e41e49b70880ac52071225ea17454c74bca6c07a801c663938133e5fbfdeb7dc61b8ea044da0da183133b3edeaf0b1eef719c44996f330b7cb5a6ea2bfcea5f6ac2d36e6bef233b8e397ccedfa1c7689c93fdd3a34174318634e89826acd7069a6c5dd9795f59e2fd740062b84f3b0be0eae86996bc9a2e924538e6fb440b595d82bd42cc715fd6a918db65aba2ff58137b735a237db13de913d715dd718f5f5e9e4c68aed26e05a3ba71911ce59c4bd89ceeda1d7243c235459b4e7cf492ba42552d787579ada7cee73934034d48d20f17766044e31ba70a5577b9e92b7d19de535230e912b4a842a0ace87d0ce4e09e24cac17ec246875f53c4de97d7b6eb05d82a89d9c39127a037ab1c16e2e21463be24284a68ea328238fb303586da25ebeb6c53790e64b060fe8b79a5c86a64584e3885166c6adf16eb557401cbb2bc8a43125f565a376d7c5dc46479192d4b5d5718bced118b02a84e3bb9816d1d4476c0eac6b8f2a4b0b3c12844a786decb3a91363564f8ad0841e0e5c0d84ebf2b97ce609cdb1691ac9b2c1f29d3f03266430d08068a03317afa09b0dc6b571281c4d31a2c3db50a41bf7dddc1707d3b9c4cc5402424a342ae96183b32e94b0ce232c4816a2e540bf61dc7ad6e182914c87256fcb298d78a1772f533d6a400084cb1a019142ea742669284186a5988434b4f98121b054da1707c2aad8fd1331efbbb594ab9eb5b2bd451fd08531ba913543c77dcbee6272c13674d1b7f27cf0aecadd72eb3aee81877b441ad04dc0a19b0f079e4f6b1864e90ff80e829d5b9067f8adf0d195866baf04ad82cf360d424ee2df495817c82bb789bcbbd1ae43e52cb9d41e28944e7d6bb73da9cdd2dd634590ee2d892c87f563831e7b7243282f494e6c9318b0f72aa202b8d2fc46fd35d9ead2412f9fc0e221e5242063b26be4f9d39167b73f5ad3ecfa476c8907e32cfaf15c2b6bd6da1e68076a805f46e4773d5f89aaec9737e864012a68af3822456fddd2b3e1826c8829e3b46bea8b21382724b2fa9b923f8ae33305e6adf8993582bb824fa4c91dfd52b7a79a9e5dbd8e791e98bf0c0ed6353452afdcbba756d7ee7889a33583c3f1d6129fd4b8547ae6355b969f0522883ceeb0aa0811ecc60911a04244773a6ba9f12cd2c0b96304923e81442aade19762e91419c695526ca99a49445908bebaeee0a540fa6c4db27bf2ab6587e6f551dba6bb036e7d3fdc652c679b17a3cf22f1a68e47f0ad263f7fc20447b3641a12d2fb736cd616cecacf75ce32f5e57f76a41c11b81012190228fe7e1cf836954336b9e6c26b68f545409acf441d3588580bfd70de0205a0d9b87467000896fa012529a51aeecbd8b3d12be673ec013c21086d82108675332315feecc3db8093ec8652dca5a709298e489c57f533623bc6563a83ce12ad626ac251d0ec25137f1ac1194a9483b2a531765246739a015643001f96d5620b505825fb1ac1a0451bc38253b28d75b53be5c66d5bca61c9929b2ab41e03e87351ec4ad42ca1d48662ae91121a6d586551e73946380266da01bcae6aacbef2c3a9845b6550ddf0f8bd7177340076c62b26dee8bfba293076496713121b8cba60f9308b2f0ada87529150a96deaa9183e6ec8db8ec9a3971f7d7efce1f481ee73715f31c722be048b6bea26a9c99388471f5c500bdec77410fec1fbc076a19319acdb71fa6eed6db18406c3c23b1aacd5e2031f4862948a351ef065a848208c32f307fd2098798b9cf866c40b25540dcd7369fdffd12df37b40760d6b76fc095a750d881c2ebfac72bd0fb25082f0581a918f64b3aefb58fced9d82c984cbf4ca961d6ed6dbf05f32393ea70249fe849a2d96c802cdcea222b2a3ed66071e7700d7730ceb205566f4081d7f5db904b1e10c876f05577c459ea35f0149bab40cb623df6157dff70e75b137f00119897a9a1a8172d4eef31373bbaf4789d3d52e1aa50d1344555a2e53ff8656c3bc239ea62603422b724f51c1bd3a42d640aa627b4200075cd3f45078b6df6810fbba1741df1bf97b0c7cc7c3455acbcbe9c4ffd5f99b4ffc7166ae6961da67b6c4e41ed3f61108d99686913cd375ac510a2cc7d21462c6239016f9a448f0ebd8141e375bfdc27dcc538d5f0a139d82d5c4356627cf9c687b1bc96389be772ff42ee165ff9fb6a857614cf435cac80d232f84f5f8f44903cbb4b69253fd12c727e37396cc7e68495449c8f29b5342ac2a12cf74b8be4294b4c6a84e360f38f6c90baf27a18f200f64e153b7a2ba5e57022cccb1144bced93ff27c8fc4b865794bde3d66b2e79a32a7ca79f865b8b15687d77c94cbf23f7c8d958f382e363d02fa16498a69006c7b6f0eb623c1ef293a74c7a596ef9371d86ecd46d5b36f4f4d5c449810b4627c463f5f3acf5234654a14cfee7ec1c53a804959fc748434bc8fcb41b0ef26b3e25a0a26a2dcf8d174ec82437f451804814113b31dd8238d7de297fa226a359bf0f190c72736762344d2df5a0391a9ba2e8aa08b5718cbf439464c694c7c86831fa8464290da624aba37a595c1fb11da11b01645cffd793b8e8a483ddb5ad7fc139166603eecb04362bb104870a589d47c89e1ced565ea02174dd17e209ce822bb4266e2ba248fac1da46cc615099caf173d3e238ec674b16dafdaf284e642a3b082873a4a787c623a2efd17d308fdcf55700d982aac32a35fb49f865c17c261bb42495b38b2ead223a40a188e4a62dc0d579cc474aa2bde6e87f4797886a377027730ea13e4791371980810504f3394c3d326366eaf80892567649e4a889942380f6f3c6c7030347b4663a170ca9534c726af6454f5db7e2838a8a6e1266b1c46adb36205df955dcf5322415c9dad36a24dc48517a0ed568b55ce9a724471c4b3aa961c521a5e25bf05301168217621d21c19acf1f93b3cb270fb8ab495f122e2ea479dd60cd1eee7df957405ae6e3ac237227d59e334a12e3bd02e80cca24c5248dc6f2ddf788785ed1107e5476b858a365e2f4543e306dc11d24e2b14a952576f9e8a18c3913dbe90de5fe77dda8ba67c373ecd9d768f2a621270ada0866619aabad68ac6ff744f8ac66efa14d605f66f09f2aa6fc123c8edb0b9402fd982ec7239ef7c1765893671b4c02b8cd172504269ad79d79dde8cbd7645770237cdc66b9ea02fd36732dfad3ee132157bd9bec5a4fe759ba66e36765dad2cd9cb02af3634658716e505b99dff4e3dd1b9ddf4b47bfa37b94fe5ab2c97bb521000297de1acff5469d453a1a024bc19330aac44fc039391d74f1bb58b46e0018fd5597bdc42bc89e9cbb02834b47acfcd997363f69d6575f99a4ed17ed9b7df3b495f2b52fe49b3d00679730e96d3c02986d1d6f2d33388f8d4b2cdd2565d846bca8b2dd079ee0aa88e9d3e82a694493ceebb036eb56e8891ff1fc707cebab9bf79ee1d0ddc752a7de1d94a3aab8316377403effa788f3b74c817c22108e70be33691475c51c316391bdec735b3c5c3dddef1bf2b96c7b6f1c8d239106339a66d2f81f5d77db425f63ad70d8ad4494e74d28d3ed404c84c6177c7e67e339af9f577361b0821ddb0606eca12418eebf78eb6d95a4bfba910b2f5538cae1678d4e048bc54259f8edeb1ccc07eb33ce70b85a4c4fca3181baed5f2faba053e6e45b37542bbb3397003c10bcb61182cb6ab97c39c7f2a4197b16568f3e9d1db95a03be9df211758a3440b576aa2f4c036558c71ebacf0d716e9a12792ce42a9081831ed3a7b6d0e254ee61e94b7fde3bf7ffb8d9da8477d6ae846e5400d3a0c5b293b5fd1a54a0b8b7a5980e7fe5d7bd46828f93b26408a36585e1e0f151a692b4fb883c64bcb6aa56fb4fc4d05d329ee2e7668c0c8a68c9706fa40f8ef9a84ded96d3035615eb5ae8a482e876317704bb681f9d6fe2c154a529c85653a20fa81e9d5daeb37f8aa8f8f4cd6c751aded2eafcffa6da624facb4c728336b7c2fbce1ad111a34b933b77c0763c2cc4406e4104a65399febdd219667b90597df5f9b4ea43536b309b4347ef1607d2a7f9e77184c08c34085fb2ae0baa2f4241bec55990769973d3b490c8ad966a2290e81f18675a18de949c118f5c94f0039639b0134655b5eecd59ef2c7fbef4c832f3ffc33b23de32377f00a0fd9e01d320fddde44e5454087aea030754b3f60d75c2b4dc28c2aec2c743b0808514a85266d8145a0fb287258e25893e065fd8921eabee2954d6895ab81efff29d4466c91f5b31ae5af90296914194964094977e7a962ece1ac82833a316cc3d408967f68e32d1290b2f7017e4daa240c83375cfa0e5a410b85ed8cae6b088e604576398e95a94f811e66141c9f7e8110568504b6c6a87bfacf8c3d1cee15af2698949753d287a15af342848707c72f80fa1539de4513f4828bdd0913f34648fa966deee51da94e066fbf7a83c293d620e7a744183cfaabde7464ff3bfce5ea17ba3eaf7d0a660f4f9af176d03332af04129546fb7d321bc98eb1ab291e5749d0172b9aece71624476b16599e670ef0461086963ec4db4887b12f1d433bb82b56cbda7e0df5057551712a2cfd920e6f48cdc7e4a47260e69e7809e3315663b73df2ef1a7d5c8b4075b421105c7c7444ed9bcd81ec7031ab1aae796aade0fac7ddc25d5a5b886f258097a9ace7eaea24797c17066530a063a51056b96576e10fb9fe6438bea0910f4c93c2523955155f79b00a5696c1349c26f7aa729e7568fee0b466040e5f049612cdc2d242f8390e53a9710ad8dad743097a90a267486c6c49495068dbedfd3291d03a90889eac3f3db7f2d2f9b3e0943b060699dcd37f589d492b02c047f9ec48ef8ea9b86fb461f18b7cfaf383ee8659a4c48162ad54c906cd183d264b1870cffeb574a4dd52d63b3094560a7b5e3e60502e56ef9981ffbae914baa22b2a645ff1585c588c483304cd7df37c8ff68beb030f1366bebaf42887de01484f73a55bf9d6f6b8d0493ba32d3f6249ad48bef2b39754884c86741ecdb8ff91ca4e86906fff01195e2160131d3324a676d631b1bb73c62112e2f275b4013d63f686515edd82afabbe1ad175a77796236d93365ca5396de429544f33b02c9c5c49ec1a3bc", 0x1000}, {&(0x7f00000001c0)="6b7ceccf83a3c5dad714bf642a5510d13afcc1d16fa28d9fdf5fd67f5f07c1ee0016c68ef80a64a67363f08c87f5cd90b811d0c74a3f1816", 0x38}], 0x2, &(0x7f00000003c0)=[{0xf0, 0x118, 0x0, "1d978c3e4abc51c9b87ce1edafa8612d0cd8b2549899c294b9929dcd5c31bf6f6724a3f9afcad07c967eb264d6c991f7963b3b9649e2fcaa219836fa2d7523d3cf7acc708d8c4e094593e766fed337ceafde29f3626ec79df46a96dbf06cddec97e8a5b4d241d94f015101a2942deb82c495fc1901a191d35bb974ccc94a553f7c46d02d637bf8d323cd179883bed8b3129abec37a2ebd871682f823bc04da8b5bfd4dd14c968b0c3f60f6558c454b1e4f2aeae18ea8db585ea687e31db0142091c8df4f6c8a521cef4818f9c9f458487d61c96dc8dec4238e80dd4359"}], 0xf0}}, {{&(0x7f0000001600)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @broadcast}, 0x0, 0x2, 0x3}}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000340)="ea76f93c0dc62846b90fbab94ce2eb42a4e9093f596262f1384d2d46f7cc16b373d9068142a540", 0x27}, {&(0x7f0000001680)="93d5447f47aa4c9978588dbfcfbf2650d74e1991fe8676ea8f40d9067eb6a2e606eec78f8eaeb7ddc8cab72747c2efb050496fb2b3be98239dd67e65569d724b297a78e31e0486ffccf3d86f7a5b9500612fec152d7901bd5ce85147e45a9e0f7c12037d73ab1ff4f201323bac39e4ef105338a391e905f79944f3b187603c6fb923b6da0cc81d24dd270ec8d0f9400d3c36b049556b7b64b2d25e1a2b9d27a3afebc4e588801b2735bdaf049f9aa6b748490efc8700afc559fb0b296cddef9dcc", 0xc1}, {&(0x7f0000001780)="220d5f8b5bf82502446e91b56d22eb76af19a609a70676f427f8062c3dd7cd4517c037bcb1f5fede35cad459ef198fcc42f20393e92006e85a6c56dec1903783540b800491175209f07f6f0e4cc30c5ea9594c7f2e2da289b1f59d43e7638c644d50502f66712e89afe0e3afbfb9425f285143707065981359073156d4f4421f7c843b2ea24f3a552fe89508866511c2c61bafa89702ee06e59e2e657a2e9f7aa17b824651444e501a1b284eeea60565eb3a48135e89dd23a78a267cd7b6070ae46a3907489be788de72e20105b53db87c9d9b78de51f3d7132638bc530d6314c54d3e9e31c96ae1d8", 0xe9}, {&(0x7f0000000500)="3d6dae3f13450731aa2de16c097a2501b5961b5b92130dee265050986eb8fb3ec8b70a7192fd65bd32e2dc43b2588e237d4d72570102369652c0", 0x3a}, {&(0x7f0000001880)="8040848e07449523dce4c63c8e39577115d3b602d5b3b7510d901cf1fb326c5d9502a68f45e8f04c0124e4e5a020bed1e028f3381fb6b4f47a95d70953d1f7ca025b6051c851f78b38c64a6b743756cf69ef9e680b9c2da1cd3a4cb0c9c8fb0591555f9dcbc059d2f05d41b0e4f57bab26aa28ddcbe4586d12b5270125c2bec60bee06b393bf9e01186512872b4acd06bd022f3cb5359414a31811de15b025e5963a77c64668bbc97c8ed6ddc6003d2651be0c7c7e995bbc029c676cb7c16e33a9269aec4023908dc60b9b8782104e3c7713ce4c41eb22eb323afa33dc698da5ee693554ed39ac44", 0xe8}, {&(0x7f0000001980)="331a01d8f8ab28b5627e91163aaf2243e540abad3cf266ca592e97c7c27c66e868b0da2bdd1023ef7053eccd163f041983eb93d8f117cc1bff10d13bb701d3ea18fc249e494d33cecf722f0afdab8d80dd0aa3652c63959616239665cd9a833ddd7f48f9efd12f98381f0e69b7c2f478406a526d20a4c2deb7f8d8de20a560246db7b122675b7016f0d44f146553f4ef5902eee5fb1b35f6ebea2a8db1b991e454a3ae73b363", 0xa6}], 0x6, &(0x7f0000001ac0)=[{0x100, 0x114, 0x35, "6cc1e97f145ee5581388777629092c17ed0e6b0866e53f04ab3026181c2f26bb5945728d405f776cab346a5abda60d610ea1c88bbac40c100c5cdfd5d22b6a64c5017452a7d75c3446988311001017cb6a41eb5bf71e177d9f53421aa3e04bdbac2d6a9f360eb4d5280094d918bed374afb9d7bc425c15011b97b2d292b32f2f4a615d1e92ff131d71ae4764589c52171981b21a6b644ec4eff93b68949357458cfb85dae4c1086369bf62b94e56beba8613e4887b98680430d5fddec0307a3055bda07db432469b88300679c2c382f45ac5b46baf2aecb1c2521f9f230fb86a02ff5cd8c59b168937d9"}, {0xb8, 0x10a, 0x0, "9e1e0747909a37269a78760ec4a19ebb368345b59cb340ba0b84649d88d5cd85adb62c20a5c4513f722e9a82768bda2b6138d59c455b141b93c856d0e4371056e5ad712c94ac592c1884b1fb67c1358729bcdd722294872aa2d8e96c9401b6aae6bc7a754524ae3436e6a7524330885417c19aa5547d1a4258c9310ae828ac03fbf310513d94b755474b67fa0e9bfafa4dd022209da21ac321ce2a42fd97a349417e"}, {0xd0, 0x1, 0x3, "4d6d6febc7b0fc586b23143d418d3e7ffaee7a17f11e712aa74eff0d668a492485df417b503e15ceed9986d80a9e419d20c5108c4acb714ab50c1c9951b3db4f0f59d585a6672bbf9cda4e443e6d5ceb38d2718be2c346a30a14e433dfec235bba2591ad086cb98b846e1a7f1f8a49a6a7fcc0ad24ee453a2ddc1d93272c28267c40cea663cd5b8d44127b0262d98a0b99665f2a40c68cc98c9f5d03018ee38bc6cf213be497670210e95007a0cbe801d1d1012d94180e243fa5493b"}], 0x288}}, {{&(0x7f0000001d80)=@qipcrtr={0x2a, 0x3}, 0x80, &(0x7f00000023c0)=[{&(0x7f0000001e00)="3d62fd9460ae39ee3956c546d57b9536727e858b4f5ab6ed637260bc85a7ef75fc54ad769bd727b4bf5ae02f7d7d78ecee8c33ef4372e94a209eb278e69bb58cc109c9f5fd38c96609de2e9cacae3db71d8c69ebad658eb125a5f39a2b3b2717cc3afff8de5d9c84d766403066a06b198b39cd8cff7de4a38c5de8e2f8fc707536a4cbf4d1c27441e9f52c1bb9d743e3d895b3e8e7beac554dea27af626cce32899ea7aa6e9eae0d457070e961824ddab099ba9f63477975df6a8ace6b3455df57aa2082eb30ab7dd0507f1edf64b19f121a448d0af53e24", 0xd8}, {&(0x7f0000001f00)="c4a31c191ec3c7b2f2f8dd72c059ecdff89d470feb8016daaca2708c38b0dacdaad7806055bf89ed4b2bfb022d8135ecb9524ffc0d07d8e5731f3bda9b270ef30ba1ea9628fec84e69c260b09c9bd49e", 0x50}, {&(0x7f0000001f80)="d408f9ad501437d05e50719ccd02c304a81bc5d7f9c8f1f91dcf069b13f89d94cfeb72685c0c25868de028a4838319c6f095804f9651145a6989a436f6302ee3916f6334340e94d858ea54f987ded380638de8b57cca23a3c72521bfab008784ad6272c061186240ad3bf2e64e983fcd1484711715add661d59d73be15cefe627a35bdd2c32c8ab019ff4b5a3e5e82e85a5878f237da6574d4c44051b43fda88cda79332fa30dcc1b552e5fc101bf82ea9f00c6e067c5f7c8021e80cfa5ad8884ff90be6226c178a8a7a2c12776467b8c72f75cabc81a9621db026f614fb", 0xde}, {&(0x7f0000002080)="8882e8b06a8bf9a166fbddc230cbce525fe792", 0x13}, {&(0x7f00000020c0)="7f651a61b3d87faaffed98b7e1531539e49b953303d7aeddb8e674d3e1af21e639fdf2687fc10ca80d40cd6b882d274571c4269b1a2911b5386d0d4e6ffdbdbb5f74c637edea59feaefc631306dbe6abca47ccfc04f27bd81e588ec410aad0e5bb8d17443529045b4b6c51191ca5bf3c0dede7c3d337919c3d106e6c3cb55e512ca7b7192083fa467d843211da02c3136512fb426758410a257a476fbccba18a2734f0658c8ba4feee01e692467f3758491760222934ad3c4bfd044c5e27ccf250039f481218c9f23b118185bf56ee3b0bd1cd0c0fbc5cc7a7", 0xd9}, {&(0x7f00000021c0)="b291910ac597d0ea9dfcd9e6b59378c9306920c822d7fd1bb0c4802fdcd46a33a26a9c9a377772b67afba2957d6d64792b1fee7318a42b71b2777c9cc31db05f69d34cf2aba4f58113fb74f6eca3668bae8e51917271aecc362a998d0862ff5659d35922489f465c87d47c60b24674e534e31df895fa9cd52af98c4494d7fa2b62709e475c66e2a09af85b5aac26523c1425e2a0430bfe", 0x97}, {&(0x7f0000002280)="ec090367322913e496b95adcf483d7ccd4266c2982d7c949dbe5de0ccf5c9da49dc037120581a82c161d7ceeb731399887249b94dd7ba4cb", 0x38}, {&(0x7f00000022c0)="1189eaed6a5e25617cea9c0e10a2da206f391fcd2abb31e9ae70c4ad77890da08cf68696aa579706c082989b6d2d5010a8458c21ddbabf42dc78ac5bdf1b4223c5e22b29fc7fc1410d0b6a010bce949ce7174ecff09e09fd84689d2ed3475e50895d6fc696f3d03e6d7ad280a87e6af4398c386b0d5005ecbd289782d5ead67d26d008f877632dbe1c1930482f37b3af2397a4e131b18ea091e4e807c35f52c4ae9b231fb89f4bb2112e06c9b2bc9d5eaf5c50aeaaa38c312c8edb7f77a982e3f19ae57849d6134120fa34eb360b1b9e36747e761ee1f949d0d2ba573a29087e8078", 0xe2}], 0x8, &(0x7f0000002440)=[{0x50, 0x103, 0x3, "59a543bd47f7a24cbc9a260b5c8ed7e16448eabc23b570a67d2958ee2674b01a08fa56bf13f2c5aa91b3960641cd4db0c807330d575ec6f94258"}, {0x28, 0x101, 0x9, "0990f0d41c38d15d9a5e8092630bebade463e7e0398a4c"}, {0x110, 0x10d, 0xfff, "6dc3279f51e9396418acfd0940837d2ce90701d0c6c5fac69862f0d26f8790882fe1bff33a296ee38a3cc1459cf5c8d4f8c0c555db2914dfb06e4e116e04d15d18c036e54a9a68f85a8bac3e486862618e630bc48752a35e96ca3665161fc14d1db8178b5926b726d5418a210ec82b4667aae28cf7aecc6a5527d873ade1ec40c2b7a7aca8c33cc77d8d4d03aba80fabea5c49272c8eb05d71a8c4dd00e329483354085facd5f27e9935f67b6eb6d33b3623b7c6897bfad6344747e985b57e0f1dccd0666d130915f42607af68f700fbc911c3dda9ead887a78dbd8b0ad92c853322c52fe4f655f1a7c285b444bba65127e721ba7989b17cfd81"}, {0x18, 0x104, 0x7, "f101d6774b"}, {0xc0, 0x3a, 0x9, "c3ad628c138488e61dd76a3eaf169777c57e3e4e08662458766819df278fef64578ea757bef433824e6779af8717d53971b0ba4556037651793a6a83939f26cca1e75569fd9541a2fb0e39076b5f12cba9f25a9901af2027a52bac13918c8a33ea0b02a5221b0ecec28c1b19303324d37a0ecd99a3e77cf8e06b24441affded1d8f4d7faef77a124f1e5dd599d4c7b41312ef0ed02211f43e8fcb98374fb45820f295f928fdd49914629195a60"}, {0x38, 0x10e, 0x5, "e12c61cf8b92503ec60551a31e25b42a9b852587d8fa4499e47e34e313e0052805cc37f25b3a"}, {0xa8, 0x1e, 0x101, "e0466cd760d9b61205adcd052c65b1f18046aac0110a9ec0850f7fb3057bb03cdc8cbbf375363137f16eb2243f8a0604bdbfcb6f7ff90ab343c8c1c2f2ed28ea21001e2f32cb6190c1a1216fe8ad2488cd17a0c0300865f156c6c51e8b20ba81aa934be37e8b65f17360e3926eed2031639ff2962dbc3542734b7d6d137ae62f5edd546ab755f011f1f879aea422ad4a1136"}, {0x1010, 0x117, 0xfffffff8, "5ccf547a24df6d5a473ee7015840c984d24f83cc58845907bd07a02d13d0dc35e18667d1676b9f0e5460c10a50f0aa41126b7ba492998f0d4e104e4af8ea6ec88d6b9cb2012d462d3533c2568ec1110ce4418588ca0506b0613b8f8e210d468cf7e994c541c875f9cf769416c58897a812de95da272ff18cdfe9d3ded6133a18367ba51887f512b7120568d249ed299edd0258c99917c5cda1bb655ab69e971b957baec742740f2b264a329b65833a4ca469256b3c3d43759f53e504d8a71370bf256fdcce15b99946fcc1db048a738018333e0990b0224ebd3a7c88ea2661d0bdf58756bc165ab00ce3c432d8a30c156b39db63e02bbce467dc07e62b692a69e979b0c062afc7d068d12183a6d8ab71db5a65961d1feda761b39dfacc0132241ed4fea3f4feb0061b4e932a60fddcdfdb03a1769f29f8bb278593e6decafe77dbb553f79c7205b352680f2d1cd1de46c37de23dd7f3122387d27f3e98c0f001f9e662a5ccb201bf33d537d4113037a61f87c6de5688f18e5430e4f8c858ce98ce8f97bcbb5491c117723a11a5db64dd365b30d0b30c1a99900c4a02b7c7210cb2bd0880cf654fb828dbd412f46ea3011625c7fbcd85704b881858f4aa929a42ad364a6bd7139e1d2bb15992d2ddd47922b1a5b5868e27c3380681d15ab78fef315510cac484255980f52cea3b0f66ebd7c1b347212b9653bac0278df39a96f93e555adc820f5d8745f79da9089a52d78d7146c76123e0d0355927e849c463cb2b5d04f8e2019e780c5226fedd5e6f204450379e958a2c6c3b5dc2dfa8ce1156c50a617ecb09e14dab39768b608c6e212426c7898402574235b04245f138443b1617f7061d454d5a626fd4d77e6144c2507cb3bb2a26babfc6d3024aa5ed66182c87582d49f69646ef153a34e87299e004493429554a62dfd166bc33fb14a4f148d30e31fdf93a4fcd5363d9c3c8d4054d3746d286d515b0f3b76af6203bfb9beaabeb08c3427f40c21c2e1d7d423bac204310719bc9a07e06ff902fa60cf50af4c8c92cab994639c8a0d8cabe84566cf2891fa9e28a52c714e54fe289d22bfb678589f6bb3156bc9eed5c8c102de63a6364c1971ac585fddb2afc75511b0b12fcfd4e14dd1abc26ccf7342b72bd457cff6a6795a8054f5cb389db11243e2f2c15cca6f4b4f03b395000909a82b4e47c8fa16e42a988ed482ab31fa2f58af6589ad5e72a394cd3c0145733e91d9da920967bae15260aecaf0eff69a0d9b18562964f20a8badb2cd50e59fe634781cc411bcdfdf85741b1becc82fc18ffe7e975965741d09c5afeb448e093d904da5a676e2b10e525101dc1224c92fb99b3cacdecb0dd1385889549862b8c7b2757e11a22b0894290b5d1d370a614f7764bdb0a3cb8ffccc62c8ab8f04110350b0aea2c6624987d38c533d74613a28f92df90082afa0aee0f31437aa2e9f844502cd441212e81577b2b7cdfd5f7e1061fab709471adcf98aab8e2b0ae34bdce5325942ec3a1b3d4a305def52c4dc88fe302ac76d10f342c19ce5ecf52df7417218b2a06eec913c8204a43f6f9788d833519ae22d2ea7df0520710333fc75c283c486284c9e19d494d191c091a3c3f7dad8169d57d9a739117c583f90234fe46ff48d1cab2ceedb533e6476733d038a73158d8924c7c4cc902388e5df7430e5da56e090e9c5de0c5d3f49d34648b2685114816707e66312e2a726a7f31f624105dde751b4aa06c07393f475b1d887531688d6f0ea17bded33827fbc0e9aadafd690f2cdf5370e15417280c5c1ead740c4aaffc3300745696767315002ba9ec665866e4de4071cc91c425e237320cdf187f4bc8beec0c37449afb6b3efc04145f485a5790d8811f6b624b37e9af3f6363db483089f68dcd5e6ee93fa795051886133a6e9e00f0b917b66c9573b5a2c2fdea4c87928c78bfcffa7606e2e356059eb11c531186938298b5d704eb5d3b3dae43485a5e8117f67b64093fe8004f68b13af3fd683fe4301c9666223782dd4623852f75e79759c2a1a56e1f9867c46abb5b15d56834babef551f080b81017e503e79cc6a3e383871911a7b4b18b98744422bb68acec2d7c57381722797f9a97fec1e3400c6a6a4826e2651555b41cecbdb235ce8bdc9f743514eae6c743e6c3dae45285c23694407eaf15dc543db18678e7a4166b5e10597ba79435384dbda586192234d18f1d855119596e6862bf8706706166eb6f764fc8f96bcfdbe510fb8aaa24659449d74ee598ed03272bc0756e6ec57596ad8f0a0624a1c185ba3894ab66a44299990bdfc848fae6385cade7132abe8da9c00dcf3afa7656dbd9c55c244922b0c4be562c2d519888b31f1a0a90d3d8761d0035ec998042ff6c35c9de4cb3e76ace78741049ebf5367416f6f567aeb03564b0ab22e2ebe9641910f548a0d50a38a752b2aa11fc6123c0806d3f224c4a20908581cdd4332db0cfedca1522c68b90e64660be931dbc1024ad7de1974693adf3da57207b0d2acd4925edc31e158bc81b072869766da347de0b51436848ed61211f175a14724c4a41e0633797c0fd1595d2903f84ee1213662f72cd03648f3d7f71fb25be9160b48cf1d7f0f094e07008674d4987eff52cb886c00e649ad703b8042a2c660da44921d49fcdbf1d6af9750a0425817a3aa2ec2fa79eec124b83820b659ca3ee2a3119453cc5675ff27d7ab5f852693666b552dfee24a57fa1b38946ddc18e78888238f2837ee5d903616caace945b83c0ea95714e50f28622856abf328bc7b68168eb17d8f3dfb33642c2dc6f7a1c59f2cc486f1593fabc281bbe3bd54a60e8004d81fcbe1b836aa6a9a2a77bfc31de7216b11e557c5015c4f4d0ca777d55fa3ff39202f4a066c6bc7a454d9cf9c6ea2dc3350d90a91f34ebf3fcd5c61dba67ee5c57f5f0552a040e9145a5a7316cbb27fed5d954a8595229a901c24fe8779b118b9200c6708fe6a49ba8e9ba220824a7b669a8dd94a325636b4ca8db825e72d6bd6f9e499af3b720993a4d45a8dc7ceaf986d35b17b46334d658866480cc15af72efa9d52db80f461c12a090b7b5fd5c9293d8cd4336c8c5deecf005c04bd405429b63da79cfcae435fc6195c35a7b7bafadf867f2ecab4f990ffbb5d5b8fd4445a4cd05f9b697c8bc1e759efad4c19cb9c499feec1e9e41df03d0abaa7593afcea50dcc3add1c6dedda1567029bf970b46c9c064fef5be1c4a9d794147d74ddde4c7afda130377f926d44dbc1684a31b40a88f75b4e17fc202af06f7fe5b04e47d42a55317e296c9345ae80d81a1c8aaeddc53512a175259e16c6727b649a6cf6eca0ef776fe5e30ff06281e30534ab35390fe15eb722939876000a353032f2f0db576bfbaa2eee7e73741152f002b9b4c8c0e1b2e2e01841b951a85a1b28c62bd9e90af2d8b279c9a9e8c5e86fde2916a16177d891474cc58e0dc54f4916b1e9846ac9bdd71639ce4539398caf4100bec85b713f13a6cd9d3a278dfbd0fec49c844cc6270f56a4c5a413213650f39f30754c6cf20b021a4bc7841241e9fef2b6ff015e654b111bbb95fb2214e0dc4802ad933172ba7fcff633b8d7f67a237ca8a6ef1aeb29f3bc4d6f786cef973d5e72509acbf02853bdea529fd0a377eab21dcbe37cd70f8459befc9a6a8cd8d77c96b7eabe4feda7452bce1bf8e1c01b690cab9be0b87d481ec74692c3a45ad7b01d15411c3f8d33dab3da67dfd7de44283e372daf4824739cd8e613f9d01f5df627fd6c018b2f9521ea543a91ccb9de5e10aab8150cb7f1725ee66083141542279b052e926445015b7b8cf8d03d84806abb1768d206be36e3f5af4830cd74f0cc1b9161ff6ce33a81857621bc98fe86fe705c12f564f6344007eb80cf6a77baf84b6fdf647a8b442dfc4b0894ee4b00658fda4b792401521f2cec583cc73e4691868fcc44952e10ef07ab9abb6ee9e61ee365880c013c9eb4cc57c87b3172f5d329a10ee20697788dcc49244d25ecdc82034055948287f10fdb60f09aa46414a477b6cacf9b7550635d8fa844e01f88a521a483249c6b5b941f40351d93da31cfd6a8b1ebcf135e0cc79fdaa6401837b6fc9812e34d770cc647f8b52848210ff932c72e88fe5f2093c7c95692de806ea5ca51529d80b49b296799d412abe9448d3cd6dfcbb781dd8f892459dce7af8139133bf5a6014928114cdd0ddbd57230b5a3cbf9c7892952cf5af5b97e600066e0a873fd5da99ad1b9f5f98773ac9ab83ac6303ec5d8450f75f95993daea933de6d23579d23d2c040dd6e511f103cd741607f151230b6c4e17ad3ab2a786def02f15f158891cab67de3440e5266bafeaa4e73fd7c820a70a3ceff3e5c34c2f379257766735f15d3c3d31df6b5a9d188c0df84fac489f84a23dd760723283a357caa379152f1aac900bf859b2bc25bc688a53b4d5f6de1b3b51c8d8172c97b757d975c6c39d14c3d0ac7b3f0bca3e7d77aa069763020ca034f718e6c8599f32d42dc41544059883b9df906134e26bb6fd055cb410a28b27f9c6f78292b5d2c6525139d8b69748ff9fa4d61be7fd36bf609f4e555834333424dcebb3bde5b91a9a6fedd07b41ebfcc62bb56dee8a9dbef68dde1574888c3fbbbc0d2f8b532d8bf9c9e47f464a7dc9b86d5c59dca8ef2dbad9eb00c7dd173f887f99ceb54e768337302d70c358e2415043c7f66b7f1b76aa0cc077f0c56d572dec5555fd7e25f1ad5a00f9353bbe54e711276fc24f3b0628820137dbe2c0368a38893a7359a69d7d1be743c9d14af1a4ce292f9d3a71c935de5a6fbeaa5e2b9b97b7921420a60bdb4cefdcc1d7327dcf07a99054489e8d8a807b83a8ca348d509cf5a08d30b71a007beb5c2be58afdaf105708816dbeb3d64ce38fe5df7be8e6176e38a61401f35b1ea9dfd9ac0de6bc19072d9f2690039629faeac386aba60b6744b0c228166e765c376139a5ac40fa6bd4a1dc0506c913cc361c5979a10c908df50c00cd0b0c63c0df30b2f43d28692355e141373c7219359fc34afecc5a594292b636c4577166cd15e0a7c9274050d45da7aa8bc0a639dafb26374c813511aa398074cb808257537fbed49a5f3e1022e6dcc9a918dd2c748b3fbf0d81cecae16bba49ade278ecfab77b0a180fc443611d9a2b76261ab4850d3967d43e98095109dbd7231861f84bcfb3f9da56c60acfd89db980d091afc28bc6a4e17e3cb9bffa8f54a078d51fe2f7e2b99a2770cb817c60fa2b484327f8ca98a4cb6a2c3a8770c93b0411157e79c5f9beff8b0bf4df7020f5cbd16a7dafd37fd5b8c7493884f21e5937dde7dd0befbd88d8497b5387a74f7b00a58e197cf49b644545e03713529dfa7b37dbf6d8e27a22f1fc5beb21ef29ee6b840811c075f0d33e1c37ef60a5e79714fe8fc3520e555b93fd6cff2f5d7ab46c84b811b5236d15dafd4b1c3b881a8c64a55b1526ab766823494861c718280a128a770f3568f44761da1bfa1d527130f63512a610f3d28a3cd73a3c263b486339da9d51d8fb7e5921589744dc30d3e9a1fa5d4be2f6d19149168edcd048745bf29ac36eb9c2bf78663184b25f25d51bdf717eebb0bbc0026336664ee12ebddf8fa7a058211ad3c579d0b2a954bbf0b9a0c9c65f0f3c946aeebc0efb64b70e03accd46f4d8e983a41d2a26a3ab7285419cd7acb66d8c945608359750e2154666f8c46868588f9887bc65991848273480321ba50904d91f81ee42f5f08e1bd30ab82f0d27da67c75a9dd9e3725a5a953ef05ee026ba9f4e9ce124d850f68e45"}], 0x1350}}], 0x3, 0x1) sendfile(r3, r0, 0x0, 0x100000004) socket(0x1a, 0x4, 0xffffffce) 03:53:51 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:51 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x60}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:51 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340)={'syz1', "5b0f566446afcb7dbd0df3a56e2abb104b8276b64b94a89ab4cbb3b333f487f0c09eb34d4887ea4ee709dd847690a94d36019b4845a4c3005fc307606c2b6871e609c0ee7d33a7005f9fd6816898fea7ff1c59b54ea05aae433f1ca8962557554bf968520ba847221d84aa8e7b39900c5998b0e7daf6bdce551fa07089f71d07b09119c429937744ace0a1a369988f317e011acf6ae42d87525c71"}, 0x9f) socket$packet(0x11, 0x2, 0x300) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000300)=0x14) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'vlan0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000280)="0872fc7276042fcef0ad0aff8100", 0xe, 0x0, &(0x7f0000000180)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @broadcast}, 0x14) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000070600ff070000000800000000000000"], 0x14}}, 0x0) splice(r3, &(0x7f0000000180)=0xd85, r2, &(0x7f00000001c0)=0x18000, 0x9, 0x11348420b87a711b) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:53:51 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x8, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:52 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$kcm(r3, &(0x7f00000001c0)={&(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e21, @empty}, 0x2, 0x2, 0x4, 0x4}}, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)=[{0xb8, 0xff, 0x9, "974a1858012dbd956d353fff207752e97152928de602d712d8450527051c361e89416d8e4e2faf726c98828f9fab8dc0c9926b99b81573c11b136998f50438910d2299d3262920cf05229fe628ef84289bfa5af388eb1588002928b6351f0dba13109bcb1d0960251070aed40cb30723e8d122a61f8fca030ceb869a56a482e24fd927898f4d8bfe99e7396db9af253e2951f102cd543db6009a453494e27edac5227ee3"}], 0xb8}, 0x20000081) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) [ 506.440344][ T25] kauditd_printk_skb: 44 callbacks suppressed [ 506.440360][ T25] audit: type=1804 audit(1640058832.050:3686): pid=16825 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/437/memory.events" dev="sda1" ino=1173 res=1 errno=0 [ 506.590592][ T25] audit: type=1800 audit(1640058832.050:3687): pid=16825 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1173 res=0 errno=0 03:53:52 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000480), r2) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001040)={0x4c, r4, 0x801, 0x0, 0x0, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}]}, 0x4c}}, 0x0) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100), r1) r6 = socket(0x1f, 0x1, 0x3) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000940)='blkio.bfq.io_merged\x00', 0x0, 0x0) r8 = accept(r0, &(0x7f0000000980), &(0x7f0000000a00)=0x80) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000e80)={0xffffffffffffffff}) r10 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000f80)={&(0x7f0000000ec0)={0xa4, r5, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x81}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x6}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xf70c}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}, {0x8, 0x1, r9}, {0x8, 0x1, r10}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0xa4}, 0x1, 0x0, 0x0, 0x10}, 0x40) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r4, 0x200, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x6, 0x5, 0x6, 0x3, 0x4, @private1, @mcast1, 0x7, 0x80, 0x7, 0x10001}}) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)=@bridge_newneigh={0x50, 0x1c, 0x4, 0x70bd26, 0x25dfdbfd, {0x1c, 0x0, 0x0, r11, 0x4, 0x1d, 0x5}, [@NDA_IFINDEX={0x8}, @NDA_LINK_NETNSID={0x8}, @NDA_PROBES={0x8, 0x4, 0x100}, @NDA_CACHEINFO={0x14, 0x3, {0x1, 0x1f09, 0xffff, 0x41a}}, @NDA_VLAN={0x6, 0x5, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000014}, 0x40) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r0, 0x8b1a, &(0x7f0000000040)) 03:53:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0xf0}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:52 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 506.712128][ T25] audit: type=1804 audit(1640058832.080:3688): pid=16830 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/421/memory.events" dev="sda1" ino=1178 res=1 errno=0 [ 506.844246][T16847] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 506.863984][ T25] audit: type=1800 audit(1640058832.080:3689): pid=16830 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1178 res=0 errno=0 [ 506.976790][ T25] audit: type=1804 audit(1640058832.080:3690): pid=16830 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/421/memory.events" dev="sda1" ino=1178 res=1 errno=0 03:53:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x300}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 507.100513][ T25] audit: type=1804 audit(1640058832.100:3691): pid=16825 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/437/memory.events" dev="sda1" ino=1173 res=1 errno=0 03:53:52 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:52 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000480), r2) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001040)={0x4c, r4, 0x801, 0x0, 0x0, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}]}, 0x4c}}, 0x0) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100), r1) r6 = socket(0x1f, 0x1, 0x3) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000940)='blkio.bfq.io_merged\x00', 0x0, 0x0) r8 = accept(r0, &(0x7f0000000980), &(0x7f0000000a00)=0x80) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000e80)={0xffffffffffffffff}) r10 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000f80)={&(0x7f0000000ec0)={0xa4, r5, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x81}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x6}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xf70c}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}, {0x8, 0x1, r9}, {0x8, 0x1, r10}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0xa4}, 0x1, 0x0, 0x0, 0x10}, 0x40) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r4, 0x200, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x6, 0x5, 0x6, 0x3, 0x4, @private1, @mcast1, 0x7, 0x80, 0x7, 0x10001}}) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)=@bridge_newneigh={0x50, 0x1c, 0x4, 0x70bd26, 0x25dfdbfd, {0x1c, 0x0, 0x0, r11, 0x4, 0x1d, 0x5}, [@NDA_IFINDEX={0x8}, @NDA_LINK_NETNSID={0x8}, @NDA_PROBES={0x8, 0x4, 0x100}, @NDA_CACHEINFO={0x14, 0x3, {0x1, 0x1f09, 0xffff, 0x41a}}, @NDA_VLAN={0x6, 0x5, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000014}, 0x40) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r0, 0x8b1a, &(0x7f0000000040)) [ 507.224238][ T25] audit: type=1804 audit(1640058832.170:3692): pid=16835 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir411123904/syzkaller.EJ9sGJ/635/memory.events" dev="sda1" ino=1183 res=1 errno=0 [ 507.393908][ T25] audit: type=1800 audit(1640058832.170:3693): pid=16835 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="memory.events" dev="sda1" ino=1183 res=0 errno=0 [ 507.496464][T16864] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 507.539870][ T25] audit: type=1804 audit(1640058832.170:3694): pid=16835 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir411123904/syzkaller.EJ9sGJ/635/memory.events" dev="sda1" ino=1183 res=1 errno=0 03:53:53 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000100)='veth0\x00') r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000003880)=@newtaction={0x284, 0x30, 0x1, 0x70bd2a, 0x25dfdbff, {}, [{0x270, 0x1, [@m_gact={0x4c, 0xa, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x0, 0x94e, 0x5}}]}, {0x11, 0x6, "70347465ba0fa17aea5b2971de"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_ife={0xc0, 0xd, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_TYPE={0x6}, @TCA_IFE_METALST={0x14, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0x7}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}, @TCA_IFE_SMAC={0xa}]}, {0x6e, 0x6, "66b9a2488162a86ca283da5eaa48333846082e1e137f27391551bc40dc75f217ed78975ad8a541a7993bef7f34bd9ef277f07bce84320048b99c786bc208939b0f9c24ecd43e1313c7efe767e0bb7d4c6d48a369a887c660043f8e321c0ec691c38be35dfae335f67c49"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0x160, 0x8, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x200, 0x4, 0x0, 0x8, 0x6c7b}, 0x2}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1ff, 0x8, 0x6, 0x5, 0x2c}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x1f, 0x5, 0x4, 0xffffff80}, 0x20}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4acd, 0x9, 0x4, 0x4, 0x80000001}, 0x800}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0xc20, 0x10000000, 0x9, 0x7}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0x0, 0x10000000, 0x9, 0x8}, 0xff00}}]}, {0x87, 0x6, "034a8f7e96941c52650c778f18372a033694ad3b93d1850951f98d7f2605653300c20362d786d78463c3298fd652d968076ca7fa16e1346f5b03a562c286706f7844f20c4c793567bceb38bc11491b8f907e3cfb7b3f71897ce04153794e2f41028210c09bd6b8af138e3ced63f850296668e44f92e027de998f0f6595fff9d22102cf"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x284}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f0000000240)=@ethernet={0x6}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000600)="8af003f5f059f5b587793a921dff2db99b8eb9c1a9effb036c0169ed019999114fe9db90002a385b686041ef77329e5dbc7b0a0c86655a916c7dbf670f5414a566509973f893d29e71cdcfcd45395194ac7e5fa6501d1454b6c87a2df98569b02746dc8836e98dd602fa44acfe1633700be691d6649ca08ac9ca91f775473fb4ef66cbcb79c724f2a2fd243bee85237bd088a0de6e555d1149fa1e7715652ea0d6b0a45cfdc7c88ea881cf6762780d175684248c2ed13a17b5390c301c0d82a60d11ebd9efd20610dfc45e97eb5abef7cb0023cb28d7b7d1e3456c8d55f634c724af35c0f6021f433f6d9d78b8f5dbe6ee371c075866ff08bdd85a4618fd5027c99d9f0ecf4fe6ae9af85594736c01b2350a7f105bb6f827ccfaeb8e3818c908184c9fa5a9fba0ced76b1d7bbf46040907480c1483e1755e6fbe48b544699a25b9257d2c9bc1025b814978520521079db364c9d6ffcbb03efa101adbe525f5afb89b2e29faf27de25c9ceb8c4648ebbd3e80ce2e8b61206dabb15ff29dc598ddaadb48e3d113b9d517204846c5d68823facd3c40bb8280a9973709f769dbf9d81cf74199bd482e6da8e098a6e0d403c4f1fe99e5c033e051676bee0d3404e956bb1319decd2593b717a526f1d3c51413e5f6f467fc5399e41e49b70880ac52071225ea17454c74bca6c07a801c663938133e5fbfdeb7dc61b8ea044da0da183133b3edeaf0b1eef719c44996f330b7cb5a6ea2bfcea5f6ac2d36e6bef233b8e397ccedfa1c7689c93fdd3a34174318634e89826acd7069a6c5dd9795f59e2fd740062b84f3b0be0eae86996bc9a2e924538e6fb440b595d82bd42cc715fd6a918db65aba2ff58137b735a237db13de913d715dd718f5f5e9e4c68aed26e05a3ba71911ce59c4bd89ceeda1d7243c235459b4e7cf492ba42552d787579ada7cee73934034d48d20f17766044e31ba70a5577b9e92b7d19de535230e912b4a842a0ace87d0ce4e09e24cac17ec246875f53c4de97d7b6eb05d82a89d9c39127a037ab1c16e2e21463be24284a68ea328238fb303586da25ebeb6c53790e64b060fe8b79a5c86a64584e3885166c6adf16eb557401cbb2bc8a43125f565a376d7c5dc46479192d4b5d5718bced118b02a84e3bb9816d1d4476c0eac6b8f2a4b0b3c12844a786decb3a91363564f8ad0841e0e5c0d84ebf2b97ce609cdb1691ac9b2c1f29d3f03266430d08068a03317afa09b0dc6b571281c4d31a2c3db50a41bf7dddc1707d3b9c4cc5402424a342ae96183b32e94b0ce232c4816a2e540bf61dc7ad6e182914c87256fcb298d78a1772f533d6a400084cb1a019142ea742669284186a5988434b4f98121b054da1707c2aad8fd1331efbbb594ab9eb5b2bd451fd08531ba913543c77dcbee6272c13674d1b7f27cf0aecadd72eb3aee81877b441ad04dc0a19b0f079e4f6b1864e90ff80e829d5b9067f8adf0d195866baf04ad82cf360d424ee2df495817c82bb789bcbbd1ae43e52cb9d41e28944e7d6bb73da9cdd2dd634590ee2d892c87f563831e7b7243282f494e6c9318b0f72aa202b8d2fc46fd35d9ead2412f9fc0e221e5242063b26be4f9d39167b73f5ad3ecfa476c8907e32cfaf15c2b6bd6da1e68076a805f46e4773d5f89aaec9737e864012a68af3822456fddd2b3e1826c8829e3b46bea8b21382724b2fa9b923f8ae33305e6adf8993582bb824fa4c91dfd52b7a79a9e5dbd8e791e98bf0c0ed6353452afdcbba756d7ee7889a33583c3f1d6129fd4b8547ae6355b969f0522883ceeb0aa0811ecc60911a04244773a6ba9f12cd2c0b96304923e81442aade19762e91419c695526ca99a49445908bebaeee0a540fa6c4db27bf2ab6587e6f551dba6bb036e7d3fdc652c679b17a3cf22f1a68e47f0ad263f7fc20447b3641a12d2fb736cd616cecacf75ce32f5e57f76a41c11b81012190228fe7e1cf836954336b9e6c26b68f545409acf441d3588580bfd70de0205a0d9b87467000896fa012529a51aeecbd8b3d12be673ec013c21086d82108675332315feecc3db8093ec8652dca5a709298e489c57f533623bc6563a83ce12ad626ac251d0ec25137f1ac1194a9483b2a531765246739a015643001f96d5620b505825fb1ac1a0451bc38253b28d75b53be5c66d5bca61c9929b2ab41e03e87351ec4ad42ca1d48662ae91121a6d586551e73946380266da01bcae6aacbef2c3a9845b6550ddf0f8bd7177340076c62b26dee8bfba293076496713121b8cba60f9308b2f0ada87529150a96deaa9183e6ec8db8ec9a3971f7d7efce1f481ee73715f31c722be048b6bea26a9c99388471f5c500bdec77410fec1fbc076a19319acdb71fa6eed6db18406c3c23b1aacd5e2031f4862948a351ef065a848208c32f307fd2098798b9cf866c40b25540dcd7369fdffd12df37b40760d6b76fc095a750d881c2ebfac72bd0fb25082f0581a918f64b3aefb58fced9d82c984cbf4ca961d6ed6dbf05f32393ea70249fe849a2d96c802cdcea222b2a3ed66071e7700d7730ceb205566f4081d7f5db904b1e10c876f05577c459ea35f0149bab40cb623df6157dff70e75b137f00119897a9a1a8172d4eef31373bbaf4789d3d52e1aa50d1344555a2e53ff8656c3bc239ea62603422b724f51c1bd3a42d640aa627b4200075cd3f45078b6df6810fbba1741df1bf97b0c7cc7c3455acbcbe9c4ffd5f99b4ffc7166ae6961da67b6c4e41ed3f61108d99686913cd375ac510a2cc7d21462c6239016f9a448f0ebd8141e375bfdc27dcc538d5f0a139d82d5c4356627cf9c687b1bc96389be772ff42ee165ff9fb6a857614cf435cac80d232f84f5f8f44903cbb4b69253fd12c727e37396cc7e68495449c8f29b5342ac2a12cf74b8be4294b4c6a84e360f38f6c90baf27a18f200f64e153b7a2ba5e57022cccb1144bced93ff27c8fc4b865794bde3d66b2e79a32a7ca79f865b8b15687d77c94cbf23f7c8d958f382e363d02fa16498a69006c7b6f0eb623c1ef293a74c7a596ef9371d86ecd46d5b36f4f4d5c449810b4627c463f5f3acf5234654a14cfee7ec1c53a804959fc748434bc8fcb41b0ef26b3e25a0a26a2dcf8d174ec82437f451804814113b31dd8238d7de297fa226a359bf0f190c72736762344d2df5a0391a9ba2e8aa08b5718cbf439464c694c7c86831fa8464290da624aba37a595c1fb11da11b01645cffd793b8e8a483ddb5ad7fc139166603eecb04362bb104870a589d47c89e1ced565ea02174dd17e209ce822bb4266e2ba248fac1da46cc615099caf173d3e238ec674b16dafdaf284e642a3b082873a4a787c623a2efd17d308fdcf55700d982aac32a35fb49f865c17c261bb42495b38b2ead223a40a188e4a62dc0d579cc474aa2bde6e87f4797886a377027730ea13e4791371980810504f3394c3d326366eaf80892567649e4a889942380f6f3c6c7030347b4663a170ca9534c726af6454f5db7e2838a8a6e1266b1c46adb36205df955dcf5322415c9dad36a24dc48517a0ed568b55ce9a724471c4b3aa961c521a5e25bf05301168217621d21c19acf1f93b3cb270fb8ab495f122e2ea479dd60cd1eee7df957405ae6e3ac237227d59e334a12e3bd02e80cca24c5248dc6f2ddf788785ed1107e5476b858a365e2f4543e306dc11d24e2b14a952576f9e8a18c3913dbe90de5fe77dda8ba67c373ecd9d768f2a621270ada0866619aabad68ac6ff744f8ac66efa14d605f66f09f2aa6fc123c8edb0b9402fd982ec7239ef7c1765893671b4c02b8cd172504269ad79d79dde8cbd7645770237cdc66b9ea02fd36732dfad3ee132157bd9bec5a4fe759ba66e36765dad2cd9cb02af3634658716e505b99dff4e3dd1b9ddf4b47bfa37b94fe5ab2c97bb521000297de1acff5469d453a1a024bc19330aac44fc039391d74f1bb58b46e0018fd5597bdc42bc89e9cbb02834b47acfcd997363f69d6575f99a4ed17ed9b7df3b495f2b52fe49b3d00679730e96d3c02986d1d6f2d33388f8d4b2cdd2565d846bca8b2dd079ee0aa88e9d3e82a694493ceebb036eb56e8891ff1fc707cebab9bf79ee1d0ddc752a7de1d94a3aab8316377403effa788f3b74c817c22108e70be33691475c51c316391bdec735b3c5c3dddef1bf2b96c7b6f1c8d239106339a66d2f81f5d77db425f63ad70d8ad4494e74d28d3ed404c84c6177c7e67e339af9f577361b0821ddb0606eca12418eebf78eb6d95a4bfba910b2f5538cae1678d4e048bc54259f8edeb1ccc07eb33ce70b85a4c4fca3181baed5f2faba053e6e45b37542bbb3397003c10bcb61182cb6ab97c39c7f2a4197b16568f3e9d1db95a03be9df211758a3440b576aa2f4c036558c71ebacf0d716e9a12792ce42a9081831ed3a7b6d0e254ee61e94b7fde3bf7ffb8d9da8477d6ae846e5400d3a0c5b293b5fd1a54a0b8b7a5980e7fe5d7bd46828f93b26408a36585e1e0f151a692b4fb883c64bcb6aa56fb4fc4d05d329ee2e7668c0c8a68c9706fa40f8ef9a84ded96d3035615eb5ae8a482e876317704bb681f9d6fe2c154a529c85653a20fa81e9d5daeb37f8aa8f8f4cd6c751aded2eafcffa6da624facb4c728336b7c2fbce1ad111a34b933b77c0763c2cc4406e4104a65399febdd219667b90597df5f9b4ea43536b309b4347ef1607d2a7f9e77184c08c34085fb2ae0baa2f4241bec55990769973d3b490c8ad966a2290e81f18675a18de949c118f5c94f0039639b0134655b5eecd59ef2c7fbef4c832f3ffc33b23de32377f00a0fd9e01d320fddde44e5454087aea030754b3f60d75c2b4dc28c2aec2c743b0808514a85266d8145a0fb287258e25893e065fd8921eabee2954d6895ab81efff29d4466c91f5b31ae5af90296914194964094977e7a962ece1ac82833a316cc3d408967f68e32d1290b2f7017e4daa240c83375cfa0e5a410b85ed8cae6b088e604576398e95a94f811e66141c9f7e8110568504b6c6a87bfacf8c3d1cee15af2698949753d287a15af342848707c72f80fa1539de4513f4828bdd0913f34648fa966deee51da94e066fbf7a83c293d620e7a744183cfaabde7464ff3bfce5ea17ba3eaf7d0a660f4f9af176d03332af04129546fb7d321bc98eb1ab291e5749d0172b9aece71624476b16599e670ef0461086963ec4db4887b12f1d433bb82b56cbda7e0df5057551712a2cfd920e6f48cdc7e4a47260e69e7809e3315663b73df2ef1a7d5c8b4075b421105c7c7444ed9bcd81ec7031ab1aae796aade0fac7ddc25d5a5b886f258097a9ace7eaea24797c17066530a063a51056b96576e10fb9fe6438bea0910f4c93c2523955155f79b00a5696c1349c26f7aa729e7568fee0b466040e5f049612cdc2d242f8390e53a9710ad8dad743097a90a267486c6c49495068dbedfd3291d03a90889eac3f3db7f2d2f9b3e0943b060699dcd37f589d492b02c047f9ec48ef8ea9b86fb461f18b7cfaf383ee8659a4c48162ad54c906cd183d264b1870cffeb574a4dd52d63b3094560a7b5e3e60502e56ef9981ffbae914baa22b2a645ff1585c588c483304cd7df37c8ff68beb030f1366bebaf42887de01484f73a55bf9d6f6b8d0493ba32d3f6249ad48bef2b39754884c86741ecdb8ff91ca4e86906fff01195e2160131d3324a676d631b1bb73c62112e2f275b4013d63f686515edd82afabbe1ad175a77796236d93365ca5396de429544f33b02c9c5c49ec1a3bc", 0x1000}, {&(0x7f00000001c0)="6b7ceccf83a3c5dad714bf642a5510d13afcc1d16fa28d9fdf5fd67f5f07c1ee0016c68ef80a64a67363f08c87f5cd90b811d0c74a3f1816", 0x38}], 0x2, &(0x7f00000003c0)=[{0xf0, 0x118, 0x0, "1d978c3e4abc51c9b87ce1edafa8612d0cd8b2549899c294b9929dcd5c31bf6f6724a3f9afcad07c967eb264d6c991f7963b3b9649e2fcaa219836fa2d7523d3cf7acc708d8c4e094593e766fed337ceafde29f3626ec79df46a96dbf06cddec97e8a5b4d241d94f015101a2942deb82c495fc1901a191d35bb974ccc94a553f7c46d02d637bf8d323cd179883bed8b3129abec37a2ebd871682f823bc04da8b5bfd4dd14c968b0c3f60f6558c454b1e4f2aeae18ea8db585ea687e31db0142091c8df4f6c8a521cef4818f9c9f458487d61c96dc8dec4238e80dd4359"}], 0xf0}}, {{&(0x7f0000001600)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @broadcast}, 0x0, 0x2, 0x3}}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000340)="ea76f93c0dc62846b90fbab94ce2eb42a4e9093f596262f1384d2d46f7cc16b373d9068142a540", 0x27}, {&(0x7f0000001680)="93d5447f47aa4c9978588dbfcfbf2650d74e1991fe8676ea8f40d9067eb6a2e606eec78f8eaeb7ddc8cab72747c2efb050496fb2b3be98239dd67e65569d724b297a78e31e0486ffccf3d86f7a5b9500612fec152d7901bd5ce85147e45a9e0f7c12037d73ab1ff4f201323bac39e4ef105338a391e905f79944f3b187603c6fb923b6da0cc81d24dd270ec8d0f9400d3c36b049556b7b64b2d25e1a2b9d27a3afebc4e588801b2735bdaf049f9aa6b748490efc8700afc559fb0b296cddef9dcc", 0xc1}, {&(0x7f0000001780)="220d5f8b5bf82502446e91b56d22eb76af19a609a70676f427f8062c3dd7cd4517c037bcb1f5fede35cad459ef198fcc42f20393e92006e85a6c56dec1903783540b800491175209f07f6f0e4cc30c5ea9594c7f2e2da289b1f59d43e7638c644d50502f66712e89afe0e3afbfb9425f285143707065981359073156d4f4421f7c843b2ea24f3a552fe89508866511c2c61bafa89702ee06e59e2e657a2e9f7aa17b824651444e501a1b284eeea60565eb3a48135e89dd23a78a267cd7b6070ae46a3907489be788de72e20105b53db87c9d9b78de51f3d7132638bc530d6314c54d3e9e31c96ae1d8", 0xe9}, {&(0x7f0000000500)="3d6dae3f13450731aa2de16c097a2501b5961b5b92130dee265050986eb8fb3ec8b70a7192fd65bd32e2dc43b2588e237d4d72570102369652c0", 0x3a}, {&(0x7f0000001880)="8040848e07449523dce4c63c8e39577115d3b602d5b3b7510d901cf1fb326c5d9502a68f45e8f04c0124e4e5a020bed1e028f3381fb6b4f47a95d70953d1f7ca025b6051c851f78b38c64a6b743756cf69ef9e680b9c2da1cd3a4cb0c9c8fb0591555f9dcbc059d2f05d41b0e4f57bab26aa28ddcbe4586d12b5270125c2bec60bee06b393bf9e01186512872b4acd06bd022f3cb5359414a31811de15b025e5963a77c64668bbc97c8ed6ddc6003d2651be0c7c7e995bbc029c676cb7c16e33a9269aec4023908dc60b9b8782104e3c7713ce4c41eb22eb323afa33dc698da5ee693554ed39ac44", 0xe8}, {&(0x7f0000001980)="331a01d8f8ab28b5627e91163aaf2243e540abad3cf266ca592e97c7c27c66e868b0da2bdd1023ef7053eccd163f041983eb93d8f117cc1bff10d13bb701d3ea18fc249e494d33cecf722f0afdab8d80dd0aa3652c63959616239665cd9a833ddd7f48f9efd12f98381f0e69b7c2f478406a526d20a4c2deb7f8d8de20a560246db7b122675b7016f0d44f146553f4ef5902eee5fb1b35f6ebea2a8db1b991e454a3ae73b363", 0xa6}], 0x6, &(0x7f0000001ac0)=[{0x100, 0x114, 0x35, "6cc1e97f145ee5581388777629092c17ed0e6b0866e53f04ab3026181c2f26bb5945728d405f776cab346a5abda60d610ea1c88bbac40c100c5cdfd5d22b6a64c5017452a7d75c3446988311001017cb6a41eb5bf71e177d9f53421aa3e04bdbac2d6a9f360eb4d5280094d918bed374afb9d7bc425c15011b97b2d292b32f2f4a615d1e92ff131d71ae4764589c52171981b21a6b644ec4eff93b68949357458cfb85dae4c1086369bf62b94e56beba8613e4887b98680430d5fddec0307a3055bda07db432469b88300679c2c382f45ac5b46baf2aecb1c2521f9f230fb86a02ff5cd8c59b168937d9"}, {0xb8, 0x10a, 0x0, "9e1e0747909a37269a78760ec4a19ebb368345b59cb340ba0b84649d88d5cd85adb62c20a5c4513f722e9a82768bda2b6138d59c455b141b93c856d0e4371056e5ad712c94ac592c1884b1fb67c1358729bcdd722294872aa2d8e96c9401b6aae6bc7a754524ae3436e6a7524330885417c19aa5547d1a4258c9310ae828ac03fbf310513d94b755474b67fa0e9bfafa4dd022209da21ac321ce2a42fd97a349417e"}, {0xd0, 0x1, 0x3, "4d6d6febc7b0fc586b23143d418d3e7ffaee7a17f11e712aa74eff0d668a492485df417b503e15ceed9986d80a9e419d20c5108c4acb714ab50c1c9951b3db4f0f59d585a6672bbf9cda4e443e6d5ceb38d2718be2c346a30a14e433dfec235bba2591ad086cb98b846e1a7f1f8a49a6a7fcc0ad24ee453a2ddc1d93272c28267c40cea663cd5b8d44127b0262d98a0b99665f2a40c68cc98c9f5d03018ee38bc6cf213be497670210e95007a0cbe801d1d1012d94180e243fa5493b"}], 0x288}}, {{&(0x7f0000001d80)=@qipcrtr={0x2a, 0x3}, 0x80, &(0x7f00000023c0)=[{&(0x7f0000001e00)="3d62fd9460ae39ee3956c546d57b9536727e858b4f5ab6ed637260bc85a7ef75fc54ad769bd727b4bf5ae02f7d7d78ecee8c33ef4372e94a209eb278e69bb58cc109c9f5fd38c96609de2e9cacae3db71d8c69ebad658eb125a5f39a2b3b2717cc3afff8de5d9c84d766403066a06b198b39cd8cff7de4a38c5de8e2f8fc707536a4cbf4d1c27441e9f52c1bb9d743e3d895b3e8e7beac554dea27af626cce32899ea7aa6e9eae0d457070e961824ddab099ba9f63477975df6a8ace6b3455df57aa2082eb30ab7dd0507f1edf64b19f121a448d0af53e24", 0xd8}, {&(0x7f0000001f00)="c4a31c191ec3c7b2f2f8dd72c059ecdff89d470feb8016daaca2708c38b0dacdaad7806055bf89ed4b2bfb022d8135ecb9524ffc0d07d8e5731f3bda9b270ef30ba1ea9628fec84e69c260b09c9bd49e", 0x50}, {&(0x7f0000001f80)="d408f9ad501437d05e50719ccd02c304a81bc5d7f9c8f1f91dcf069b13f89d94cfeb72685c0c25868de028a4838319c6f095804f9651145a6989a436f6302ee3916f6334340e94d858ea54f987ded380638de8b57cca23a3c72521bfab008784ad6272c061186240ad3bf2e64e983fcd1484711715add661d59d73be15cefe627a35bdd2c32c8ab019ff4b5a3e5e82e85a5878f237da6574d4c44051b43fda88cda79332fa30dcc1b552e5fc101bf82ea9f00c6e067c5f7c8021e80cfa5ad8884ff90be6226c178a8a7a2c12776467b8c72f75cabc81a9621db026f614fb", 0xde}, {&(0x7f0000002080)="8882e8b06a8bf9a166fbddc230cbce525fe792", 0x13}, {&(0x7f00000020c0)="7f651a61b3d87faaffed98b7e1531539e49b953303d7aeddb8e674d3e1af21e639fdf2687fc10ca80d40cd6b882d274571c4269b1a2911b5386d0d4e6ffdbdbb5f74c637edea59feaefc631306dbe6abca47ccfc04f27bd81e588ec410aad0e5bb8d17443529045b4b6c51191ca5bf3c0dede7c3d337919c3d106e6c3cb55e512ca7b7192083fa467d843211da02c3136512fb426758410a257a476fbccba18a2734f0658c8ba4feee01e692467f3758491760222934ad3c4bfd044c5e27ccf250039f481218c9f23b118185bf56ee3b0bd1cd0c0fbc5cc7a7", 0xd9}, {&(0x7f00000021c0)="b291910ac597d0ea9dfcd9e6b59378c9306920c822d7fd1bb0c4802fdcd46a33a26a9c9a377772b67afba2957d6d64792b1fee7318a42b71b2777c9cc31db05f69d34cf2aba4f58113fb74f6eca3668bae8e51917271aecc362a998d0862ff5659d35922489f465c87d47c60b24674e534e31df895fa9cd52af98c4494d7fa2b62709e475c66e2a09af85b5aac26523c1425e2a0430bfe", 0x97}, {&(0x7f0000002280)="ec090367322913e496b95adcf483d7ccd4266c2982d7c949dbe5de0ccf5c9da49dc037120581a82c161d7ceeb731399887249b94dd7ba4cb", 0x38}, {&(0x7f00000022c0)="1189eaed6a5e25617cea9c0e10a2da206f391fcd2abb31e9ae70c4ad77890da08cf68696aa579706c082989b6d2d5010a8458c21ddbabf42dc78ac5bdf1b4223c5e22b29fc7fc1410d0b6a010bce949ce7174ecff09e09fd84689d2ed3475e50895d6fc696f3d03e6d7ad280a87e6af4398c386b0d5005ecbd289782d5ead67d26d008f877632dbe1c1930482f37b3af2397a4e131b18ea091e4e807c35f52c4ae9b231fb89f4bb2112e06c9b2bc9d5eaf5c50aeaaa38c312c8edb7f77a982e3f19ae57849d6134120fa34eb360b1b9e36747e761ee1f949d0d2ba573a29087e8078", 0xe2}], 0x8, &(0x7f0000002440)=[{0x50, 0x103, 0x3, "59a543bd47f7a24cbc9a260b5c8ed7e16448eabc23b570a67d2958ee2674b01a08fa56bf13f2c5aa91b3960641cd4db0c807330d575ec6f94258"}, {0x28, 0x101, 0x9, "0990f0d41c38d15d9a5e8092630bebade463e7e0398a4c"}, {0x110, 0x10d, 0xfff, "6dc3279f51e9396418acfd0940837d2ce90701d0c6c5fac69862f0d26f8790882fe1bff33a296ee38a3cc1459cf5c8d4f8c0c555db2914dfb06e4e116e04d15d18c036e54a9a68f85a8bac3e486862618e630bc48752a35e96ca3665161fc14d1db8178b5926b726d5418a210ec82b4667aae28cf7aecc6a5527d873ade1ec40c2b7a7aca8c33cc77d8d4d03aba80fabea5c49272c8eb05d71a8c4dd00e329483354085facd5f27e9935f67b6eb6d33b3623b7c6897bfad6344747e985b57e0f1dccd0666d130915f42607af68f700fbc911c3dda9ead887a78dbd8b0ad92c853322c52fe4f655f1a7c285b444bba65127e721ba7989b17cfd81"}, {0x18, 0x104, 0x7, "f101d6774b"}, {0xc0, 0x3a, 0x9, "c3ad628c138488e61dd76a3eaf169777c57e3e4e08662458766819df278fef64578ea757bef433824e6779af8717d53971b0ba4556037651793a6a83939f26cca1e75569fd9541a2fb0e39076b5f12cba9f25a9901af2027a52bac13918c8a33ea0b02a5221b0ecec28c1b19303324d37a0ecd99a3e77cf8e06b24441affded1d8f4d7faef77a124f1e5dd599d4c7b41312ef0ed02211f43e8fcb98374fb45820f295f928fdd49914629195a60"}, {0x38, 0x10e, 0x5, "e12c61cf8b92503ec60551a31e25b42a9b852587d8fa4499e47e34e313e0052805cc37f25b3a"}, {0xa8, 0x1e, 0x101, "e0466cd760d9b61205adcd052c65b1f18046aac0110a9ec0850f7fb3057bb03cdc8cbbf375363137f16eb2243f8a0604bdbfcb6f7ff90ab343c8c1c2f2ed28ea21001e2f32cb6190c1a1216fe8ad2488cd17a0c0300865f156c6c51e8b20ba81aa934be37e8b65f17360e3926eed2031639ff2962dbc3542734b7d6d137ae62f5edd546ab755f011f1f879aea422ad4a1136"}, {0x1010, 0x117, 0xfffffff8, "5ccf547a24df6d5a473ee7015840c984d24f83cc58845907bd07a02d13d0dc35e18667d1676b9f0e5460c10a50f0aa41126b7ba492998f0d4e104e4af8ea6ec88d6b9cb2012d462d3533c2568ec1110ce4418588ca0506b0613b8f8e210d468cf7e994c541c875f9cf769416c58897a812de95da272ff18cdfe9d3ded6133a18367ba51887f512b7120568d249ed299edd0258c99917c5cda1bb655ab69e971b957baec742740f2b264a329b65833a4ca469256b3c3d43759f53e504d8a71370bf256fdcce15b99946fcc1db048a738018333e0990b0224ebd3a7c88ea2661d0bdf58756bc165ab00ce3c432d8a30c156b39db63e02bbce467dc07e62b692a69e979b0c062afc7d068d12183a6d8ab71db5a65961d1feda761b39dfacc0132241ed4fea3f4feb0061b4e932a60fddcdfdb03a1769f29f8bb278593e6decafe77dbb553f79c7205b352680f2d1cd1de46c37de23dd7f3122387d27f3e98c0f001f9e662a5ccb201bf33d537d4113037a61f87c6de5688f18e5430e4f8c858ce98ce8f97bcbb5491c117723a11a5db64dd365b30d0b30c1a99900c4a02b7c7210cb2bd0880cf654fb828dbd412f46ea3011625c7fbcd85704b881858f4aa929a42ad364a6bd7139e1d2bb15992d2ddd47922b1a5b5868e27c3380681d15ab78fef315510cac484255980f52cea3b0f66ebd7c1b347212b9653bac0278df39a96f93e555adc820f5d8745f79da9089a52d78d7146c76123e0d0355927e849c463cb2b5d04f8e2019e780c5226fedd5e6f204450379e958a2c6c3b5dc2dfa8ce1156c50a617ecb09e14dab39768b608c6e212426c7898402574235b04245f138443b1617f7061d454d5a626fd4d77e6144c2507cb3bb2a26babfc6d3024aa5ed66182c87582d49f69646ef153a34e87299e004493429554a62dfd166bc33fb14a4f148d30e31fdf93a4fcd5363d9c3c8d4054d3746d286d515b0f3b76af6203bfb9beaabeb08c3427f40c21c2e1d7d423bac204310719bc9a07e06ff902fa60cf50af4c8c92cab994639c8a0d8cabe84566cf2891fa9e28a52c714e54fe289d22bfb678589f6bb3156bc9eed5c8c102de63a6364c1971ac585fddb2afc75511b0b12fcfd4e14dd1abc26ccf7342b72bd457cff6a6795a8054f5cb389db11243e2f2c15cca6f4b4f03b395000909a82b4e47c8fa16e42a988ed482ab31fa2f58af6589ad5e72a394cd3c0145733e91d9da920967bae15260aecaf0eff69a0d9b18562964f20a8badb2cd50e59fe634781cc411bcdfdf85741b1becc82fc18ffe7e975965741d09c5afeb448e093d904da5a676e2b10e525101dc1224c92fb99b3cacdecb0dd1385889549862b8c7b2757e11a22b0894290b5d1d370a614f7764bdb0a3cb8ffccc62c8ab8f04110350b0aea2c6624987d38c533d74613a28f92df90082afa0aee0f31437aa2e9f844502cd441212e81577b2b7cdfd5f7e1061fab709471adcf98aab8e2b0ae34bdce5325942ec3a1b3d4a305def52c4dc88fe302ac76d10f342c19ce5ecf52df7417218b2a06eec913c8204a43f6f9788d833519ae22d2ea7df0520710333fc75c283c486284c9e19d494d191c091a3c3f7dad8169d57d9a739117c583f90234fe46ff48d1cab2ceedb533e6476733d038a73158d8924c7c4cc902388e5df7430e5da56e090e9c5de0c5d3f49d34648b2685114816707e66312e2a726a7f31f624105dde751b4aa06c07393f475b1d887531688d6f0ea17bded33827fbc0e9aadafd690f2cdf5370e15417280c5c1ead740c4aaffc3300745696767315002ba9ec665866e4de4071cc91c425e237320cdf187f4bc8beec0c37449afb6b3efc04145f485a5790d8811f6b624b37e9af3f6363db483089f68dcd5e6ee93fa795051886133a6e9e00f0b917b66c9573b5a2c2fdea4c87928c78bfcffa7606e2e356059eb11c531186938298b5d704eb5d3b3dae43485a5e8117f67b64093fe8004f68b13af3fd683fe4301c9666223782dd4623852f75e79759c2a1a56e1f9867c46abb5b15d56834babef551f080b81017e503e79cc6a3e383871911a7b4b18b98744422bb68acec2d7c57381722797f9a97fec1e3400c6a6a4826e2651555b41cecbdb235ce8bdc9f743514eae6c743e6c3dae45285c23694407eaf15dc543db18678e7a4166b5e10597ba79435384dbda586192234d18f1d855119596e6862bf8706706166eb6f764fc8f96bcfdbe510fb8aaa24659449d74ee598ed03272bc0756e6ec57596ad8f0a0624a1c185ba3894ab66a44299990bdfc848fae6385cade7132abe8da9c00dcf3afa7656dbd9c55c244922b0c4be562c2d519888b31f1a0a90d3d8761d0035ec998042ff6c35c9de4cb3e76ace78741049ebf5367416f6f567aeb03564b0ab22e2ebe9641910f548a0d50a38a752b2aa11fc6123c0806d3f224c4a20908581cdd4332db0cfedca1522c68b90e64660be931dbc1024ad7de1974693adf3da57207b0d2acd4925edc31e158bc81b072869766da347de0b51436848ed61211f175a14724c4a41e0633797c0fd1595d2903f84ee1213662f72cd03648f3d7f71fb25be9160b48cf1d7f0f094e07008674d4987eff52cb886c00e649ad703b8042a2c660da44921d49fcdbf1d6af9750a0425817a3aa2ec2fa79eec124b83820b659ca3ee2a3119453cc5675ff27d7ab5f852693666b552dfee24a57fa1b38946ddc18e78888238f2837ee5d903616caace945b83c0ea95714e50f28622856abf328bc7b68168eb17d8f3dfb33642c2dc6f7a1c59f2cc486f1593fabc281bbe3bd54a60e8004d81fcbe1b836aa6a9a2a77bfc31de7216b11e557c5015c4f4d0ca777d55fa3ff39202f4a066c6bc7a454d9cf9c6ea2dc3350d90a91f34ebf3fcd5c61dba67ee5c57f5f0552a040e9145a5a7316cbb27fed5d954a8595229a901c24fe8779b118b9200c6708fe6a49ba8e9ba220824a7b669a8dd94a325636b4ca8db825e72d6bd6f9e499af3b720993a4d45a8dc7ceaf986d35b17b46334d658866480cc15af72efa9d52db80f461c12a090b7b5fd5c9293d8cd4336c8c5deecf005c04bd405429b63da79cfcae435fc6195c35a7b7bafadf867f2ecab4f990ffbb5d5b8fd4445a4cd05f9b697c8bc1e759efad4c19cb9c499feec1e9e41df03d0abaa7593afcea50dcc3add1c6dedda1567029bf970b46c9c064fef5be1c4a9d794147d74ddde4c7afda130377f926d44dbc1684a31b40a88f75b4e17fc202af06f7fe5b04e47d42a55317e296c9345ae80d81a1c8aaeddc53512a175259e16c6727b649a6cf6eca0ef776fe5e30ff06281e30534ab35390fe15eb722939876000a353032f2f0db576bfbaa2eee7e73741152f002b9b4c8c0e1b2e2e01841b951a85a1b28c62bd9e90af2d8b279c9a9e8c5e86fde2916a16177d891474cc58e0dc54f4916b1e9846ac9bdd71639ce4539398caf4100bec85b713f13a6cd9d3a278dfbd0fec49c844cc6270f56a4c5a413213650f39f30754c6cf20b021a4bc7841241e9fef2b6ff015e654b111bbb95fb2214e0dc4802ad933172ba7fcff633b8d7f67a237ca8a6ef1aeb29f3bc4d6f786cef973d5e72509acbf02853bdea529fd0a377eab21dcbe37cd70f8459befc9a6a8cd8d77c96b7eabe4feda7452bce1bf8e1c01b690cab9be0b87d481ec74692c3a45ad7b01d15411c3f8d33dab3da67dfd7de44283e372daf4824739cd8e613f9d01f5df627fd6c018b2f9521ea543a91ccb9de5e10aab8150cb7f1725ee66083141542279b052e926445015b7b8cf8d03d84806abb1768d206be36e3f5af4830cd74f0cc1b9161ff6ce33a81857621bc98fe86fe705c12f564f6344007eb80cf6a77baf84b6fdf647a8b442dfc4b0894ee4b00658fda4b792401521f2cec583cc73e4691868fcc44952e10ef07ab9abb6ee9e61ee365880c013c9eb4cc57c87b3172f5d329a10ee20697788dcc49244d25ecdc82034055948287f10fdb60f09aa46414a477b6cacf9b7550635d8fa844e01f88a521a483249c6b5b941f40351d93da31cfd6a8b1ebcf135e0cc79fdaa6401837b6fc9812e34d770cc647f8b52848210ff932c72e88fe5f2093c7c95692de806ea5ca51529d80b49b296799d412abe9448d3cd6dfcbb781dd8f892459dce7af8139133bf5a6014928114cdd0ddbd57230b5a3cbf9c7892952cf5af5b97e600066e0a873fd5da99ad1b9f5f98773ac9ab83ac6303ec5d8450f75f95993daea933de6d23579d23d2c040dd6e511f103cd741607f151230b6c4e17ad3ab2a786def02f15f158891cab67de3440e5266bafeaa4e73fd7c820a70a3ceff3e5c34c2f379257766735f15d3c3d31df6b5a9d188c0df84fac489f84a23dd760723283a357caa379152f1aac900bf859b2bc25bc688a53b4d5f6de1b3b51c8d8172c97b757d975c6c39d14c3d0ac7b3f0bca3e7d77aa069763020ca034f718e6c8599f32d42dc41544059883b9df906134e26bb6fd055cb410a28b27f9c6f78292b5d2c6525139d8b69748ff9fa4d61be7fd36bf609f4e555834333424dcebb3bde5b91a9a6fedd07b41ebfcc62bb56dee8a9dbef68dde1574888c3fbbbc0d2f8b532d8bf9c9e47f464a7dc9b86d5c59dca8ef2dbad9eb00c7dd173f887f99ceb54e768337302d70c358e2415043c7f66b7f1b76aa0cc077f0c56d572dec5555fd7e25f1ad5a00f9353bbe54e711276fc24f3b0628820137dbe2c0368a38893a7359a69d7d1be743c9d14af1a4ce292f9d3a71c935de5a6fbeaa5e2b9b97b7921420a60bdb4cefdcc1d7327dcf07a99054489e8d8a807b83a8ca348d509cf5a08d30b71a007beb5c2be58afdaf105708816dbeb3d64ce38fe5df7be8e6176e38a61401f35b1ea9dfd9ac0de6bc19072d9f2690039629faeac386aba60b6744b0c228166e765c376139a5ac40fa6bd4a1dc0506c913cc361c5979a10c908df50c00cd0b0c63c0df30b2f43d28692355e141373c7219359fc34afecc5a594292b636c4577166cd15e0a7c9274050d45da7aa8bc0a639dafb26374c813511aa398074cb808257537fbed49a5f3e1022e6dcc9a918dd2c748b3fbf0d81cecae16bba49ade278ecfab77b0a180fc443611d9a2b76261ab4850d3967d43e98095109dbd7231861f84bcfb3f9da56c60acfd89db980d091afc28bc6a4e17e3cb9bffa8f54a078d51fe2f7e2b99a2770cb817c60fa2b484327f8ca98a4cb6a2c3a8770c93b0411157e79c5f9beff8b0bf4df7020f5cbd16a7dafd37fd5b8c7493884f21e5937dde7dd0befbd88d8497b5387a74f7b00a58e197cf49b644545e03713529dfa7b37dbf6d8e27a22f1fc5beb21ef29ee6b840811c075f0d33e1c37ef60a5e79714fe8fc3520e555b93fd6cff2f5d7ab46c84b811b5236d15dafd4b1c3b881a8c64a55b1526ab766823494861c718280a128a770f3568f44761da1bfa1d527130f63512a610f3d28a3cd73a3c263b486339da9d51d8fb7e5921589744dc30d3e9a1fa5d4be2f6d19149168edcd048745bf29ac36eb9c2bf78663184b25f25d51bdf717eebb0bbc0026336664ee12ebddf8fa7a058211ad3c579d0b2a954bbf0b9a0c9c65f0f3c946aeebc0efb64b70e03accd46f4d8e983a41d2a26a3ab7285419cd7acb66d8c945608359750e2154666f8c46868588f9887bc65991848273480321ba50904d91f81ee42f5f08e1bd30ab82f0d27da67c75a9dd9e3725a5a953ef05ee026ba9f4e9ce124d850f68e45"}], 0x1350}}], 0x3, 0x1) sendfile(r3, r0, 0x0, 0x100000004) socket(0x1a, 0x4, 0xffffffce) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) (async) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000100)='veth0\x00') (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000003880)=@newtaction={0x284, 0x30, 0x1, 0x70bd2a, 0x25dfdbff, {}, [{0x270, 0x1, [@m_gact={0x4c, 0xa, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x0, 0x94e, 0x5}}]}, {0x11, 0x6, "70347465ba0fa17aea5b2971de"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_ife={0xc0, 0xd, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_TYPE={0x6}, @TCA_IFE_METALST={0x14, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0x7}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}, @TCA_IFE_SMAC={0xa}]}, {0x6e, 0x6, "66b9a2488162a86ca283da5eaa48333846082e1e137f27391551bc40dc75f217ed78975ad8a541a7993bef7f34bd9ef277f07bce84320048b99c786bc208939b0f9c24ecd43e1313c7efe767e0bb7d4c6d48a369a887c660043f8e321c0ec691c38be35dfae335f67c49"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0x160, 0x8, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x200, 0x4, 0x0, 0x8, 0x6c7b}, 0x2}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1ff, 0x8, 0x6, 0x5, 0x2c}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x1f, 0x5, 0x4, 0xffffff80}, 0x20}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4acd, 0x9, 0x4, 0x4, 0x80000001}, 0x800}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0xc20, 0x10000000, 0x9, 0x7}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0x0, 0x10000000, 0x9, 0x8}, 0xff00}}]}, {0x87, 0x6, "034a8f7e96941c52650c778f18372a033694ad3b93d1850951f98d7f2605653300c20362d786d78463c3298fd652d968076ca7fa16e1346f5b03a562c286706f7844f20c4c793567bceb38bc11491b8f907e3cfb7b3f71897ce04153794e2f41028210c09bd6b8af138e3ced63f850296668e44f92e027de998f0f6595fff9d22102cf"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x284}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f0000000240)=@ethernet={0x6}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000600)="8af003f5f059f5b587793a921dff2db99b8eb9c1a9effb036c0169ed019999114fe9db90002a385b686041ef77329e5dbc7b0a0c86655a916c7dbf670f5414a566509973f893d29e71cdcfcd45395194ac7e5fa6501d1454b6c87a2df98569b02746dc8836e98dd602fa44acfe1633700be691d6649ca08ac9ca91f775473fb4ef66cbcb79c724f2a2fd243bee85237bd088a0de6e555d1149fa1e7715652ea0d6b0a45cfdc7c88ea881cf6762780d175684248c2ed13a17b5390c301c0d82a60d11ebd9efd20610dfc45e97eb5abef7cb0023cb28d7b7d1e3456c8d55f634c724af35c0f6021f433f6d9d78b8f5dbe6ee371c075866ff08bdd85a4618fd5027c99d9f0ecf4fe6ae9af85594736c01b2350a7f105bb6f827ccfaeb8e3818c908184c9fa5a9fba0ced76b1d7bbf46040907480c1483e1755e6fbe48b544699a25b9257d2c9bc1025b814978520521079db364c9d6ffcbb03efa101adbe525f5afb89b2e29faf27de25c9ceb8c4648ebbd3e80ce2e8b61206dabb15ff29dc598ddaadb48e3d113b9d517204846c5d68823facd3c40bb8280a9973709f769dbf9d81cf74199bd482e6da8e098a6e0d403c4f1fe99e5c033e051676bee0d3404e956bb1319decd2593b717a526f1d3c51413e5f6f467fc5399e41e49b70880ac52071225ea17454c74bca6c07a801c663938133e5fbfdeb7dc61b8ea044da0da183133b3edeaf0b1eef719c44996f330b7cb5a6ea2bfcea5f6ac2d36e6bef233b8e397ccedfa1c7689c93fdd3a34174318634e89826acd7069a6c5dd9795f59e2fd740062b84f3b0be0eae86996bc9a2e924538e6fb440b595d82bd42cc715fd6a918db65aba2ff58137b735a237db13de913d715dd718f5f5e9e4c68aed26e05a3ba71911ce59c4bd89ceeda1d7243c235459b4e7cf492ba42552d787579ada7cee73934034d48d20f17766044e31ba70a5577b9e92b7d19de535230e912b4a842a0ace87d0ce4e09e24cac17ec246875f53c4de97d7b6eb05d82a89d9c39127a037ab1c16e2e21463be24284a68ea328238fb303586da25ebeb6c53790e64b060fe8b79a5c86a64584e3885166c6adf16eb557401cbb2bc8a43125f565a376d7c5dc46479192d4b5d5718bced118b02a84e3bb9816d1d4476c0eac6b8f2a4b0b3c12844a786decb3a91363564f8ad0841e0e5c0d84ebf2b97ce609cdb1691ac9b2c1f29d3f03266430d08068a03317afa09b0dc6b571281c4d31a2c3db50a41bf7dddc1707d3b9c4cc5402424a342ae96183b32e94b0ce232c4816a2e540bf61dc7ad6e182914c87256fcb298d78a1772f533d6a400084cb1a019142ea742669284186a5988434b4f98121b054da1707c2aad8fd1331efbbb594ab9eb5b2bd451fd08531ba913543c77dcbee6272c13674d1b7f27cf0aecadd72eb3aee81877b441ad04dc0a19b0f079e4f6b1864e90ff80e829d5b9067f8adf0d195866baf04ad82cf360d424ee2df495817c82bb789bcbbd1ae43e52cb9d41e28944e7d6bb73da9cdd2dd634590ee2d892c87f563831e7b7243282f494e6c9318b0f72aa202b8d2fc46fd35d9ead2412f9fc0e221e5242063b26be4f9d39167b73f5ad3ecfa476c8907e32cfaf15c2b6bd6da1e68076a805f46e4773d5f89aaec9737e864012a68af3822456fddd2b3e1826c8829e3b46bea8b21382724b2fa9b923f8ae33305e6adf8993582bb824fa4c91dfd52b7a79a9e5dbd8e791e98bf0c0ed6353452afdcbba756d7ee7889a33583c3f1d6129fd4b8547ae6355b969f0522883ceeb0aa0811ecc60911a04244773a6ba9f12cd2c0b96304923e81442aade19762e91419c695526ca99a49445908bebaeee0a540fa6c4db27bf2ab6587e6f551dba6bb036e7d3fdc652c679b17a3cf22f1a68e47f0ad263f7fc20447b3641a12d2fb736cd616cecacf75ce32f5e57f76a41c11b81012190228fe7e1cf836954336b9e6c26b68f545409acf441d3588580bfd70de0205a0d9b87467000896fa012529a51aeecbd8b3d12be673ec013c21086d82108675332315feecc3db8093ec8652dca5a709298e489c57f533623bc6563a83ce12ad626ac251d0ec25137f1ac1194a9483b2a531765246739a015643001f96d5620b505825fb1ac1a0451bc38253b28d75b53be5c66d5bca61c9929b2ab41e03e87351ec4ad42ca1d48662ae91121a6d586551e73946380266da01bcae6aacbef2c3a9845b6550ddf0f8bd7177340076c62b26dee8bfba293076496713121b8cba60f9308b2f0ada87529150a96deaa9183e6ec8db8ec9a3971f7d7efce1f481ee73715f31c722be048b6bea26a9c99388471f5c500bdec77410fec1fbc076a19319acdb71fa6eed6db18406c3c23b1aacd5e2031f4862948a351ef065a848208c32f307fd2098798b9cf866c40b25540dcd7369fdffd12df37b40760d6b76fc095a750d881c2ebfac72bd0fb25082f0581a918f64b3aefb58fced9d82c984cbf4ca961d6ed6dbf05f32393ea70249fe849a2d96c802cdcea222b2a3ed66071e7700d7730ceb205566f4081d7f5db904b1e10c876f05577c459ea35f0149bab40cb623df6157dff70e75b137f00119897a9a1a8172d4eef31373bbaf4789d3d52e1aa50d1344555a2e53ff8656c3bc239ea62603422b724f51c1bd3a42d640aa627b4200075cd3f45078b6df6810fbba1741df1bf97b0c7cc7c3455acbcbe9c4ffd5f99b4ffc7166ae6961da67b6c4e41ed3f61108d99686913cd375ac510a2cc7d21462c6239016f9a448f0ebd8141e375bfdc27dcc538d5f0a139d82d5c4356627cf9c687b1bc96389be772ff42ee165ff9fb6a857614cf435cac80d232f84f5f8f44903cbb4b69253fd12c727e37396cc7e68495449c8f29b5342ac2a12cf74b8be4294b4c6a84e360f38f6c90baf27a18f200f64e153b7a2ba5e57022cccb1144bced93ff27c8fc4b865794bde3d66b2e79a32a7ca79f865b8b15687d77c94cbf23f7c8d958f382e363d02fa16498a69006c7b6f0eb623c1ef293a74c7a596ef9371d86ecd46d5b36f4f4d5c449810b4627c463f5f3acf5234654a14cfee7ec1c53a804959fc748434bc8fcb41b0ef26b3e25a0a26a2dcf8d174ec82437f451804814113b31dd8238d7de297fa226a359bf0f190c72736762344d2df5a0391a9ba2e8aa08b5718cbf439464c694c7c86831fa8464290da624aba37a595c1fb11da11b01645cffd793b8e8a483ddb5ad7fc139166603eecb04362bb104870a589d47c89e1ced565ea02174dd17e209ce822bb4266e2ba248fac1da46cc615099caf173d3e238ec674b16dafdaf284e642a3b082873a4a787c623a2efd17d308fdcf55700d982aac32a35fb49f865c17c261bb42495b38b2ead223a40a188e4a62dc0d579cc474aa2bde6e87f4797886a377027730ea13e4791371980810504f3394c3d326366eaf80892567649e4a889942380f6f3c6c7030347b4663a170ca9534c726af6454f5db7e2838a8a6e1266b1c46adb36205df955dcf5322415c9dad36a24dc48517a0ed568b55ce9a724471c4b3aa961c521a5e25bf05301168217621d21c19acf1f93b3cb270fb8ab495f122e2ea479dd60cd1eee7df957405ae6e3ac237227d59e334a12e3bd02e80cca24c5248dc6f2ddf788785ed1107e5476b858a365e2f4543e306dc11d24e2b14a952576f9e8a18c3913dbe90de5fe77dda8ba67c373ecd9d768f2a621270ada0866619aabad68ac6ff744f8ac66efa14d605f66f09f2aa6fc123c8edb0b9402fd982ec7239ef7c1765893671b4c02b8cd172504269ad79d79dde8cbd7645770237cdc66b9ea02fd36732dfad3ee132157bd9bec5a4fe759ba66e36765dad2cd9cb02af3634658716e505b99dff4e3dd1b9ddf4b47bfa37b94fe5ab2c97bb521000297de1acff5469d453a1a024bc19330aac44fc039391d74f1bb58b46e0018fd5597bdc42bc89e9cbb02834b47acfcd997363f69d6575f99a4ed17ed9b7df3b495f2b52fe49b3d00679730e96d3c02986d1d6f2d33388f8d4b2cdd2565d846bca8b2dd079ee0aa88e9d3e82a694493ceebb036eb56e8891ff1fc707cebab9bf79ee1d0ddc752a7de1d94a3aab8316377403effa788f3b74c817c22108e70be33691475c51c316391bdec735b3c5c3dddef1bf2b96c7b6f1c8d239106339a66d2f81f5d77db425f63ad70d8ad4494e74d28d3ed404c84c6177c7e67e339af9f577361b0821ddb0606eca12418eebf78eb6d95a4bfba910b2f5538cae1678d4e048bc54259f8edeb1ccc07eb33ce70b85a4c4fca3181baed5f2faba053e6e45b37542bbb3397003c10bcb61182cb6ab97c39c7f2a4197b16568f3e9d1db95a03be9df211758a3440b576aa2f4c036558c71ebacf0d716e9a12792ce42a9081831ed3a7b6d0e254ee61e94b7fde3bf7ffb8d9da8477d6ae846e5400d3a0c5b293b5fd1a54a0b8b7a5980e7fe5d7bd46828f93b26408a36585e1e0f151a692b4fb883c64bcb6aa56fb4fc4d05d329ee2e7668c0c8a68c9706fa40f8ef9a84ded96d3035615eb5ae8a482e876317704bb681f9d6fe2c154a529c85653a20fa81e9d5daeb37f8aa8f8f4cd6c751aded2eafcffa6da624facb4c728336b7c2fbce1ad111a34b933b77c0763c2cc4406e4104a65399febdd219667b90597df5f9b4ea43536b309b4347ef1607d2a7f9e77184c08c34085fb2ae0baa2f4241bec55990769973d3b490c8ad966a2290e81f18675a18de949c118f5c94f0039639b0134655b5eecd59ef2c7fbef4c832f3ffc33b23de32377f00a0fd9e01d320fddde44e5454087aea030754b3f60d75c2b4dc28c2aec2c743b0808514a85266d8145a0fb287258e25893e065fd8921eabee2954d6895ab81efff29d4466c91f5b31ae5af90296914194964094977e7a962ece1ac82833a316cc3d408967f68e32d1290b2f7017e4daa240c83375cfa0e5a410b85ed8cae6b088e604576398e95a94f811e66141c9f7e8110568504b6c6a87bfacf8c3d1cee15af2698949753d287a15af342848707c72f80fa1539de4513f4828bdd0913f34648fa966deee51da94e066fbf7a83c293d620e7a744183cfaabde7464ff3bfce5ea17ba3eaf7d0a660f4f9af176d03332af04129546fb7d321bc98eb1ab291e5749d0172b9aece71624476b16599e670ef0461086963ec4db4887b12f1d433bb82b56cbda7e0df5057551712a2cfd920e6f48cdc7e4a47260e69e7809e3315663b73df2ef1a7d5c8b4075b421105c7c7444ed9bcd81ec7031ab1aae796aade0fac7ddc25d5a5b886f258097a9ace7eaea24797c17066530a063a51056b96576e10fb9fe6438bea0910f4c93c2523955155f79b00a5696c1349c26f7aa729e7568fee0b466040e5f049612cdc2d242f8390e53a9710ad8dad743097a90a267486c6c49495068dbedfd3291d03a90889eac3f3db7f2d2f9b3e0943b060699dcd37f589d492b02c047f9ec48ef8ea9b86fb461f18b7cfaf383ee8659a4c48162ad54c906cd183d264b1870cffeb574a4dd52d63b3094560a7b5e3e60502e56ef9981ffbae914baa22b2a645ff1585c588c483304cd7df37c8ff68beb030f1366bebaf42887de01484f73a55bf9d6f6b8d0493ba32d3f6249ad48bef2b39754884c86741ecdb8ff91ca4e86906fff01195e2160131d3324a676d631b1bb73c62112e2f275b4013d63f686515edd82afabbe1ad175a77796236d93365ca5396de429544f33b02c9c5c49ec1a3bc", 0x1000}, {&(0x7f00000001c0)="6b7ceccf83a3c5dad714bf642a5510d13afcc1d16fa28d9fdf5fd67f5f07c1ee0016c68ef80a64a67363f08c87f5cd90b811d0c74a3f1816", 0x38}], 0x2, &(0x7f00000003c0)=[{0xf0, 0x118, 0x0, "1d978c3e4abc51c9b87ce1edafa8612d0cd8b2549899c294b9929dcd5c31bf6f6724a3f9afcad07c967eb264d6c991f7963b3b9649e2fcaa219836fa2d7523d3cf7acc708d8c4e094593e766fed337ceafde29f3626ec79df46a96dbf06cddec97e8a5b4d241d94f015101a2942deb82c495fc1901a191d35bb974ccc94a553f7c46d02d637bf8d323cd179883bed8b3129abec37a2ebd871682f823bc04da8b5bfd4dd14c968b0c3f60f6558c454b1e4f2aeae18ea8db585ea687e31db0142091c8df4f6c8a521cef4818f9c9f458487d61c96dc8dec4238e80dd4359"}], 0xf0}}, {{&(0x7f0000001600)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @broadcast}, 0x0, 0x2, 0x3}}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000340)="ea76f93c0dc62846b90fbab94ce2eb42a4e9093f596262f1384d2d46f7cc16b373d9068142a540", 0x27}, {&(0x7f0000001680)="93d5447f47aa4c9978588dbfcfbf2650d74e1991fe8676ea8f40d9067eb6a2e606eec78f8eaeb7ddc8cab72747c2efb050496fb2b3be98239dd67e65569d724b297a78e31e0486ffccf3d86f7a5b9500612fec152d7901bd5ce85147e45a9e0f7c12037d73ab1ff4f201323bac39e4ef105338a391e905f79944f3b187603c6fb923b6da0cc81d24dd270ec8d0f9400d3c36b049556b7b64b2d25e1a2b9d27a3afebc4e588801b2735bdaf049f9aa6b748490efc8700afc559fb0b296cddef9dcc", 0xc1}, {&(0x7f0000001780)="220d5f8b5bf82502446e91b56d22eb76af19a609a70676f427f8062c3dd7cd4517c037bcb1f5fede35cad459ef198fcc42f20393e92006e85a6c56dec1903783540b800491175209f07f6f0e4cc30c5ea9594c7f2e2da289b1f59d43e7638c644d50502f66712e89afe0e3afbfb9425f285143707065981359073156d4f4421f7c843b2ea24f3a552fe89508866511c2c61bafa89702ee06e59e2e657a2e9f7aa17b824651444e501a1b284eeea60565eb3a48135e89dd23a78a267cd7b6070ae46a3907489be788de72e20105b53db87c9d9b78de51f3d7132638bc530d6314c54d3e9e31c96ae1d8", 0xe9}, {&(0x7f0000000500)="3d6dae3f13450731aa2de16c097a2501b5961b5b92130dee265050986eb8fb3ec8b70a7192fd65bd32e2dc43b2588e237d4d72570102369652c0", 0x3a}, {&(0x7f0000001880)="8040848e07449523dce4c63c8e39577115d3b602d5b3b7510d901cf1fb326c5d9502a68f45e8f04c0124e4e5a020bed1e028f3381fb6b4f47a95d70953d1f7ca025b6051c851f78b38c64a6b743756cf69ef9e680b9c2da1cd3a4cb0c9c8fb0591555f9dcbc059d2f05d41b0e4f57bab26aa28ddcbe4586d12b5270125c2bec60bee06b393bf9e01186512872b4acd06bd022f3cb5359414a31811de15b025e5963a77c64668bbc97c8ed6ddc6003d2651be0c7c7e995bbc029c676cb7c16e33a9269aec4023908dc60b9b8782104e3c7713ce4c41eb22eb323afa33dc698da5ee693554ed39ac44", 0xe8}, {&(0x7f0000001980)="331a01d8f8ab28b5627e91163aaf2243e540abad3cf266ca592e97c7c27c66e868b0da2bdd1023ef7053eccd163f041983eb93d8f117cc1bff10d13bb701d3ea18fc249e494d33cecf722f0afdab8d80dd0aa3652c63959616239665cd9a833ddd7f48f9efd12f98381f0e69b7c2f478406a526d20a4c2deb7f8d8de20a560246db7b122675b7016f0d44f146553f4ef5902eee5fb1b35f6ebea2a8db1b991e454a3ae73b363", 0xa6}], 0x6, &(0x7f0000001ac0)=[{0x100, 0x114, 0x35, "6cc1e97f145ee5581388777629092c17ed0e6b0866e53f04ab3026181c2f26bb5945728d405f776cab346a5abda60d610ea1c88bbac40c100c5cdfd5d22b6a64c5017452a7d75c3446988311001017cb6a41eb5bf71e177d9f53421aa3e04bdbac2d6a9f360eb4d5280094d918bed374afb9d7bc425c15011b97b2d292b32f2f4a615d1e92ff131d71ae4764589c52171981b21a6b644ec4eff93b68949357458cfb85dae4c1086369bf62b94e56beba8613e4887b98680430d5fddec0307a3055bda07db432469b88300679c2c382f45ac5b46baf2aecb1c2521f9f230fb86a02ff5cd8c59b168937d9"}, {0xb8, 0x10a, 0x0, "9e1e0747909a37269a78760ec4a19ebb368345b59cb340ba0b84649d88d5cd85adb62c20a5c4513f722e9a82768bda2b6138d59c455b141b93c856d0e4371056e5ad712c94ac592c1884b1fb67c1358729bcdd722294872aa2d8e96c9401b6aae6bc7a754524ae3436e6a7524330885417c19aa5547d1a4258c9310ae828ac03fbf310513d94b755474b67fa0e9bfafa4dd022209da21ac321ce2a42fd97a349417e"}, {0xd0, 0x1, 0x3, "4d6d6febc7b0fc586b23143d418d3e7ffaee7a17f11e712aa74eff0d668a492485df417b503e15ceed9986d80a9e419d20c5108c4acb714ab50c1c9951b3db4f0f59d585a6672bbf9cda4e443e6d5ceb38d2718be2c346a30a14e433dfec235bba2591ad086cb98b846e1a7f1f8a49a6a7fcc0ad24ee453a2ddc1d93272c28267c40cea663cd5b8d44127b0262d98a0b99665f2a40c68cc98c9f5d03018ee38bc6cf213be497670210e95007a0cbe801d1d1012d94180e243fa5493b"}], 0x288}}, {{&(0x7f0000001d80)=@qipcrtr={0x2a, 0x3}, 0x80, &(0x7f00000023c0)=[{&(0x7f0000001e00)="3d62fd9460ae39ee3956c546d57b9536727e858b4f5ab6ed637260bc85a7ef75fc54ad769bd727b4bf5ae02f7d7d78ecee8c33ef4372e94a209eb278e69bb58cc109c9f5fd38c96609de2e9cacae3db71d8c69ebad658eb125a5f39a2b3b2717cc3afff8de5d9c84d766403066a06b198b39cd8cff7de4a38c5de8e2f8fc707536a4cbf4d1c27441e9f52c1bb9d743e3d895b3e8e7beac554dea27af626cce32899ea7aa6e9eae0d457070e961824ddab099ba9f63477975df6a8ace6b3455df57aa2082eb30ab7dd0507f1edf64b19f121a448d0af53e24", 0xd8}, {&(0x7f0000001f00)="c4a31c191ec3c7b2f2f8dd72c059ecdff89d470feb8016daaca2708c38b0dacdaad7806055bf89ed4b2bfb022d8135ecb9524ffc0d07d8e5731f3bda9b270ef30ba1ea9628fec84e69c260b09c9bd49e", 0x50}, {&(0x7f0000001f80)="d408f9ad501437d05e50719ccd02c304a81bc5d7f9c8f1f91dcf069b13f89d94cfeb72685c0c25868de028a4838319c6f095804f9651145a6989a436f6302ee3916f6334340e94d858ea54f987ded380638de8b57cca23a3c72521bfab008784ad6272c061186240ad3bf2e64e983fcd1484711715add661d59d73be15cefe627a35bdd2c32c8ab019ff4b5a3e5e82e85a5878f237da6574d4c44051b43fda88cda79332fa30dcc1b552e5fc101bf82ea9f00c6e067c5f7c8021e80cfa5ad8884ff90be6226c178a8a7a2c12776467b8c72f75cabc81a9621db026f614fb", 0xde}, {&(0x7f0000002080)="8882e8b06a8bf9a166fbddc230cbce525fe792", 0x13}, {&(0x7f00000020c0)="7f651a61b3d87faaffed98b7e1531539e49b953303d7aeddb8e674d3e1af21e639fdf2687fc10ca80d40cd6b882d274571c4269b1a2911b5386d0d4e6ffdbdbb5f74c637edea59feaefc631306dbe6abca47ccfc04f27bd81e588ec410aad0e5bb8d17443529045b4b6c51191ca5bf3c0dede7c3d337919c3d106e6c3cb55e512ca7b7192083fa467d843211da02c3136512fb426758410a257a476fbccba18a2734f0658c8ba4feee01e692467f3758491760222934ad3c4bfd044c5e27ccf250039f481218c9f23b118185bf56ee3b0bd1cd0c0fbc5cc7a7", 0xd9}, {&(0x7f00000021c0)="b291910ac597d0ea9dfcd9e6b59378c9306920c822d7fd1bb0c4802fdcd46a33a26a9c9a377772b67afba2957d6d64792b1fee7318a42b71b2777c9cc31db05f69d34cf2aba4f58113fb74f6eca3668bae8e51917271aecc362a998d0862ff5659d35922489f465c87d47c60b24674e534e31df895fa9cd52af98c4494d7fa2b62709e475c66e2a09af85b5aac26523c1425e2a0430bfe", 0x97}, {&(0x7f0000002280)="ec090367322913e496b95adcf483d7ccd4266c2982d7c949dbe5de0ccf5c9da49dc037120581a82c161d7ceeb731399887249b94dd7ba4cb", 0x38}, {&(0x7f00000022c0)="1189eaed6a5e25617cea9c0e10a2da206f391fcd2abb31e9ae70c4ad77890da08cf68696aa579706c082989b6d2d5010a8458c21ddbabf42dc78ac5bdf1b4223c5e22b29fc7fc1410d0b6a010bce949ce7174ecff09e09fd84689d2ed3475e50895d6fc696f3d03e6d7ad280a87e6af4398c386b0d5005ecbd289782d5ead67d26d008f877632dbe1c1930482f37b3af2397a4e131b18ea091e4e807c35f52c4ae9b231fb89f4bb2112e06c9b2bc9d5eaf5c50aeaaa38c312c8edb7f77a982e3f19ae57849d6134120fa34eb360b1b9e36747e761ee1f949d0d2ba573a29087e8078", 0xe2}], 0x8, &(0x7f0000002440)=[{0x50, 0x103, 0x3, "59a543bd47f7a24cbc9a260b5c8ed7e16448eabc23b570a67d2958ee2674b01a08fa56bf13f2c5aa91b3960641cd4db0c807330d575ec6f94258"}, {0x28, 0x101, 0x9, "0990f0d41c38d15d9a5e8092630bebade463e7e0398a4c"}, {0x110, 0x10d, 0xfff, "6dc3279f51e9396418acfd0940837d2ce90701d0c6c5fac69862f0d26f8790882fe1bff33a296ee38a3cc1459cf5c8d4f8c0c555db2914dfb06e4e116e04d15d18c036e54a9a68f85a8bac3e486862618e630bc48752a35e96ca3665161fc14d1db8178b5926b726d5418a210ec82b4667aae28cf7aecc6a5527d873ade1ec40c2b7a7aca8c33cc77d8d4d03aba80fabea5c49272c8eb05d71a8c4dd00e329483354085facd5f27e9935f67b6eb6d33b3623b7c6897bfad6344747e985b57e0f1dccd0666d130915f42607af68f700fbc911c3dda9ead887a78dbd8b0ad92c853322c52fe4f655f1a7c285b444bba65127e721ba7989b17cfd81"}, {0x18, 0x104, 0x7, "f101d6774b"}, {0xc0, 0x3a, 0x9, "c3ad628c138488e61dd76a3eaf169777c57e3e4e08662458766819df278fef64578ea757bef433824e6779af8717d53971b0ba4556037651793a6a83939f26cca1e75569fd9541a2fb0e39076b5f12cba9f25a9901af2027a52bac13918c8a33ea0b02a5221b0ecec28c1b19303324d37a0ecd99a3e77cf8e06b24441affded1d8f4d7faef77a124f1e5dd599d4c7b41312ef0ed02211f43e8fcb98374fb45820f295f928fdd49914629195a60"}, {0x38, 0x10e, 0x5, "e12c61cf8b92503ec60551a31e25b42a9b852587d8fa4499e47e34e313e0052805cc37f25b3a"}, {0xa8, 0x1e, 0x101, "e0466cd760d9b61205adcd052c65b1f18046aac0110a9ec0850f7fb3057bb03cdc8cbbf375363137f16eb2243f8a0604bdbfcb6f7ff90ab343c8c1c2f2ed28ea21001e2f32cb6190c1a1216fe8ad2488cd17a0c0300865f156c6c51e8b20ba81aa934be37e8b65f17360e3926eed2031639ff2962dbc3542734b7d6d137ae62f5edd546ab755f011f1f879aea422ad4a1136"}, {0x1010, 0x117, 0xfffffff8, "5ccf547a24df6d5a473ee7015840c984d24f83cc58845907bd07a02d13d0dc35e18667d1676b9f0e5460c10a50f0aa41126b7ba492998f0d4e104e4af8ea6ec88d6b9cb2012d462d3533c2568ec1110ce4418588ca0506b0613b8f8e210d468cf7e994c541c875f9cf769416c58897a812de95da272ff18cdfe9d3ded6133a18367ba51887f512b7120568d249ed299edd0258c99917c5cda1bb655ab69e971b957baec742740f2b264a329b65833a4ca469256b3c3d43759f53e504d8a71370bf256fdcce15b99946fcc1db048a738018333e0990b0224ebd3a7c88ea2661d0bdf58756bc165ab00ce3c432d8a30c156b39db63e02bbce467dc07e62b692a69e979b0c062afc7d068d12183a6d8ab71db5a65961d1feda761b39dfacc0132241ed4fea3f4feb0061b4e932a60fddcdfdb03a1769f29f8bb278593e6decafe77dbb553f79c7205b352680f2d1cd1de46c37de23dd7f3122387d27f3e98c0f001f9e662a5ccb201bf33d537d4113037a61f87c6de5688f18e5430e4f8c858ce98ce8f97bcbb5491c117723a11a5db64dd365b30d0b30c1a99900c4a02b7c7210cb2bd0880cf654fb828dbd412f46ea3011625c7fbcd85704b881858f4aa929a42ad364a6bd7139e1d2bb15992d2ddd47922b1a5b5868e27c3380681d15ab78fef315510cac484255980f52cea3b0f66ebd7c1b347212b9653bac0278df39a96f93e555adc820f5d8745f79da9089a52d78d7146c76123e0d0355927e849c463cb2b5d04f8e2019e780c5226fedd5e6f204450379e958a2c6c3b5dc2dfa8ce1156c50a617ecb09e14dab39768b608c6e212426c7898402574235b04245f138443b1617f7061d454d5a626fd4d77e6144c2507cb3bb2a26babfc6d3024aa5ed66182c87582d49f69646ef153a34e87299e004493429554a62dfd166bc33fb14a4f148d30e31fdf93a4fcd5363d9c3c8d4054d3746d286d515b0f3b76af6203bfb9beaabeb08c3427f40c21c2e1d7d423bac204310719bc9a07e06ff902fa60cf50af4c8c92cab994639c8a0d8cabe84566cf2891fa9e28a52c714e54fe289d22bfb678589f6bb3156bc9eed5c8c102de63a6364c1971ac585fddb2afc75511b0b12fcfd4e14dd1abc26ccf7342b72bd457cff6a6795a8054f5cb389db11243e2f2c15cca6f4b4f03b395000909a82b4e47c8fa16e42a988ed482ab31fa2f58af6589ad5e72a394cd3c0145733e91d9da920967bae15260aecaf0eff69a0d9b18562964f20a8badb2cd50e59fe634781cc411bcdfdf85741b1becc82fc18ffe7e975965741d09c5afeb448e093d904da5a676e2b10e525101dc1224c92fb99b3cacdecb0dd1385889549862b8c7b2757e11a22b0894290b5d1d370a614f7764bdb0a3cb8ffccc62c8ab8f04110350b0aea2c6624987d38c533d74613a28f92df90082afa0aee0f31437aa2e9f844502cd441212e81577b2b7cdfd5f7e1061fab709471adcf98aab8e2b0ae34bdce5325942ec3a1b3d4a305def52c4dc88fe302ac76d10f342c19ce5ecf52df7417218b2a06eec913c8204a43f6f9788d833519ae22d2ea7df0520710333fc75c283c486284c9e19d494d191c091a3c3f7dad8169d57d9a739117c583f90234fe46ff48d1cab2ceedb533e6476733d038a73158d8924c7c4cc902388e5df7430e5da56e090e9c5de0c5d3f49d34648b2685114816707e66312e2a726a7f31f624105dde751b4aa06c07393f475b1d887531688d6f0ea17bded33827fbc0e9aadafd690f2cdf5370e15417280c5c1ead740c4aaffc3300745696767315002ba9ec665866e4de4071cc91c425e237320cdf187f4bc8beec0c37449afb6b3efc04145f485a5790d8811f6b624b37e9af3f6363db483089f68dcd5e6ee93fa795051886133a6e9e00f0b917b66c9573b5a2c2fdea4c87928c78bfcffa7606e2e356059eb11c531186938298b5d704eb5d3b3dae43485a5e8117f67b64093fe8004f68b13af3fd683fe4301c9666223782dd4623852f75e79759c2a1a56e1f9867c46abb5b15d56834babef551f080b81017e503e79cc6a3e383871911a7b4b18b98744422bb68acec2d7c57381722797f9a97fec1e3400c6a6a4826e2651555b41cecbdb235ce8bdc9f743514eae6c743e6c3dae45285c23694407eaf15dc543db18678e7a4166b5e10597ba79435384dbda586192234d18f1d855119596e6862bf8706706166eb6f764fc8f96bcfdbe510fb8aaa24659449d74ee598ed03272bc0756e6ec57596ad8f0a0624a1c185ba3894ab66a44299990bdfc848fae6385cade7132abe8da9c00dcf3afa7656dbd9c55c244922b0c4be562c2d519888b31f1a0a90d3d8761d0035ec998042ff6c35c9de4cb3e76ace78741049ebf5367416f6f567aeb03564b0ab22e2ebe9641910f548a0d50a38a752b2aa11fc6123c0806d3f224c4a20908581cdd4332db0cfedca1522c68b90e64660be931dbc1024ad7de1974693adf3da57207b0d2acd4925edc31e158bc81b072869766da347de0b51436848ed61211f175a14724c4a41e0633797c0fd1595d2903f84ee1213662f72cd03648f3d7f71fb25be9160b48cf1d7f0f094e07008674d4987eff52cb886c00e649ad703b8042a2c660da44921d49fcdbf1d6af9750a0425817a3aa2ec2fa79eec124b83820b659ca3ee2a3119453cc5675ff27d7ab5f852693666b552dfee24a57fa1b38946ddc18e78888238f2837ee5d903616caace945b83c0ea95714e50f28622856abf328bc7b68168eb17d8f3dfb33642c2dc6f7a1c59f2cc486f1593fabc281bbe3bd54a60e8004d81fcbe1b836aa6a9a2a77bfc31de7216b11e557c5015c4f4d0ca777d55fa3ff39202f4a066c6bc7a454d9cf9c6ea2dc3350d90a91f34ebf3fcd5c61dba67ee5c57f5f0552a040e9145a5a7316cbb27fed5d954a8595229a901c24fe8779b118b9200c6708fe6a49ba8e9ba220824a7b669a8dd94a325636b4ca8db825e72d6bd6f9e499af3b720993a4d45a8dc7ceaf986d35b17b46334d658866480cc15af72efa9d52db80f461c12a090b7b5fd5c9293d8cd4336c8c5deecf005c04bd405429b63da79cfcae435fc6195c35a7b7bafadf867f2ecab4f990ffbb5d5b8fd4445a4cd05f9b697c8bc1e759efad4c19cb9c499feec1e9e41df03d0abaa7593afcea50dcc3add1c6dedda1567029bf970b46c9c064fef5be1c4a9d794147d74ddde4c7afda130377f926d44dbc1684a31b40a88f75b4e17fc202af06f7fe5b04e47d42a55317e296c9345ae80d81a1c8aaeddc53512a175259e16c6727b649a6cf6eca0ef776fe5e30ff06281e30534ab35390fe15eb722939876000a353032f2f0db576bfbaa2eee7e73741152f002b9b4c8c0e1b2e2e01841b951a85a1b28c62bd9e90af2d8b279c9a9e8c5e86fde2916a16177d891474cc58e0dc54f4916b1e9846ac9bdd71639ce4539398caf4100bec85b713f13a6cd9d3a278dfbd0fec49c844cc6270f56a4c5a413213650f39f30754c6cf20b021a4bc7841241e9fef2b6ff015e654b111bbb95fb2214e0dc4802ad933172ba7fcff633b8d7f67a237ca8a6ef1aeb29f3bc4d6f786cef973d5e72509acbf02853bdea529fd0a377eab21dcbe37cd70f8459befc9a6a8cd8d77c96b7eabe4feda7452bce1bf8e1c01b690cab9be0b87d481ec74692c3a45ad7b01d15411c3f8d33dab3da67dfd7de44283e372daf4824739cd8e613f9d01f5df627fd6c018b2f9521ea543a91ccb9de5e10aab8150cb7f1725ee66083141542279b052e926445015b7b8cf8d03d84806abb1768d206be36e3f5af4830cd74f0cc1b9161ff6ce33a81857621bc98fe86fe705c12f564f6344007eb80cf6a77baf84b6fdf647a8b442dfc4b0894ee4b00658fda4b792401521f2cec583cc73e4691868fcc44952e10ef07ab9abb6ee9e61ee365880c013c9eb4cc57c87b3172f5d329a10ee20697788dcc49244d25ecdc82034055948287f10fdb60f09aa46414a477b6cacf9b7550635d8fa844e01f88a521a483249c6b5b941f40351d93da31cfd6a8b1ebcf135e0cc79fdaa6401837b6fc9812e34d770cc647f8b52848210ff932c72e88fe5f2093c7c95692de806ea5ca51529d80b49b296799d412abe9448d3cd6dfcbb781dd8f892459dce7af8139133bf5a6014928114cdd0ddbd57230b5a3cbf9c7892952cf5af5b97e600066e0a873fd5da99ad1b9f5f98773ac9ab83ac6303ec5d8450f75f95993daea933de6d23579d23d2c040dd6e511f103cd741607f151230b6c4e17ad3ab2a786def02f15f158891cab67de3440e5266bafeaa4e73fd7c820a70a3ceff3e5c34c2f379257766735f15d3c3d31df6b5a9d188c0df84fac489f84a23dd760723283a357caa379152f1aac900bf859b2bc25bc688a53b4d5f6de1b3b51c8d8172c97b757d975c6c39d14c3d0ac7b3f0bca3e7d77aa069763020ca034f718e6c8599f32d42dc41544059883b9df906134e26bb6fd055cb410a28b27f9c6f78292b5d2c6525139d8b69748ff9fa4d61be7fd36bf609f4e555834333424dcebb3bde5b91a9a6fedd07b41ebfcc62bb56dee8a9dbef68dde1574888c3fbbbc0d2f8b532d8bf9c9e47f464a7dc9b86d5c59dca8ef2dbad9eb00c7dd173f887f99ceb54e768337302d70c358e2415043c7f66b7f1b76aa0cc077f0c56d572dec5555fd7e25f1ad5a00f9353bbe54e711276fc24f3b0628820137dbe2c0368a38893a7359a69d7d1be743c9d14af1a4ce292f9d3a71c935de5a6fbeaa5e2b9b97b7921420a60bdb4cefdcc1d7327dcf07a99054489e8d8a807b83a8ca348d509cf5a08d30b71a007beb5c2be58afdaf105708816dbeb3d64ce38fe5df7be8e6176e38a61401f35b1ea9dfd9ac0de6bc19072d9f2690039629faeac386aba60b6744b0c228166e765c376139a5ac40fa6bd4a1dc0506c913cc361c5979a10c908df50c00cd0b0c63c0df30b2f43d28692355e141373c7219359fc34afecc5a594292b636c4577166cd15e0a7c9274050d45da7aa8bc0a639dafb26374c813511aa398074cb808257537fbed49a5f3e1022e6dcc9a918dd2c748b3fbf0d81cecae16bba49ade278ecfab77b0a180fc443611d9a2b76261ab4850d3967d43e98095109dbd7231861f84bcfb3f9da56c60acfd89db980d091afc28bc6a4e17e3cb9bffa8f54a078d51fe2f7e2b99a2770cb817c60fa2b484327f8ca98a4cb6a2c3a8770c93b0411157e79c5f9beff8b0bf4df7020f5cbd16a7dafd37fd5b8c7493884f21e5937dde7dd0befbd88d8497b5387a74f7b00a58e197cf49b644545e03713529dfa7b37dbf6d8e27a22f1fc5beb21ef29ee6b840811c075f0d33e1c37ef60a5e79714fe8fc3520e555b93fd6cff2f5d7ab46c84b811b5236d15dafd4b1c3b881a8c64a55b1526ab766823494861c718280a128a770f3568f44761da1bfa1d527130f63512a610f3d28a3cd73a3c263b486339da9d51d8fb7e5921589744dc30d3e9a1fa5d4be2f6d19149168edcd048745bf29ac36eb9c2bf78663184b25f25d51bdf717eebb0bbc0026336664ee12ebddf8fa7a058211ad3c579d0b2a954bbf0b9a0c9c65f0f3c946aeebc0efb64b70e03accd46f4d8e983a41d2a26a3ab7285419cd7acb66d8c945608359750e2154666f8c46868588f9887bc65991848273480321ba50904d91f81ee42f5f08e1bd30ab82f0d27da67c75a9dd9e3725a5a953ef05ee026ba9f4e9ce124d850f68e45"}], 0x1350}}], 0x3, 0x1) (async) sendfile(r3, r0, 0x0, 0x100000004) (async) socket(0x1a, 0x4, 0xffffffce) (async) 03:53:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x500}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:53 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r3 = socket$kcm(0x29, 0x2, 0x0) (async, rerun: 64) ioctl$int_in(r0, 0x5452, &(0x7f0000000080)=0xae) (rerun: 64) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340)={'syz1', "5b0f566446afcb7dbd0df3a56e2abb104b8276b64b94a89ab4cbb3b333f487f0c09eb34d4887ea4ee709dd847690a94d36019b4845a4c3005fc307606c2b6871e609c0ee7d33a7005f9fd6816898fea7ff1c59b54ea05aae433f1ca8962557554bf968520ba847221d84aa8e7b39900c5998b0e7daf6bdce551fa07089f71d07b09119c429937744ace0a1a369988f317e011acf6ae42d87525c71"}, 0x9f) socket$packet(0x11, 0x2, 0x300) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000300)=0x14) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'vlan0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000280)="0872fc7276042fcef0ad0aff8100", 0xe, 0x0, &(0x7f0000000180)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @broadcast}, 0x14) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000070600ff070000000800000000000000"], 0x14}}, 0x0) (async, rerun: 64) splice(r3, &(0x7f0000000180)=0xd85, r2, &(0x7f00000001c0)=0x18000, 0x9, 0x11348420b87a711b) (async, rerun: 64) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async, rerun: 64) sendfile(r3, r1, 0x0, 0x100000004) (rerun: 64) [ 507.686039][ T25] audit: type=1804 audit(1640058833.290:3695): pid=16871 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/422/memory.events" dev="sda1" ino=1178 res=1 errno=0 03:53:53 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7", 0x9}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:53 executing program 5: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000480), r2) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001040)={0x4c, r4, 0x801, 0x0, 0x0, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}]}, 0x4c}}, 0x0) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100), r1) r6 = socket(0x1f, 0x1, 0x3) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000940)='blkio.bfq.io_merged\x00', 0x0, 0x0) r8 = accept(r0, &(0x7f0000000980), &(0x7f0000000a00)=0x80) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000e80)={0xffffffffffffffff}) r10 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000f80)={&(0x7f0000000ec0)={0xa4, r5, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x81}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x6}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xf70c}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}, {0x8, 0x1, r9}, {0x8, 0x1, r10}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0xa4}, 0x1, 0x0, 0x0, 0x10}, 0x40) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r4, 0x200, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x6, 0x5, 0x6, 0x3, 0x4, @private1, @mcast1, 0x7, 0x80, 0x7, 0x10001}}) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)=@bridge_newneigh={0x50, 0x1c, 0x4, 0x70bd26, 0x25dfdbfd, {0x1c, 0x0, 0x0, r11, 0x4, 0x1d, 0x5}, [@NDA_IFINDEX={0x8}, @NDA_LINK_NETNSID={0x8}, @NDA_PROBES={0x8, 0x4, 0x100}, @NDA_CACHEINFO={0x14, 0x3, {0x1, 0x1f09, 0xffff, 0x41a}}, @NDA_VLAN={0x6, 0x5, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000014}, 0x40) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r0, 0x8b1a, &(0x7f0000000040)) 03:53:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x5da}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:53 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) (async) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000100)='veth0\x00') r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000003880)=@newtaction={0x284, 0x30, 0x1, 0x70bd2a, 0x25dfdbff, {}, [{0x270, 0x1, [@m_gact={0x4c, 0xa, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x0, 0x94e, 0x5}}]}, {0x11, 0x6, "70347465ba0fa17aea5b2971de"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_ife={0xc0, 0xd, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_TYPE={0x6}, @TCA_IFE_METALST={0x14, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0x7}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}, @TCA_IFE_SMAC={0xa}]}, {0x6e, 0x6, "66b9a2488162a86ca283da5eaa48333846082e1e137f27391551bc40dc75f217ed78975ad8a541a7993bef7f34bd9ef277f07bce84320048b99c786bc208939b0f9c24ecd43e1313c7efe767e0bb7d4c6d48a369a887c660043f8e321c0ec691c38be35dfae335f67c49"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0x160, 0x8, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x200, 0x4, 0x0, 0x8, 0x6c7b}, 0x2}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1ff, 0x8, 0x6, 0x5, 0x2c}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x1f, 0x5, 0x4, 0xffffff80}, 0x20}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4acd, 0x9, 0x4, 0x4, 0x80000001}, 0x800}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0xc20, 0x10000000, 0x9, 0x7}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0x0, 0x10000000, 0x9, 0x8}, 0xff00}}]}, {0x87, 0x6, "034a8f7e96941c52650c778f18372a033694ad3b93d1850951f98d7f2605653300c20362d786d78463c3298fd652d968076ca7fa16e1346f5b03a562c286706f7844f20c4c793567bceb38bc11491b8f907e3cfb7b3f71897ce04153794e2f41028210c09bd6b8af138e3ced63f850296668e44f92e027de998f0f6595fff9d22102cf"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x284}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f0000000240)=@ethernet={0x6}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000600)="8af003f5f059f5b587793a921dff2db99b8eb9c1a9effb036c0169ed019999114fe9db90002a385b686041ef77329e5dbc7b0a0c86655a916c7dbf670f5414a566509973f893d29e71cdcfcd45395194ac7e5fa6501d1454b6c87a2df98569b02746dc8836e98dd602fa44acfe1633700be691d6649ca08ac9ca91f775473fb4ef66cbcb79c724f2a2fd243bee85237bd088a0de6e555d1149fa1e7715652ea0d6b0a45cfdc7c88ea881cf6762780d175684248c2ed13a17b5390c301c0d82a60d11ebd9efd20610dfc45e97eb5abef7cb0023cb28d7b7d1e3456c8d55f634c724af35c0f6021f433f6d9d78b8f5dbe6ee371c075866ff08bdd85a4618fd5027c99d9f0ecf4fe6ae9af85594736c01b2350a7f105bb6f827ccfaeb8e3818c908184c9fa5a9fba0ced76b1d7bbf46040907480c1483e1755e6fbe48b544699a25b9257d2c9bc1025b814978520521079db364c9d6ffcbb03efa101adbe525f5afb89b2e29faf27de25c9ceb8c4648ebbd3e80ce2e8b61206dabb15ff29dc598ddaadb48e3d113b9d517204846c5d68823facd3c40bb8280a9973709f769dbf9d81cf74199bd482e6da8e098a6e0d403c4f1fe99e5c033e051676bee0d3404e956bb1319decd2593b717a526f1d3c51413e5f6f467fc5399e41e49b70880ac52071225ea17454c74bca6c07a801c663938133e5fbfdeb7dc61b8ea044da0da183133b3edeaf0b1eef719c44996f330b7cb5a6ea2bfcea5f6ac2d36e6bef233b8e397ccedfa1c7689c93fdd3a34174318634e89826acd7069a6c5dd9795f59e2fd740062b84f3b0be0eae86996bc9a2e924538e6fb440b595d82bd42cc715fd6a918db65aba2ff58137b735a237db13de913d715dd718f5f5e9e4c68aed26e05a3ba71911ce59c4bd89ceeda1d7243c235459b4e7cf492ba42552d787579ada7cee73934034d48d20f17766044e31ba70a5577b9e92b7d19de535230e912b4a842a0ace87d0ce4e09e24cac17ec246875f53c4de97d7b6eb05d82a89d9c39127a037ab1c16e2e21463be24284a68ea328238fb303586da25ebeb6c53790e64b060fe8b79a5c86a64584e3885166c6adf16eb557401cbb2bc8a43125f565a376d7c5dc46479192d4b5d5718bced118b02a84e3bb9816d1d4476c0eac6b8f2a4b0b3c12844a786decb3a91363564f8ad0841e0e5c0d84ebf2b97ce609cdb1691ac9b2c1f29d3f03266430d08068a03317afa09b0dc6b571281c4d31a2c3db50a41bf7dddc1707d3b9c4cc5402424a342ae96183b32e94b0ce232c4816a2e540bf61dc7ad6e182914c87256fcb298d78a1772f533d6a400084cb1a019142ea742669284186a5988434b4f98121b054da1707c2aad8fd1331efbbb594ab9eb5b2bd451fd08531ba913543c77dcbee6272c13674d1b7f27cf0aecadd72eb3aee81877b441ad04dc0a19b0f079e4f6b1864e90ff80e829d5b9067f8adf0d195866baf04ad82cf360d424ee2df495817c82bb789bcbbd1ae43e52cb9d41e28944e7d6bb73da9cdd2dd634590ee2d892c87f563831e7b7243282f494e6c9318b0f72aa202b8d2fc46fd35d9ead2412f9fc0e221e5242063b26be4f9d39167b73f5ad3ecfa476c8907e32cfaf15c2b6bd6da1e68076a805f46e4773d5f89aaec9737e864012a68af3822456fddd2b3e1826c8829e3b46bea8b21382724b2fa9b923f8ae33305e6adf8993582bb824fa4c91dfd52b7a79a9e5dbd8e791e98bf0c0ed6353452afdcbba756d7ee7889a33583c3f1d6129fd4b8547ae6355b969f0522883ceeb0aa0811ecc60911a04244773a6ba9f12cd2c0b96304923e81442aade19762e91419c695526ca99a49445908bebaeee0a540fa6c4db27bf2ab6587e6f551dba6bb036e7d3fdc652c679b17a3cf22f1a68e47f0ad263f7fc20447b3641a12d2fb736cd616cecacf75ce32f5e57f76a41c11b81012190228fe7e1cf836954336b9e6c26b68f545409acf441d3588580bfd70de0205a0d9b87467000896fa012529a51aeecbd8b3d12be673ec013c21086d82108675332315feecc3db8093ec8652dca5a709298e489c57f533623bc6563a83ce12ad626ac251d0ec25137f1ac1194a9483b2a531765246739a015643001f96d5620b505825fb1ac1a0451bc38253b28d75b53be5c66d5bca61c9929b2ab41e03e87351ec4ad42ca1d48662ae91121a6d586551e73946380266da01bcae6aacbef2c3a9845b6550ddf0f8bd7177340076c62b26dee8bfba293076496713121b8cba60f9308b2f0ada87529150a96deaa9183e6ec8db8ec9a3971f7d7efce1f481ee73715f31c722be048b6bea26a9c99388471f5c500bdec77410fec1fbc076a19319acdb71fa6eed6db18406c3c23b1aacd5e2031f4862948a351ef065a848208c32f307fd2098798b9cf866c40b25540dcd7369fdffd12df37b40760d6b76fc095a750d881c2ebfac72bd0fb25082f0581a918f64b3aefb58fced9d82c984cbf4ca961d6ed6dbf05f32393ea70249fe849a2d96c802cdcea222b2a3ed66071e7700d7730ceb205566f4081d7f5db904b1e10c876f05577c459ea35f0149bab40cb623df6157dff70e75b137f00119897a9a1a8172d4eef31373bbaf4789d3d52e1aa50d1344555a2e53ff8656c3bc239ea62603422b724f51c1bd3a42d640aa627b4200075cd3f45078b6df6810fbba1741df1bf97b0c7cc7c3455acbcbe9c4ffd5f99b4ffc7166ae6961da67b6c4e41ed3f61108d99686913cd375ac510a2cc7d21462c6239016f9a448f0ebd8141e375bfdc27dcc538d5f0a139d82d5c4356627cf9c687b1bc96389be772ff42ee165ff9fb6a857614cf435cac80d232f84f5f8f44903cbb4b69253fd12c727e37396cc7e68495449c8f29b5342ac2a12cf74b8be4294b4c6a84e360f38f6c90baf27a18f200f64e153b7a2ba5e57022cccb1144bced93ff27c8fc4b865794bde3d66b2e79a32a7ca79f865b8b15687d77c94cbf23f7c8d958f382e363d02fa16498a69006c7b6f0eb623c1ef293a74c7a596ef9371d86ecd46d5b36f4f4d5c449810b4627c463f5f3acf5234654a14cfee7ec1c53a804959fc748434bc8fcb41b0ef26b3e25a0a26a2dcf8d174ec82437f451804814113b31dd8238d7de297fa226a359bf0f190c72736762344d2df5a0391a9ba2e8aa08b5718cbf439464c694c7c86831fa8464290da624aba37a595c1fb11da11b01645cffd793b8e8a483ddb5ad7fc139166603eecb04362bb104870a589d47c89e1ced565ea02174dd17e209ce822bb4266e2ba248fac1da46cc615099caf173d3e238ec674b16dafdaf284e642a3b082873a4a787c623a2efd17d308fdcf55700d982aac32a35fb49f865c17c261bb42495b38b2ead223a40a188e4a62dc0d579cc474aa2bde6e87f4797886a377027730ea13e4791371980810504f3394c3d326366eaf80892567649e4a889942380f6f3c6c7030347b4663a170ca9534c726af6454f5db7e2838a8a6e1266b1c46adb36205df955dcf5322415c9dad36a24dc48517a0ed568b55ce9a724471c4b3aa961c521a5e25bf05301168217621d21c19acf1f93b3cb270fb8ab495f122e2ea479dd60cd1eee7df957405ae6e3ac237227d59e334a12e3bd02e80cca24c5248dc6f2ddf788785ed1107e5476b858a365e2f4543e306dc11d24e2b14a952576f9e8a18c3913dbe90de5fe77dda8ba67c373ecd9d768f2a621270ada0866619aabad68ac6ff744f8ac66efa14d605f66f09f2aa6fc123c8edb0b9402fd982ec7239ef7c1765893671b4c02b8cd172504269ad79d79dde8cbd7645770237cdc66b9ea02fd36732dfad3ee132157bd9bec5a4fe759ba66e36765dad2cd9cb02af3634658716e505b99dff4e3dd1b9ddf4b47bfa37b94fe5ab2c97bb521000297de1acff5469d453a1a024bc19330aac44fc039391d74f1bb58b46e0018fd5597bdc42bc89e9cbb02834b47acfcd997363f69d6575f99a4ed17ed9b7df3b495f2b52fe49b3d00679730e96d3c02986d1d6f2d33388f8d4b2cdd2565d846bca8b2dd079ee0aa88e9d3e82a694493ceebb036eb56e8891ff1fc707cebab9bf79ee1d0ddc752a7de1d94a3aab8316377403effa788f3b74c817c22108e70be33691475c51c316391bdec735b3c5c3dddef1bf2b96c7b6f1c8d239106339a66d2f81f5d77db425f63ad70d8ad4494e74d28d3ed404c84c6177c7e67e339af9f577361b0821ddb0606eca12418eebf78eb6d95a4bfba910b2f5538cae1678d4e048bc54259f8edeb1ccc07eb33ce70b85a4c4fca3181baed5f2faba053e6e45b37542bbb3397003c10bcb61182cb6ab97c39c7f2a4197b16568f3e9d1db95a03be9df211758a3440b576aa2f4c036558c71ebacf0d716e9a12792ce42a9081831ed3a7b6d0e254ee61e94b7fde3bf7ffb8d9da8477d6ae846e5400d3a0c5b293b5fd1a54a0b8b7a5980e7fe5d7bd46828f93b26408a36585e1e0f151a692b4fb883c64bcb6aa56fb4fc4d05d329ee2e7668c0c8a68c9706fa40f8ef9a84ded96d3035615eb5ae8a482e876317704bb681f9d6fe2c154a529c85653a20fa81e9d5daeb37f8aa8f8f4cd6c751aded2eafcffa6da624facb4c728336b7c2fbce1ad111a34b933b77c0763c2cc4406e4104a65399febdd219667b90597df5f9b4ea43536b309b4347ef1607d2a7f9e77184c08c34085fb2ae0baa2f4241bec55990769973d3b490c8ad966a2290e81f18675a18de949c118f5c94f0039639b0134655b5eecd59ef2c7fbef4c832f3ffc33b23de32377f00a0fd9e01d320fddde44e5454087aea030754b3f60d75c2b4dc28c2aec2c743b0808514a85266d8145a0fb287258e25893e065fd8921eabee2954d6895ab81efff29d4466c91f5b31ae5af90296914194964094977e7a962ece1ac82833a316cc3d408967f68e32d1290b2f7017e4daa240c83375cfa0e5a410b85ed8cae6b088e604576398e95a94f811e66141c9f7e8110568504b6c6a87bfacf8c3d1cee15af2698949753d287a15af342848707c72f80fa1539de4513f4828bdd0913f34648fa966deee51da94e066fbf7a83c293d620e7a744183cfaabde7464ff3bfce5ea17ba3eaf7d0a660f4f9af176d03332af04129546fb7d321bc98eb1ab291e5749d0172b9aece71624476b16599e670ef0461086963ec4db4887b12f1d433bb82b56cbda7e0df5057551712a2cfd920e6f48cdc7e4a47260e69e7809e3315663b73df2ef1a7d5c8b4075b421105c7c7444ed9bcd81ec7031ab1aae796aade0fac7ddc25d5a5b886f258097a9ace7eaea24797c17066530a063a51056b96576e10fb9fe6438bea0910f4c93c2523955155f79b00a5696c1349c26f7aa729e7568fee0b466040e5f049612cdc2d242f8390e53a9710ad8dad743097a90a267486c6c49495068dbedfd3291d03a90889eac3f3db7f2d2f9b3e0943b060699dcd37f589d492b02c047f9ec48ef8ea9b86fb461f18b7cfaf383ee8659a4c48162ad54c906cd183d264b1870cffeb574a4dd52d63b3094560a7b5e3e60502e56ef9981ffbae914baa22b2a645ff1585c588c483304cd7df37c8ff68beb030f1366bebaf42887de01484f73a55bf9d6f6b8d0493ba32d3f6249ad48bef2b39754884c86741ecdb8ff91ca4e86906fff01195e2160131d3324a676d631b1bb73c62112e2f275b4013d63f686515edd82afabbe1ad175a77796236d93365ca5396de429544f33b02c9c5c49ec1a3bc", 0x1000}, {&(0x7f00000001c0)="6b7ceccf83a3c5dad714bf642a5510d13afcc1d16fa28d9fdf5fd67f5f07c1ee0016c68ef80a64a67363f08c87f5cd90b811d0c74a3f1816", 0x38}], 0x2, &(0x7f00000003c0)=[{0xf0, 0x118, 0x0, "1d978c3e4abc51c9b87ce1edafa8612d0cd8b2549899c294b9929dcd5c31bf6f6724a3f9afcad07c967eb264d6c991f7963b3b9649e2fcaa219836fa2d7523d3cf7acc708d8c4e094593e766fed337ceafde29f3626ec79df46a96dbf06cddec97e8a5b4d241d94f015101a2942deb82c495fc1901a191d35bb974ccc94a553f7c46d02d637bf8d323cd179883bed8b3129abec37a2ebd871682f823bc04da8b5bfd4dd14c968b0c3f60f6558c454b1e4f2aeae18ea8db585ea687e31db0142091c8df4f6c8a521cef4818f9c9f458487d61c96dc8dec4238e80dd4359"}], 0xf0}}, {{&(0x7f0000001600)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @broadcast}, 0x0, 0x2, 0x3}}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000340)="ea76f93c0dc62846b90fbab94ce2eb42a4e9093f596262f1384d2d46f7cc16b373d9068142a540", 0x27}, {&(0x7f0000001680)="93d5447f47aa4c9978588dbfcfbf2650d74e1991fe8676ea8f40d9067eb6a2e606eec78f8eaeb7ddc8cab72747c2efb050496fb2b3be98239dd67e65569d724b297a78e31e0486ffccf3d86f7a5b9500612fec152d7901bd5ce85147e45a9e0f7c12037d73ab1ff4f201323bac39e4ef105338a391e905f79944f3b187603c6fb923b6da0cc81d24dd270ec8d0f9400d3c36b049556b7b64b2d25e1a2b9d27a3afebc4e588801b2735bdaf049f9aa6b748490efc8700afc559fb0b296cddef9dcc", 0xc1}, {&(0x7f0000001780)="220d5f8b5bf82502446e91b56d22eb76af19a609a70676f427f8062c3dd7cd4517c037bcb1f5fede35cad459ef198fcc42f20393e92006e85a6c56dec1903783540b800491175209f07f6f0e4cc30c5ea9594c7f2e2da289b1f59d43e7638c644d50502f66712e89afe0e3afbfb9425f285143707065981359073156d4f4421f7c843b2ea24f3a552fe89508866511c2c61bafa89702ee06e59e2e657a2e9f7aa17b824651444e501a1b284eeea60565eb3a48135e89dd23a78a267cd7b6070ae46a3907489be788de72e20105b53db87c9d9b78de51f3d7132638bc530d6314c54d3e9e31c96ae1d8", 0xe9}, {&(0x7f0000000500)="3d6dae3f13450731aa2de16c097a2501b5961b5b92130dee265050986eb8fb3ec8b70a7192fd65bd32e2dc43b2588e237d4d72570102369652c0", 0x3a}, {&(0x7f0000001880)="8040848e07449523dce4c63c8e39577115d3b602d5b3b7510d901cf1fb326c5d9502a68f45e8f04c0124e4e5a020bed1e028f3381fb6b4f47a95d70953d1f7ca025b6051c851f78b38c64a6b743756cf69ef9e680b9c2da1cd3a4cb0c9c8fb0591555f9dcbc059d2f05d41b0e4f57bab26aa28ddcbe4586d12b5270125c2bec60bee06b393bf9e01186512872b4acd06bd022f3cb5359414a31811de15b025e5963a77c64668bbc97c8ed6ddc6003d2651be0c7c7e995bbc029c676cb7c16e33a9269aec4023908dc60b9b8782104e3c7713ce4c41eb22eb323afa33dc698da5ee693554ed39ac44", 0xe8}, {&(0x7f0000001980)="331a01d8f8ab28b5627e91163aaf2243e540abad3cf266ca592e97c7c27c66e868b0da2bdd1023ef7053eccd163f041983eb93d8f117cc1bff10d13bb701d3ea18fc249e494d33cecf722f0afdab8d80dd0aa3652c63959616239665cd9a833ddd7f48f9efd12f98381f0e69b7c2f478406a526d20a4c2deb7f8d8de20a560246db7b122675b7016f0d44f146553f4ef5902eee5fb1b35f6ebea2a8db1b991e454a3ae73b363", 0xa6}], 0x6, &(0x7f0000001ac0)=[{0x100, 0x114, 0x35, "6cc1e97f145ee5581388777629092c17ed0e6b0866e53f04ab3026181c2f26bb5945728d405f776cab346a5abda60d610ea1c88bbac40c100c5cdfd5d22b6a64c5017452a7d75c3446988311001017cb6a41eb5bf71e177d9f53421aa3e04bdbac2d6a9f360eb4d5280094d918bed374afb9d7bc425c15011b97b2d292b32f2f4a615d1e92ff131d71ae4764589c52171981b21a6b644ec4eff93b68949357458cfb85dae4c1086369bf62b94e56beba8613e4887b98680430d5fddec0307a3055bda07db432469b88300679c2c382f45ac5b46baf2aecb1c2521f9f230fb86a02ff5cd8c59b168937d9"}, {0xb8, 0x10a, 0x0, "9e1e0747909a37269a78760ec4a19ebb368345b59cb340ba0b84649d88d5cd85adb62c20a5c4513f722e9a82768bda2b6138d59c455b141b93c856d0e4371056e5ad712c94ac592c1884b1fb67c1358729bcdd722294872aa2d8e96c9401b6aae6bc7a754524ae3436e6a7524330885417c19aa5547d1a4258c9310ae828ac03fbf310513d94b755474b67fa0e9bfafa4dd022209da21ac321ce2a42fd97a349417e"}, {0xd0, 0x1, 0x3, "4d6d6febc7b0fc586b23143d418d3e7ffaee7a17f11e712aa74eff0d668a492485df417b503e15ceed9986d80a9e419d20c5108c4acb714ab50c1c9951b3db4f0f59d585a6672bbf9cda4e443e6d5ceb38d2718be2c346a30a14e433dfec235bba2591ad086cb98b846e1a7f1f8a49a6a7fcc0ad24ee453a2ddc1d93272c28267c40cea663cd5b8d44127b0262d98a0b99665f2a40c68cc98c9f5d03018ee38bc6cf213be497670210e95007a0cbe801d1d1012d94180e243fa5493b"}], 0x288}}, {{&(0x7f0000001d80)=@qipcrtr={0x2a, 0x3}, 0x80, &(0x7f00000023c0)=[{&(0x7f0000001e00)="3d62fd9460ae39ee3956c546d57b9536727e858b4f5ab6ed637260bc85a7ef75fc54ad769bd727b4bf5ae02f7d7d78ecee8c33ef4372e94a209eb278e69bb58cc109c9f5fd38c96609de2e9cacae3db71d8c69ebad658eb125a5f39a2b3b2717cc3afff8de5d9c84d766403066a06b198b39cd8cff7de4a38c5de8e2f8fc707536a4cbf4d1c27441e9f52c1bb9d743e3d895b3e8e7beac554dea27af626cce32899ea7aa6e9eae0d457070e961824ddab099ba9f63477975df6a8ace6b3455df57aa2082eb30ab7dd0507f1edf64b19f121a448d0af53e24", 0xd8}, {&(0x7f0000001f00)="c4a31c191ec3c7b2f2f8dd72c059ecdff89d470feb8016daaca2708c38b0dacdaad7806055bf89ed4b2bfb022d8135ecb9524ffc0d07d8e5731f3bda9b270ef30ba1ea9628fec84e69c260b09c9bd49e", 0x50}, {&(0x7f0000001f80)="d408f9ad501437d05e50719ccd02c304a81bc5d7f9c8f1f91dcf069b13f89d94cfeb72685c0c25868de028a4838319c6f095804f9651145a6989a436f6302ee3916f6334340e94d858ea54f987ded380638de8b57cca23a3c72521bfab008784ad6272c061186240ad3bf2e64e983fcd1484711715add661d59d73be15cefe627a35bdd2c32c8ab019ff4b5a3e5e82e85a5878f237da6574d4c44051b43fda88cda79332fa30dcc1b552e5fc101bf82ea9f00c6e067c5f7c8021e80cfa5ad8884ff90be6226c178a8a7a2c12776467b8c72f75cabc81a9621db026f614fb", 0xde}, {&(0x7f0000002080)="8882e8b06a8bf9a166fbddc230cbce525fe792", 0x13}, {&(0x7f00000020c0)="7f651a61b3d87faaffed98b7e1531539e49b953303d7aeddb8e674d3e1af21e639fdf2687fc10ca80d40cd6b882d274571c4269b1a2911b5386d0d4e6ffdbdbb5f74c637edea59feaefc631306dbe6abca47ccfc04f27bd81e588ec410aad0e5bb8d17443529045b4b6c51191ca5bf3c0dede7c3d337919c3d106e6c3cb55e512ca7b7192083fa467d843211da02c3136512fb426758410a257a476fbccba18a2734f0658c8ba4feee01e692467f3758491760222934ad3c4bfd044c5e27ccf250039f481218c9f23b118185bf56ee3b0bd1cd0c0fbc5cc7a7", 0xd9}, {&(0x7f00000021c0)="b291910ac597d0ea9dfcd9e6b59378c9306920c822d7fd1bb0c4802fdcd46a33a26a9c9a377772b67afba2957d6d64792b1fee7318a42b71b2777c9cc31db05f69d34cf2aba4f58113fb74f6eca3668bae8e51917271aecc362a998d0862ff5659d35922489f465c87d47c60b24674e534e31df895fa9cd52af98c4494d7fa2b62709e475c66e2a09af85b5aac26523c1425e2a0430bfe", 0x97}, {&(0x7f0000002280)="ec090367322913e496b95adcf483d7ccd4266c2982d7c949dbe5de0ccf5c9da49dc037120581a82c161d7ceeb731399887249b94dd7ba4cb", 0x38}, {&(0x7f00000022c0)="1189eaed6a5e25617cea9c0e10a2da206f391fcd2abb31e9ae70c4ad77890da08cf68696aa579706c082989b6d2d5010a8458c21ddbabf42dc78ac5bdf1b4223c5e22b29fc7fc1410d0b6a010bce949ce7174ecff09e09fd84689d2ed3475e50895d6fc696f3d03e6d7ad280a87e6af4398c386b0d5005ecbd289782d5ead67d26d008f877632dbe1c1930482f37b3af2397a4e131b18ea091e4e807c35f52c4ae9b231fb89f4bb2112e06c9b2bc9d5eaf5c50aeaaa38c312c8edb7f77a982e3f19ae57849d6134120fa34eb360b1b9e36747e761ee1f949d0d2ba573a29087e8078", 0xe2}], 0x8, &(0x7f0000002440)=[{0x50, 0x103, 0x3, "59a543bd47f7a24cbc9a260b5c8ed7e16448eabc23b570a67d2958ee2674b01a08fa56bf13f2c5aa91b3960641cd4db0c807330d575ec6f94258"}, {0x28, 0x101, 0x9, "0990f0d41c38d15d9a5e8092630bebade463e7e0398a4c"}, {0x110, 0x10d, 0xfff, "6dc3279f51e9396418acfd0940837d2ce90701d0c6c5fac69862f0d26f8790882fe1bff33a296ee38a3cc1459cf5c8d4f8c0c555db2914dfb06e4e116e04d15d18c036e54a9a68f85a8bac3e486862618e630bc48752a35e96ca3665161fc14d1db8178b5926b726d5418a210ec82b4667aae28cf7aecc6a5527d873ade1ec40c2b7a7aca8c33cc77d8d4d03aba80fabea5c49272c8eb05d71a8c4dd00e329483354085facd5f27e9935f67b6eb6d33b3623b7c6897bfad6344747e985b57e0f1dccd0666d130915f42607af68f700fbc911c3dda9ead887a78dbd8b0ad92c853322c52fe4f655f1a7c285b444bba65127e721ba7989b17cfd81"}, {0x18, 0x104, 0x7, "f101d6774b"}, {0xc0, 0x3a, 0x9, "c3ad628c138488e61dd76a3eaf169777c57e3e4e08662458766819df278fef64578ea757bef433824e6779af8717d53971b0ba4556037651793a6a83939f26cca1e75569fd9541a2fb0e39076b5f12cba9f25a9901af2027a52bac13918c8a33ea0b02a5221b0ecec28c1b19303324d37a0ecd99a3e77cf8e06b24441affded1d8f4d7faef77a124f1e5dd599d4c7b41312ef0ed02211f43e8fcb98374fb45820f295f928fdd49914629195a60"}, {0x38, 0x10e, 0x5, "e12c61cf8b92503ec60551a31e25b42a9b852587d8fa4499e47e34e313e0052805cc37f25b3a"}, {0xa8, 0x1e, 0x101, "e0466cd760d9b61205adcd052c65b1f18046aac0110a9ec0850f7fb3057bb03cdc8cbbf375363137f16eb2243f8a0604bdbfcb6f7ff90ab343c8c1c2f2ed28ea21001e2f32cb6190c1a1216fe8ad2488cd17a0c0300865f156c6c51e8b20ba81aa934be37e8b65f17360e3926eed2031639ff2962dbc3542734b7d6d137ae62f5edd546ab755f011f1f879aea422ad4a1136"}, {0x1010, 0x117, 0xfffffff8, "5ccf547a24df6d5a473ee7015840c984d24f83cc58845907bd07a02d13d0dc35e18667d1676b9f0e5460c10a50f0aa41126b7ba492998f0d4e104e4af8ea6ec88d6b9cb2012d462d3533c2568ec1110ce4418588ca0506b0613b8f8e210d468cf7e994c541c875f9cf769416c58897a812de95da272ff18cdfe9d3ded6133a18367ba51887f512b7120568d249ed299edd0258c99917c5cda1bb655ab69e971b957baec742740f2b264a329b65833a4ca469256b3c3d43759f53e504d8a71370bf256fdcce15b99946fcc1db048a738018333e0990b0224ebd3a7c88ea2661d0bdf58756bc165ab00ce3c432d8a30c156b39db63e02bbce467dc07e62b692a69e979b0c062afc7d068d12183a6d8ab71db5a65961d1feda761b39dfacc0132241ed4fea3f4feb0061b4e932a60fddcdfdb03a1769f29f8bb278593e6decafe77dbb553f79c7205b352680f2d1cd1de46c37de23dd7f3122387d27f3e98c0f001f9e662a5ccb201bf33d537d4113037a61f87c6de5688f18e5430e4f8c858ce98ce8f97bcbb5491c117723a11a5db64dd365b30d0b30c1a99900c4a02b7c7210cb2bd0880cf654fb828dbd412f46ea3011625c7fbcd85704b881858f4aa929a42ad364a6bd7139e1d2bb15992d2ddd47922b1a5b5868e27c3380681d15ab78fef315510cac484255980f52cea3b0f66ebd7c1b347212b9653bac0278df39a96f93e555adc820f5d8745f79da9089a52d78d7146c76123e0d0355927e849c463cb2b5d04f8e2019e780c5226fedd5e6f204450379e958a2c6c3b5dc2dfa8ce1156c50a617ecb09e14dab39768b608c6e212426c7898402574235b04245f138443b1617f7061d454d5a626fd4d77e6144c2507cb3bb2a26babfc6d3024aa5ed66182c87582d49f69646ef153a34e87299e004493429554a62dfd166bc33fb14a4f148d30e31fdf93a4fcd5363d9c3c8d4054d3746d286d515b0f3b76af6203bfb9beaabeb08c3427f40c21c2e1d7d423bac204310719bc9a07e06ff902fa60cf50af4c8c92cab994639c8a0d8cabe84566cf2891fa9e28a52c714e54fe289d22bfb678589f6bb3156bc9eed5c8c102de63a6364c1971ac585fddb2afc75511b0b12fcfd4e14dd1abc26ccf7342b72bd457cff6a6795a8054f5cb389db11243e2f2c15cca6f4b4f03b395000909a82b4e47c8fa16e42a988ed482ab31fa2f58af6589ad5e72a394cd3c0145733e91d9da920967bae15260aecaf0eff69a0d9b18562964f20a8badb2cd50e59fe634781cc411bcdfdf85741b1becc82fc18ffe7e975965741d09c5afeb448e093d904da5a676e2b10e525101dc1224c92fb99b3cacdecb0dd1385889549862b8c7b2757e11a22b0894290b5d1d370a614f7764bdb0a3cb8ffccc62c8ab8f04110350b0aea2c6624987d38c533d74613a28f92df90082afa0aee0f31437aa2e9f844502cd441212e81577b2b7cdfd5f7e1061fab709471adcf98aab8e2b0ae34bdce5325942ec3a1b3d4a305def52c4dc88fe302ac76d10f342c19ce5ecf52df7417218b2a06eec913c8204a43f6f9788d833519ae22d2ea7df0520710333fc75c283c486284c9e19d494d191c091a3c3f7dad8169d57d9a739117c583f90234fe46ff48d1cab2ceedb533e6476733d038a73158d8924c7c4cc902388e5df7430e5da56e090e9c5de0c5d3f49d34648b2685114816707e66312e2a726a7f31f624105dde751b4aa06c07393f475b1d887531688d6f0ea17bded33827fbc0e9aadafd690f2cdf5370e15417280c5c1ead740c4aaffc3300745696767315002ba9ec665866e4de4071cc91c425e237320cdf187f4bc8beec0c37449afb6b3efc04145f485a5790d8811f6b624b37e9af3f6363db483089f68dcd5e6ee93fa795051886133a6e9e00f0b917b66c9573b5a2c2fdea4c87928c78bfcffa7606e2e356059eb11c531186938298b5d704eb5d3b3dae43485a5e8117f67b64093fe8004f68b13af3fd683fe4301c9666223782dd4623852f75e79759c2a1a56e1f9867c46abb5b15d56834babef551f080b81017e503e79cc6a3e383871911a7b4b18b98744422bb68acec2d7c57381722797f9a97fec1e3400c6a6a4826e2651555b41cecbdb235ce8bdc9f743514eae6c743e6c3dae45285c23694407eaf15dc543db18678e7a4166b5e10597ba79435384dbda586192234d18f1d855119596e6862bf8706706166eb6f764fc8f96bcfdbe510fb8aaa24659449d74ee598ed03272bc0756e6ec57596ad8f0a0624a1c185ba3894ab66a44299990bdfc848fae6385cade7132abe8da9c00dcf3afa7656dbd9c55c244922b0c4be562c2d519888b31f1a0a90d3d8761d0035ec998042ff6c35c9de4cb3e76ace78741049ebf5367416f6f567aeb03564b0ab22e2ebe9641910f548a0d50a38a752b2aa11fc6123c0806d3f224c4a20908581cdd4332db0cfedca1522c68b90e64660be931dbc1024ad7de1974693adf3da57207b0d2acd4925edc31e158bc81b072869766da347de0b51436848ed61211f175a14724c4a41e0633797c0fd1595d2903f84ee1213662f72cd03648f3d7f71fb25be9160b48cf1d7f0f094e07008674d4987eff52cb886c00e649ad703b8042a2c660da44921d49fcdbf1d6af9750a0425817a3aa2ec2fa79eec124b83820b659ca3ee2a3119453cc5675ff27d7ab5f852693666b552dfee24a57fa1b38946ddc18e78888238f2837ee5d903616caace945b83c0ea95714e50f28622856abf328bc7b68168eb17d8f3dfb33642c2dc6f7a1c59f2cc486f1593fabc281bbe3bd54a60e8004d81fcbe1b836aa6a9a2a77bfc31de7216b11e557c5015c4f4d0ca777d55fa3ff39202f4a066c6bc7a454d9cf9c6ea2dc3350d90a91f34ebf3fcd5c61dba67ee5c57f5f0552a040e9145a5a7316cbb27fed5d954a8595229a901c24fe8779b118b9200c6708fe6a49ba8e9ba220824a7b669a8dd94a325636b4ca8db825e72d6bd6f9e499af3b720993a4d45a8dc7ceaf986d35b17b46334d658866480cc15af72efa9d52db80f461c12a090b7b5fd5c9293d8cd4336c8c5deecf005c04bd405429b63da79cfcae435fc6195c35a7b7bafadf867f2ecab4f990ffbb5d5b8fd4445a4cd05f9b697c8bc1e759efad4c19cb9c499feec1e9e41df03d0abaa7593afcea50dcc3add1c6dedda1567029bf970b46c9c064fef5be1c4a9d794147d74ddde4c7afda130377f926d44dbc1684a31b40a88f75b4e17fc202af06f7fe5b04e47d42a55317e296c9345ae80d81a1c8aaeddc53512a175259e16c6727b649a6cf6eca0ef776fe5e30ff06281e30534ab35390fe15eb722939876000a353032f2f0db576bfbaa2eee7e73741152f002b9b4c8c0e1b2e2e01841b951a85a1b28c62bd9e90af2d8b279c9a9e8c5e86fde2916a16177d891474cc58e0dc54f4916b1e9846ac9bdd71639ce4539398caf4100bec85b713f13a6cd9d3a278dfbd0fec49c844cc6270f56a4c5a413213650f39f30754c6cf20b021a4bc7841241e9fef2b6ff015e654b111bbb95fb2214e0dc4802ad933172ba7fcff633b8d7f67a237ca8a6ef1aeb29f3bc4d6f786cef973d5e72509acbf02853bdea529fd0a377eab21dcbe37cd70f8459befc9a6a8cd8d77c96b7eabe4feda7452bce1bf8e1c01b690cab9be0b87d481ec74692c3a45ad7b01d15411c3f8d33dab3da67dfd7de44283e372daf4824739cd8e613f9d01f5df627fd6c018b2f9521ea543a91ccb9de5e10aab8150cb7f1725ee66083141542279b052e926445015b7b8cf8d03d84806abb1768d206be36e3f5af4830cd74f0cc1b9161ff6ce33a81857621bc98fe86fe705c12f564f6344007eb80cf6a77baf84b6fdf647a8b442dfc4b0894ee4b00658fda4b792401521f2cec583cc73e4691868fcc44952e10ef07ab9abb6ee9e61ee365880c013c9eb4cc57c87b3172f5d329a10ee20697788dcc49244d25ecdc82034055948287f10fdb60f09aa46414a477b6cacf9b7550635d8fa844e01f88a521a483249c6b5b941f40351d93da31cfd6a8b1ebcf135e0cc79fdaa6401837b6fc9812e34d770cc647f8b52848210ff932c72e88fe5f2093c7c95692de806ea5ca51529d80b49b296799d412abe9448d3cd6dfcbb781dd8f892459dce7af8139133bf5a6014928114cdd0ddbd57230b5a3cbf9c7892952cf5af5b97e600066e0a873fd5da99ad1b9f5f98773ac9ab83ac6303ec5d8450f75f95993daea933de6d23579d23d2c040dd6e511f103cd741607f151230b6c4e17ad3ab2a786def02f15f158891cab67de3440e5266bafeaa4e73fd7c820a70a3ceff3e5c34c2f379257766735f15d3c3d31df6b5a9d188c0df84fac489f84a23dd760723283a357caa379152f1aac900bf859b2bc25bc688a53b4d5f6de1b3b51c8d8172c97b757d975c6c39d14c3d0ac7b3f0bca3e7d77aa069763020ca034f718e6c8599f32d42dc41544059883b9df906134e26bb6fd055cb410a28b27f9c6f78292b5d2c6525139d8b69748ff9fa4d61be7fd36bf609f4e555834333424dcebb3bde5b91a9a6fedd07b41ebfcc62bb56dee8a9dbef68dde1574888c3fbbbc0d2f8b532d8bf9c9e47f464a7dc9b86d5c59dca8ef2dbad9eb00c7dd173f887f99ceb54e768337302d70c358e2415043c7f66b7f1b76aa0cc077f0c56d572dec5555fd7e25f1ad5a00f9353bbe54e711276fc24f3b0628820137dbe2c0368a38893a7359a69d7d1be743c9d14af1a4ce292f9d3a71c935de5a6fbeaa5e2b9b97b7921420a60bdb4cefdcc1d7327dcf07a99054489e8d8a807b83a8ca348d509cf5a08d30b71a007beb5c2be58afdaf105708816dbeb3d64ce38fe5df7be8e6176e38a61401f35b1ea9dfd9ac0de6bc19072d9f2690039629faeac386aba60b6744b0c228166e765c376139a5ac40fa6bd4a1dc0506c913cc361c5979a10c908df50c00cd0b0c63c0df30b2f43d28692355e141373c7219359fc34afecc5a594292b636c4577166cd15e0a7c9274050d45da7aa8bc0a639dafb26374c813511aa398074cb808257537fbed49a5f3e1022e6dcc9a918dd2c748b3fbf0d81cecae16bba49ade278ecfab77b0a180fc443611d9a2b76261ab4850d3967d43e98095109dbd7231861f84bcfb3f9da56c60acfd89db980d091afc28bc6a4e17e3cb9bffa8f54a078d51fe2f7e2b99a2770cb817c60fa2b484327f8ca98a4cb6a2c3a8770c93b0411157e79c5f9beff8b0bf4df7020f5cbd16a7dafd37fd5b8c7493884f21e5937dde7dd0befbd88d8497b5387a74f7b00a58e197cf49b644545e03713529dfa7b37dbf6d8e27a22f1fc5beb21ef29ee6b840811c075f0d33e1c37ef60a5e79714fe8fc3520e555b93fd6cff2f5d7ab46c84b811b5236d15dafd4b1c3b881a8c64a55b1526ab766823494861c718280a128a770f3568f44761da1bfa1d527130f63512a610f3d28a3cd73a3c263b486339da9d51d8fb7e5921589744dc30d3e9a1fa5d4be2f6d19149168edcd048745bf29ac36eb9c2bf78663184b25f25d51bdf717eebb0bbc0026336664ee12ebddf8fa7a058211ad3c579d0b2a954bbf0b9a0c9c65f0f3c946aeebc0efb64b70e03accd46f4d8e983a41d2a26a3ab7285419cd7acb66d8c945608359750e2154666f8c46868588f9887bc65991848273480321ba50904d91f81ee42f5f08e1bd30ab82f0d27da67c75a9dd9e3725a5a953ef05ee026ba9f4e9ce124d850f68e45"}], 0x1350}}], 0x3, 0x1) (async) sendfile(r3, r0, 0x0, 0x100000004) socket(0x1a, 0x4, 0xffffffce) [ 508.120494][T16902] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. 03:53:53 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7", 0x9}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x600}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:54 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) (fail_nth: 1) 03:53:54 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7", 0x9}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 508.694082][T16925] FAULT_INJECTION: forcing a failure. [ 508.694082][T16925] name failslab, interval 1, probability 0, space 0, times 0 [ 508.745475][T16925] CPU: 1 PID: 16925 Comm: syz-executor.2 Not tainted 5.16.0-rc5-syzkaller #0 [ 508.754282][T16925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 508.764357][T16925] Call Trace: [ 508.767649][T16925] [ 508.770591][T16925] dump_stack_lvl+0xcd/0x134 [ 508.775207][T16925] should_fail.cold+0x5/0xa [ 508.779737][T16925] ? iovec_from_user+0x338/0x3d0 [ 508.784706][T16925] should_failslab+0x5/0x10 [ 508.789230][T16925] __kmalloc+0x72/0x340 [ 508.793412][T16925] iovec_from_user+0x338/0x3d0 [ 508.798207][T16925] __import_iovec+0x65/0x5c0 [ 508.802903][T16925] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 508.808910][T16925] import_iovec+0x10c/0x150 [ 508.813441][T16925] vfs_writev+0xc1/0x630 [ 508.817788][T16925] ? vfs_iter_write+0xa0/0xa0 [ 508.822478][T16925] ? __fget_files+0x26a/0x470 [ 508.827174][T16925] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 508.833263][T16925] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 508.839275][T16925] ? __fget_files+0x28c/0x470 [ 508.843984][T16925] ? __fget_light+0xea/0x280 [ 508.848678][T16925] do_writev+0x139/0x300 [ 508.852946][T16925] ? vfs_writev+0x630/0x630 [ 508.857469][T16925] ? syscall_enter_from_user_mode+0x21/0x70 [ 508.863383][T16925] do_syscall_64+0x35/0xb0 [ 508.867812][T16925] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 508.873738][T16925] RIP: 0033:0x7ff61cfdfe99 [ 508.878168][T16925] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 508.897786][T16925] RSP: 002b:00007ff61b955168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 508.906222][T16925] RAX: ffffffffffffffda RBX: 00007ff61d0f2f60 RCX: 00007ff61cfdfe99 [ 508.914210][T16925] RDX: 0000000000000056 RSI: 0000000020001300 RDI: 0000000000000003 [ 508.922204][T16925] RBP: 00007ff61b9551d0 R08: 0000000000000000 R09: 0000000000000000 [ 508.930205][T16925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 508.938191][T16925] R13: 00007fffd42a691f R14: 00007ff61b955300 R15: 0000000000022000 03:53:54 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340)={'syz1', "5b0f566446afcb7dbd0df3a56e2abb104b8276b64b94a89ab4cbb3b333f487f0c09eb34d4887ea4ee709dd847690a94d36019b4845a4c3005fc307606c2b6871e609c0ee7d33a7005f9fd6816898fea7ff1c59b54ea05aae433f1ca8962557554bf968520ba847221d84aa8e7b39900c5998b0e7daf6bdce551fa07089f71d07b09119c429937744ace0a1a369988f317e011acf6ae42d87525c71"}, 0x9f) socket$packet(0x11, 0x2, 0x300) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000300)=0x14) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'vlan0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000280)="0872fc7276042fcef0ad0aff8100", 0xe, 0x0, &(0x7f0000000180)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @broadcast}, 0x14) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000070600ff070000000800000000000000"], 0x14}}, 0x0) splice(r3, &(0x7f0000000180)=0xd85, r2, &(0x7f00000001c0)=0x18000, 0x9, 0x11348420b87a711b) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r0, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340)={'syz1', "5b0f566446afcb7dbd0df3a56e2abb104b8276b64b94a89ab4cbb3b333f487f0c09eb34d4887ea4ee709dd847690a94d36019b4845a4c3005fc307606c2b6871e609c0ee7d33a7005f9fd6816898fea7ff1c59b54ea05aae433f1ca8962557554bf968520ba847221d84aa8e7b39900c5998b0e7daf6bdce551fa07089f71d07b09119c429937744ace0a1a369988f317e011acf6ae42d87525c71"}, 0x9f) (async) socket$packet(0x11, 0x2, 0x300) (async) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000300)=0x14) (async) socket$packet(0x11, 0x3, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'vlan0\x00'}) (async) sendto$packet(r5, &(0x7f0000000280)="0872fc7276042fcef0ad0aff8100", 0xe, 0x0, &(0x7f0000000180)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @broadcast}, 0x14) (async) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000070600ff070000000800000000000000"], 0x14}}, 0x0) (async) splice(r3, &(0x7f0000000180)=0xd85, r2, &(0x7f00000001c0)=0x18000, 0x9, 0x11348420b87a711b) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r3, r1, 0x0, 0x100000004) (async) [ 508.946192][T16925] 03:53:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x700}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:54 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8be", 0xe}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:54 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) (fail_nth: 1) 03:53:54 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) (fail_nth: 2) [ 509.145282][T16940] FAULT_INJECTION: forcing a failure. [ 509.145282][T16940] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 509.171421][T16940] CPU: 0 PID: 16940 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 [ 509.180229][T16940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 509.190735][T16940] Call Trace: [ 509.194028][T16940] [ 509.196973][T16940] dump_stack_lvl+0xcd/0x134 [ 509.201601][T16940] should_fail.cold+0x5/0xa [ 509.206133][T16940] _copy_from_user+0x2c/0x180 [ 509.210831][T16940] do_ipv6_setsockopt.constprop.0+0x460/0x44c0 [ 509.217162][T16940] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 509.223439][T16940] ? ipv6_update_options+0x3e0/0x3e0 [ 509.228753][T16940] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 509.234775][T16940] ? lock_chain_count+0x20/0x20 [ 509.239653][T16940] ? find_held_lock+0x2d/0x110 [ 509.244444][T16940] ? aa_sk_perm+0x30f/0xaa0 [ 509.249011][T16940] ? __fget_files+0x28c/0x470 [ 509.253689][T16940] ? ipv6_setsockopt+0xb7/0x180 [ 509.258555][T16940] ipv6_setsockopt+0xd6/0x180 [ 509.263247][T16940] udpv6_setsockopt+0x76/0xc0 [ 509.267935][T16940] ? __sys_setsockopt+0x24d/0x610 [ 509.272970][T16940] __sys_setsockopt+0x2db/0x610 [ 509.277830][T16940] ? sock_common_recvmsg+0x1a0/0x1a0 [ 509.283121][T16940] ? __ia32_sys_recv+0x100/0x100 [ 509.288070][T16940] ? lock_downgrade+0x6e0/0x6e0 [ 509.292925][T16940] ? lock_downgrade+0x6e0/0x6e0 [ 509.297791][T16940] __x64_sys_setsockopt+0xba/0x150 [ 509.302927][T16940] ? syscall_enter_from_user_mode+0x21/0x70 [ 509.308849][T16940] do_syscall_64+0x35/0xb0 [ 509.313276][T16940] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 509.319178][T16940] RIP: 0033:0x7f4aa0c47e99 [ 509.323593][T16940] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 509.343205][T16940] RSP: 002b:00007f4a9f5bd168 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 509.351618][T16940] RAX: ffffffffffffffda RBX: 00007f4aa0d5af60 RCX: 00007f4aa0c47e99 [ 509.359622][T16940] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 509.367583][T16940] RBP: 00007f4a9f5bd1d0 R08: 0000000000000678 R09: 0000000000000000 [ 509.375549][T16940] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001 [ 509.383526][T16940] R13: 00007ffea070cfdf R14: 00007f4a9f5bd300 R15: 0000000000022000 [ 509.391503][T16940] [ 509.396307][T16948] FAULT_INJECTION: forcing a failure. [ 509.396307][T16948] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 509.450787][T16948] CPU: 1 PID: 16948 Comm: syz-executor.2 Not tainted 5.16.0-rc5-syzkaller #0 [ 509.459599][T16948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 509.469666][T16948] Call Trace: [ 509.472955][T16948] [ 509.475892][T16948] dump_stack_lvl+0xcd/0x134 [ 509.480504][T16948] should_fail.cold+0x5/0xa [ 509.485026][T16948] _copy_from_user+0x2c/0x180 [ 509.489724][T16948] iovec_from_user+0x246/0x3d0 [ 509.494519][T16948] __import_iovec+0x65/0x5c0 [ 509.499131][T16948] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 509.505141][T16948] import_iovec+0x10c/0x150 [ 509.509659][T16948] vfs_writev+0xc1/0x630 [ 509.513908][T16948] ? vfs_iter_write+0xa0/0xa0 [ 509.518593][T16948] ? __fget_files+0x26a/0x470 [ 509.523419][T16948] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 509.529405][T16948] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 509.535400][T16948] ? __fget_files+0x28c/0x470 [ 509.540081][T16948] ? __fget_light+0xea/0x280 [ 509.544668][T16948] do_writev+0x139/0x300 [ 509.548908][T16948] ? vfs_writev+0x630/0x630 [ 509.553410][T16948] ? syscall_enter_from_user_mode+0x21/0x70 [ 509.559308][T16948] do_syscall_64+0x35/0xb0 [ 509.563723][T16948] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 509.569619][T16948] RIP: 0033:0x7ff61cfdfe99 [ 509.574031][T16948] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 03:53:55 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0xb00000000065808, 0x0) getsockname$ax25(r1, &(0x7f0000000240)={{0x3, @null}, [@default, @netrom, @netrom, @null, @netrom, @default, @null, @netrom]}, &(0x7f00000001c0)=0x48) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r3, 0x111, 0x2, 0x0, 0x4) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="02fffffe070600000000dbd9f077ec5a58aa51ff"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xe6e10ecc6a2d6bc}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4001) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000004) [ 509.593634][T16948] RSP: 002b:00007ff61b934168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 509.602046][T16948] RAX: ffffffffffffffda RBX: 00007ff61d0f3030 RCX: 00007ff61cfdfe99 [ 509.610008][T16948] RDX: 0000000000000056 RSI: 0000000020001300 RDI: 0000000000000003 [ 509.617974][T16948] RBP: 00007ff61b9341d0 R08: 0000000000000000 R09: 0000000000000000 [ 509.625936][T16948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 509.633898][T16948] R13: 00007fffd42a691f R14: 00007ff61b934300 R15: 0000000000022000 [ 509.641877][T16948] 03:53:55 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) (fail_nth: 2) 03:53:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x900}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:55 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8be", 0xe}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:55 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x100400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:55 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0xb00000000065808, 0x0) getsockname$ax25(r1, &(0x7f0000000240)={{0x3, @null}, [@default, @netrom, @netrom, @null, @netrom, @default, @null, @netrom]}, &(0x7f00000001c0)=0x48) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r3, 0x111, 0x2, 0x0, 0x4) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="02fffffe070600000000dbd9f077ec5a58aa51ff"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xe6e10ecc6a2d6bc}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4001) (async) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000004) [ 509.782106][T16964] FAULT_INJECTION: forcing a failure. [ 509.782106][T16964] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 509.817713][T16964] CPU: 1 PID: 16964 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 [ 509.826528][T16964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 509.837039][T16964] Call Trace: [ 509.840326][T16964] [ 509.843267][T16964] dump_stack_lvl+0xcd/0x134 [ 509.847882][T16964] should_fail.cold+0x5/0xa [ 509.852409][T16964] _copy_from_user+0x2c/0x180 [ 509.857103][T16964] do_ip6t_set_ctl+0x854/0xb90 [ 509.861957][T16964] ? __mutex_lock+0x21a/0x12f0 [ 509.866742][T16964] ? compat_do_replace.constprop.0+0x470/0x470 [ 509.872924][T16964] ? wait_for_completion_io+0x270/0x270 [ 509.878504][T16964] ? nf_sockopt_find.constprop.0+0x22d/0x2a0 [ 509.884572][T16964] nf_setsockopt+0x83/0xe0 [ 509.889013][T16964] ipv6_setsockopt+0x122/0x180 [ 509.893804][T16964] udpv6_setsockopt+0x76/0xc0 [ 509.898513][T16964] ? __sys_setsockopt+0x24d/0x610 [ 509.903571][T16964] __sys_setsockopt+0x2db/0x610 [ 509.908442][T16964] ? sock_common_recvmsg+0x1a0/0x1a0 [ 509.913747][T16964] ? __ia32_sys_recv+0x100/0x100 [ 509.918708][T16964] ? lock_downgrade+0x6e0/0x6e0 [ 509.923585][T16964] ? lock_downgrade+0x6e0/0x6e0 03:53:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0xe00}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 509.928476][T16964] __x64_sys_setsockopt+0xba/0x150 [ 509.933607][T16964] ? syscall_enter_from_user_mode+0x21/0x70 [ 509.939539][T16964] do_syscall_64+0x35/0xb0 [ 509.943980][T16964] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 509.949900][T16964] RIP: 0033:0x7f4aa0c47e99 [ 509.954328][T16964] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 509.973950][T16964] RSP: 002b:00007f4a9f5bd168 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 509.982378][T16964] RAX: ffffffffffffffda RBX: 00007f4aa0d5af60 RCX: 00007f4aa0c47e99 [ 509.990363][T16964] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 509.998519][T16964] RBP: 00007f4a9f5bd1d0 R08: 0000000000000678 R09: 0000000000000000 [ 510.006521][T16964] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.014540][T16964] R13: 00007ffea070cfdf R14: 00007f4a9f5bd300 R15: 0000000000022000 [ 510.022550][T16964] 03:53:55 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0xb00000000065808, 0x0) getsockname$ax25(r1, &(0x7f0000000240)={{0x3, @null}, [@default, @netrom, @netrom, @null, @netrom, @default, @null, @netrom]}, &(0x7f00000001c0)=0x48) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async, rerun: 64) r3 = socket(0x10, 0x803, 0x0) (rerun: 64) sendmsg$IPSET_CMD_LIST(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r3, 0x111, 0x2, 0x0, 0x4) (async) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="02fffffe070600000000dbd9f077ec5a58aa51ff"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async, rerun: 32) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xe6e10ecc6a2d6bc}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4001) (async, rerun: 32) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000004) 03:53:55 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8be", 0xe}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0xf00}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:55 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:53:55 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) (fail_nth: 3) 03:53:55 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0xae) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x25, 0xa, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}}}, 0x24}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xfae4d525e604348a}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)={0xd8, 0x0, 0xc04, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008041) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000000706000000000000000000000000000008000640000080010900020073797a3300000000"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r1, r0, 0x0, 0x100000004) [ 510.275514][T16999] FAULT_INJECTION: forcing a failure. [ 510.275514][T16999] name failslab, interval 1, probability 0, space 0, times 0 [ 510.323699][T16999] CPU: 1 PID: 16999 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 [ 510.332514][T16999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 510.342580][T16999] Call Trace: [ 510.345871][T16999] [ 510.348810][T16999] dump_stack_lvl+0xcd/0x134 [ 510.353422][T16999] should_fail.cold+0x5/0xa [ 510.357947][T16999] ? kvmalloc_node+0x61/0x120 [ 510.362702][T16999] should_failslab+0x5/0x10 [ 510.367224][T16999] __kmalloc_node+0x75/0x390 [ 510.371846][T16999] kvmalloc_node+0x61/0x120 [ 510.376369][T16999] xt_alloc_table_info+0x3c/0xa0 [ 510.381434][T16999] do_ip6t_set_ctl+0x500/0xb90 [ 510.386221][T16999] ? __mutex_lock+0x21a/0x12f0 [ 510.390999][T16999] ? compat_do_replace.constprop.0+0x470/0x470 [ 510.397178][T16999] ? wait_for_completion_io+0x270/0x270 [ 510.402756][T16999] ? nf_sockopt_find.constprop.0+0x22d/0x2a0 [ 510.408759][T16999] nf_setsockopt+0x83/0xe0 [ 510.413196][T16999] ipv6_setsockopt+0x122/0x180 [ 510.417990][T16999] udpv6_setsockopt+0x76/0xc0 [ 510.422685][T16999] ? __sys_setsockopt+0x24d/0x610 [ 510.427714][T16999] __sys_setsockopt+0x2db/0x610 [ 510.432569][T16999] ? sock_common_recvmsg+0x1a0/0x1a0 [ 510.437857][T16999] ? __ia32_sys_recv+0x100/0x100 [ 510.442793][T16999] ? lock_downgrade+0x6e0/0x6e0 [ 510.447646][T16999] ? lock_downgrade+0x6e0/0x6e0 [ 510.452515][T16999] __x64_sys_setsockopt+0xba/0x150 [ 510.457630][T16999] ? syscall_enter_from_user_mode+0x21/0x70 [ 510.463525][T16999] do_syscall_64+0x35/0xb0 [ 510.467940][T16999] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 510.473845][T16999] RIP: 0033:0x7f4aa0c47e99 [ 510.478260][T16999] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 510.497863][T16999] RSP: 002b:00007f4a9f5bd168 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 510.506274][T16999] RAX: ffffffffffffffda RBX: 00007f4aa0d5af60 RCX: 00007f4aa0c47e99 [ 510.514246][T16999] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 03:53:56 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d", 0x10}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 510.522212][T16999] RBP: 00007f4a9f5bd1d0 R08: 0000000000000678 R09: 0000000000000000 [ 510.530178][T16999] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.538141][T16999] R13: 00007ffea070cfdf R14: 00007f4a9f5bd300 R15: 0000000000022000 [ 510.546127][T16999] 03:53:56 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="562da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:53:56 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) (fail_nth: 4) [ 510.590715][T17003] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 510.715857][T17011] FAULT_INJECTION: forcing a failure. [ 510.715857][T17011] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 510.747845][T17011] CPU: 0 PID: 17011 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 [ 510.756645][T17011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 510.766718][T17011] Call Trace: [ 510.770002][T17011] [ 510.772939][T17011] dump_stack_lvl+0xcd/0x134 [ 510.777552][T17011] should_fail.cold+0x5/0xa [ 510.782069][T17011] _copy_from_user+0x2c/0x180 [ 510.786773][T17011] do_ip6t_set_ctl+0x8c3/0xb90 [ 510.791558][T17011] ? __mutex_lock+0x21a/0x12f0 [ 510.796342][T17011] ? compat_do_replace.constprop.0+0x470/0x470 [ 510.802519][T17011] ? wait_for_completion_io+0x270/0x270 [ 510.808090][T17011] ? nf_sockopt_find.constprop.0+0x22d/0x2a0 [ 510.814074][T17011] nf_setsockopt+0x83/0xe0 [ 510.818490][T17011] ipv6_setsockopt+0x122/0x180 [ 510.823262][T17011] udpv6_setsockopt+0x76/0xc0 [ 510.827945][T17011] ? __sys_setsockopt+0x24d/0x610 [ 510.832977][T17011] __sys_setsockopt+0x2db/0x610 [ 510.837828][T17011] ? sock_common_recvmsg+0x1a0/0x1a0 [ 510.843113][T17011] ? __ia32_sys_recv+0x100/0x100 [ 510.848056][T17011] ? lock_downgrade+0x6e0/0x6e0 [ 510.852903][T17011] ? lock_downgrade+0x6e0/0x6e0 [ 510.857767][T17011] __x64_sys_setsockopt+0xba/0x150 [ 510.862974][T17011] ? syscall_enter_from_user_mode+0x21/0x70 [ 510.868870][T17011] do_syscall_64+0x35/0xb0 [ 510.873286][T17011] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 510.879182][T17011] RIP: 0033:0x7f4aa0c47e99 [ 510.883595][T17011] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 510.903197][T17011] RSP: 002b:00007f4a9f5bd168 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 03:53:56 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async, rerun: 32) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async, rerun: 32) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async, rerun: 64) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x100400) (async, rerun: 64) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:53:56 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x3f00}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 510.911614][T17011] RAX: ffffffffffffffda RBX: 00007f4aa0d5af60 RCX: 00007f4aa0c47e99 [ 510.919705][T17011] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 510.927671][T17011] RBP: 00007f4a9f5bd1d0 R08: 0000000000000678 R09: 0000000000000000 [ 510.935635][T17011] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.943598][T17011] R13: 00007ffea070cfdf R14: 00007f4a9f5bd300 R15: 0000000000022000 [ 510.951576][T17011] 03:53:56 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0xae) r2 = socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket(0x25, 0xa, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}}}, 0x24}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xfae4d525e604348a}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)={0xd8, 0x0, 0xc04, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008041) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000000706000000000000000000000000000008000640000080010900020073797a3300000000"], 0x28}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r1, r0, 0x0, 0x100000004) 03:53:56 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c56a2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:53:56 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) (fail_nth: 5) 03:53:56 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0xae) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x25, 0xa, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}}}, 0x24}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xfae4d525e604348a}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)={0xd8, 0x0, 0xc04, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008041) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000000706000000000000000000000000000008000640000080010900020073797a3300000000"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r1, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0xae) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x25, 0xa, 0x0) (async) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}}}, 0x24}}, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) (async) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xfae4d525e604348a}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)={0xd8, 0x0, 0xc04, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008041) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000000706000000000000000000000000000008000640000080010900020073797a3300000000"], 0x28}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r1, r0, 0x0, 0x100000004) (async) [ 511.199066][T17034] FAULT_INJECTION: forcing a failure. [ 511.199066][T17034] name failslab, interval 1, probability 0, space 0, times 0 [ 511.244689][T17034] CPU: 0 PID: 17034 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 [ 511.253498][T17034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 511.263566][T17034] Call Trace: [ 511.266853][T17034] [ 511.269794][T17034] dump_stack_lvl+0xcd/0x134 [ 511.274410][T17034] should_fail.cold+0x5/0xa [ 511.276699][T17036] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 511.278933][T17034] ? kvmalloc_node+0x61/0x120 [ 511.278967][T17034] should_failslab+0x5/0x10 [ 511.297405][T17034] __kmalloc_node+0x75/0x390 [ 511.302029][T17034] kvmalloc_node+0x61/0x120 [ 511.306568][T17034] xt_alloc_entry_offsets+0x3b/0x50 [ 511.311787][T17034] translate_table+0x234/0x1750 [ 511.316660][T17034] ? __might_fault+0xd1/0x170 [ 511.321350][T17034] ? lock_downgrade+0x6e0/0x6e0 [ 511.326228][T17034] ? ip6t_do_table+0x1a30/0x1a30 [ 511.331196][T17034] do_ip6t_set_ctl+0x56e/0xb90 [ 511.335983][T17034] ? __mutex_lock+0x21a/0x12f0 [ 511.340768][T17034] ? compat_do_replace.constprop.0+0x470/0x470 [ 511.347036][T17034] ? wait_for_completion_io+0x270/0x270 [ 511.352622][T17034] ? nf_sockopt_find.constprop.0+0x22d/0x2a0 [ 511.358623][T17034] nf_setsockopt+0x83/0xe0 [ 511.363056][T17034] ipv6_setsockopt+0x122/0x180 [ 511.367842][T17034] udpv6_setsockopt+0x76/0xc0 [ 511.372544][T17034] ? __sys_setsockopt+0x24d/0x610 [ 511.377587][T17034] __sys_setsockopt+0x2db/0x610 [ 511.382455][T17034] ? sock_common_recvmsg+0x1a0/0x1a0 [ 511.387765][T17034] ? __ia32_sys_recv+0x100/0x100 [ 511.392720][T17034] ? lock_downgrade+0x6e0/0x6e0 [ 511.397675][T17034] ? lock_downgrade+0x6e0/0x6e0 [ 511.402564][T17034] __x64_sys_setsockopt+0xba/0x150 [ 511.407700][T17034] ? syscall_enter_from_user_mode+0x21/0x70 [ 511.413620][T17034] do_syscall_64+0x35/0xb0 [ 511.418059][T17034] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 511.423976][T17034] RIP: 0033:0x7f4aa0c47e99 [ 511.428404][T17034] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 511.448036][T17034] RSP: 002b:00007f4a9f5bd168 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 511.456555][T17034] RAX: ffffffffffffffda RBX: 00007f4aa0d5af60 RCX: 00007f4aa0c47e99 [ 511.464543][T17034] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 511.472532][T17034] RBP: 00007f4a9f5bd1d0 R08: 0000000000000678 R09: 0000000000000000 [ 511.480515][T17034] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001 [ 511.488493][T17034] R13: 00007ffea070cfdf R14: 00007f4a9f5bd300 R15: 0000000000022000 [ 511.496492][T17034] [ 511.500526][ T25] kauditd_printk_skb: 27 callbacks suppressed [ 511.500541][ T25] audit: type=1804 audit(1640058836.850:3723): pid=17036 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/429/memory.events" dev="sda1" ino=1176 res=1 errno=0 03:53:57 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d", 0x10}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:57 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0x6000}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:57 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a5630f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) [ 511.534049][ T25] audit: type=1800 audit(1640058836.850:3724): pid=17036 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1176 res=0 errno=0 03:53:57 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x149000, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r3, 0x80089419, &(0x7f0000000040)) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) [ 511.616453][ T25] audit: type=1804 audit(1640058836.850:3725): pid=17040 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/429/memory.events" dev="sda1" ino=1176 res=1 errno=0 [ 511.695579][ T25] audit: type=1800 audit(1640058836.850:3726): pid=17040 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1176 res=0 errno=0 03:53:57 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d", 0x10}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:57 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) (fail_nth: 6) [ 511.781884][ T25] audit: type=1804 audit(1640058837.370:3727): pid=17061 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/430/memory.events" dev="sda1" ino=1176 res=1 errno=0 [ 511.899042][T17067] FAULT_INJECTION: forcing a failure. [ 511.899042][T17067] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 511.932948][ T25] audit: type=1800 audit(1640058837.370:3728): pid=17061 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1176 res=0 errno=0 [ 511.977966][T17067] CPU: 1 PID: 17067 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 [ 511.986760][T17067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 511.996827][T17067] Call Trace: [ 512.000119][T17067] [ 512.000994][ T25] audit: type=1804 audit(1640058837.390:3729): pid=17061 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/430/memory.events" dev="sda1" ino=1176 res=1 errno=0 [ 512.003048][T17067] dump_stack_lvl+0xcd/0x134 [ 512.033130][T17067] should_fail.cold+0x5/0xa [ 512.037658][T17067] _copy_to_user+0x2c/0x150 [ 512.042181][T17067] simple_read_from_buffer+0xcc/0x160 [ 512.047573][T17067] proc_fail_nth_read+0x187/0x220 [ 512.052687][T17067] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 512.058418][T17067] ? security_file_permission+0xab/0xd0 [ 512.063994][T17067] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 512.069729][T17067] vfs_read+0x1b5/0x600 [ 512.073891][T17067] ksys_read+0x12d/0x250 [ 512.078130][T17067] ? vfs_write+0xae0/0xae0 [ 512.082547][T17067] ? syscall_enter_from_user_mode+0x21/0x70 [ 512.088446][T17067] do_syscall_64+0x35/0xb0 [ 512.092863][T17067] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 512.098761][T17067] RIP: 0033:0x7f4aa0bfaa4c [ 512.103173][T17067] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 512.122775][T17067] RSP: 002b:00007f4a9f5bd160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 512.131181][T17067] RAX: ffffffffffffffda RBX: 00007f4aa0d5af60 RCX: 00007f4aa0bfaa4c [ 512.139149][T17067] RDX: 000000000000000f RSI: 00007f4a9f5bd1e0 RDI: 0000000000000004 [ 512.147121][T17067] RBP: 00007f4a9f5bd1d0 R08: 0000000000000000 R09: 0000000000000000 [ 512.155084][T17067] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001 [ 512.163050][T17067] R13: 00007ffea070cfdf R14: 00007f4a9f5bd300 R15: 0000000000022000 [ 512.171034][T17067] 03:53:58 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x100400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:58 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3756f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:53:58 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0xda05}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:58 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86", 0x11}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:58 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:53:58 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x4}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) [ 512.495316][ T25] audit: type=1804 audit(1640058838.100:3730): pid=17078 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/442/memory.events" dev="sda1" ino=1178 res=1 errno=0 03:53:58 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x11, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:53:58 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86", 0x11}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 512.565080][ T25] audit: type=1800 audit(1640058838.100:3731): pid=17078 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1178 res=0 errno=0 03:53:58 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x88, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 512.686382][ T25] audit: type=1804 audit(1640058838.100:3732): pid=17077 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/442/memory.events" dev="sda1" ino=1178 res=1 errno=0 03:53:58 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x149000, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r3, 0x80089419, &(0x7f0000000040)) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:53:58 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0xf000}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:58 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x56}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:53:59 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r3, r1, &(0x7f0000000100)=0x5, 0x80000000) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) sendfile(r1, r6, &(0x7f0000000040)=0x3, 0x400) ioctl$sock_inet_SIOCGIFBRDADDR(r5, 0x8919, &(0x7f00000001c0)={'macvlan0\x00', {0x2, 0x0, @empty}}) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r4, r1, 0x0, 0x100000004) getsockname$packet(r0, &(0x7f0000000140), &(0x7f0000000180)=0x14) 03:53:59 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x2, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:53:59 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86", 0x11}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:59 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{0x68, 0x0, 0xffff}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:59 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x20000292}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:53:59 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x3, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:53:59 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x4, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:53:59 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x7ffff000}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:53:59 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d", 0x10}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:53:59 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) (async) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x149000, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r3, 0x80089419, &(0x7f0000000040)) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:53:59 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x3, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:53:59 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x5, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 514.339713][T17137] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 03:54:00 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r3, r1, &(0x7f0000000100)=0x5, 0x80000000) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) sendfile(r1, r6, &(0x7f0000000040)=0x3, 0x400) ioctl$sock_inet_SIOCGIFBRDADDR(r5, 0x8919, &(0x7f00000001c0)={'macvlan0\x00', {0x2, 0x0, @empty}}) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r4, r1, 0x0, 0x100000004) getsockname$packet(r0, &(0x7f0000000140), &(0x7f0000000180)=0x14) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r3, r1, &(0x7f0000000100)=0x5, 0x80000000) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async) sendfile(r1, r6, &(0x7f0000000040)=0x3, 0x400) (async) ioctl$sock_inet_SIOCGIFBRDADDR(r5, 0x8919, &(0x7f00000001c0)={'macvlan0\x00', {0x2, 0x0, @empty}}) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r4, r1, 0x0, 0x100000004) (async) getsockname$packet(r0, &(0x7f0000000140), &(0x7f0000000180)=0x14) (async) 03:54:00 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d502122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:00 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) (fail_nth: 1) 03:54:00 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x6, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:00 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000000706000000f1ffffff00000000000000"], 0x14}}, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000000000)=0x8, 0xfff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:00 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x1c, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:00 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x7, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 514.644590][T17141] FAULT_INJECTION: forcing a failure. [ 514.644590][T17141] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 514.680653][T17150] netlink: 'syz-executor.4': attribute type 3 has an invalid length. 03:54:00 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x8, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 514.698115][T17141] CPU: 0 PID: 17141 Comm: syz-executor.0 Not tainted 5.16.0-rc5-syzkaller #0 [ 514.706924][T17141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 514.717428][T17141] Call Trace: [ 514.720810][T17141] [ 514.723861][T17141] dump_stack_lvl+0xcd/0x134 [ 514.728475][T17141] should_fail.cold+0x5/0xa [ 514.733003][T17141] _copy_from_user+0x2c/0x180 [ 514.737705][T17141] iovec_from_user+0x246/0x3d0 [ 514.742618][T17141] __import_iovec+0x65/0x5c0 [ 514.747228][T17141] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 514.753224][T17141] import_iovec+0x10c/0x150 [ 514.757734][T17141] vfs_writev+0xc1/0x630 [ 514.761984][T17141] ? vfs_iter_write+0xa0/0xa0 [ 514.766833][T17141] ? __fget_files+0x26a/0x470 [ 514.771507][T17141] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 514.777491][T17141] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 514.783481][T17141] ? __fget_files+0x28c/0x470 [ 514.788164][T17141] ? __fget_light+0xea/0x280 [ 514.792778][T17141] do_writev+0x139/0x300 [ 514.797107][T17141] ? vfs_writev+0x630/0x630 [ 514.801615][T17141] ? syscall_enter_from_user_mode+0x21/0x70 [ 514.807515][T17141] do_syscall_64+0x35/0xb0 [ 514.811932][T17141] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 514.817914][T17141] RIP: 0033:0x7f6912b93e99 [ 514.822324][T17141] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 514.841937][T17141] RSP: 002b:00007f6911509168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 514.850357][T17141] RAX: ffffffffffffffda RBX: 00007f6912ca6f60 RCX: 00007f6912b93e99 [ 514.858324][T17141] RDX: 0000000000000004 RSI: 0000000020001300 RDI: 0000000000000003 [ 514.866375][T17141] RBP: 00007f69115091d0 R08: 0000000000000000 R09: 0000000000000000 [ 514.874339][T17141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 514.882308][T17141] R13: 00007ffea42d4b8f R14: 00007f6911509300 R15: 0000000000022000 [ 514.890294][T17141] 03:54:00 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d503122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:00 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0xb, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:00 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x68, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:00 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x10, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 515.208162][T17182] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 03:54:00 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r3, r1, &(0x7f0000000100)=0x5, 0x80000000) (async) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) sendfile(r1, r6, &(0x7f0000000040)=0x3, 0x400) (async) ioctl$sock_inet_SIOCGIFBRDADDR(r5, 0x8919, &(0x7f00000001c0)={'macvlan0\x00', {0x2, 0x0, @empty}}) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r4, r1, 0x0, 0x100000004) getsockname$packet(r0, &(0x7f0000000140), &(0x7f0000000180)=0x14) 03:54:00 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x11, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:00 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) (fail_nth: 2) 03:54:00 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500562fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) [ 515.353679][T17186] FAULT_INJECTION: forcing a failure. [ 515.353679][T17186] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 515.435989][T17186] CPU: 1 PID: 17186 Comm: syz-executor.0 Not tainted 5.16.0-rc5-syzkaller #0 [ 515.444799][T17186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 515.454875][T17186] Call Trace: [ 515.458173][T17186] [ 515.461112][T17186] dump_stack_lvl+0xcd/0x134 [ 515.465726][T17186] should_fail.cold+0x5/0xa [ 515.470252][T17186] _copy_from_iter+0x389/0x1320 [ 515.475133][T17186] ? hash_and_copy_to_iter+0x200/0x200 [ 515.480620][T17186] ? __lock_acquire+0xbc2/0x54a0 [ 515.485590][T17186] tun_get_user+0x229/0x36d0 [ 515.490288][T17186] ? tun_build_skb+0x1010/0x1010 [ 515.495266][T17186] ? lock_downgrade+0x6e0/0x6e0 [ 515.500157][T17186] tun_chr_write_iter+0xdd/0x1a0 [ 515.505122][T17186] do_iter_readv_writev+0x472/0x750 [ 515.510342][T17186] ? new_sync_write+0x660/0x660 [ 515.515217][T17186] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 515.521476][T17186] ? security_file_permission+0xab/0xd0 [ 515.527056][T17186] do_iter_write+0x188/0x710 [ 515.531673][T17186] ? import_iovec+0x10c/0x150 [ 515.536386][T17186] vfs_writev+0x1aa/0x630 [ 515.540735][T17186] ? vfs_iter_write+0xa0/0xa0 [ 515.545423][T17186] ? __fget_files+0x26a/0x470 [ 515.550121][T17186] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 515.556155][T17186] ? __fget_light+0xea/0x280 [ 515.560764][T17186] do_writev+0x139/0x300 [ 515.565030][T17186] ? vfs_writev+0x630/0x630 [ 515.569583][T17186] ? syscall_enter_from_user_mode+0x21/0x70 [ 515.575510][T17186] do_syscall_64+0x35/0xb0 [ 515.579940][T17186] entry_SYSCALL_64_after_hwframe+0x44/0xae 03:54:01 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async, rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (rerun: 64) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000000706000000f1ffffff00000000000000"], 0x14}}, 0x0) (async, rerun: 64) sendfile(r1, 0xffffffffffffffff, &(0x7f0000000000)=0x8, 0xfff) (rerun: 64) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:54:01 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x12, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:01 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000100)={0x0, @adiantum, 0x0, @desc3}) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={r2, 0x7, 0x9, 0x7f}) sendfile(r5, r4, &(0x7f0000000040)=0x3, 0x661) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)={0x2c, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x2c}}, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) sendfile(r6, r1, 0x0, 0x100000004) 03:54:01 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500042fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) [ 515.585854][T17186] RIP: 0033:0x7f6912b93e99 [ 515.590279][T17186] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 515.609901][T17186] RSP: 002b:00007f6911509168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 515.618331][T17186] RAX: ffffffffffffffda RBX: 00007f6912ca6f60 RCX: 00007f6912b93e99 [ 515.626320][T17186] RDX: 0000000000000004 RSI: 0000000020001300 RDI: 0000000000000003 03:54:01 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x6b, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 515.634302][T17186] RBP: 00007f69115091d0 R08: 0000000000000000 R09: 0000000000000000 [ 515.642283][T17186] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 515.650261][T17186] R13: 00007ffea42d4b8f R14: 00007f6911509300 R15: 0000000000022000 [ 515.658528][T17186] 03:54:01 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x13, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:01 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500562fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:01 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x14, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 515.762711][T17210] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 03:54:01 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x2, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:01 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d5001256c8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:01 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) (fail_nth: 3) 03:54:01 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000000706000000f1ffffff00000000000000"], 0x14}}, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000000000)=0x8, 0xfff) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:01 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x15, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:01 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x16, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 516.146687][T17231] FAULT_INJECTION: forcing a failure. [ 516.146687][T17231] name failslab, interval 1, probability 0, space 0, times 0 [ 516.159866][T17231] CPU: 0 PID: 17231 Comm: syz-executor.0 Not tainted 5.16.0-rc5-syzkaller #0 [ 516.168660][T17231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 516.178730][T17231] Call Trace: [ 516.182020][T17231] [ 516.184956][T17231] dump_stack_lvl+0xcd/0x134 [ 516.189570][T17231] should_fail.cold+0x5/0xa [ 516.194095][T17231] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 516.199842][T17231] should_failslab+0x5/0x10 [ 516.204359][T17231] __kmalloc_node_track_caller+0x7d/0x360 [ 516.210102][T17231] ? __napi_alloc_skb+0x70/0x310 [ 516.215063][T17231] __alloc_skb+0xde/0x340 [ 516.219415][T17231] __napi_alloc_skb+0x70/0x310 [ 516.224203][T17231] napi_get_frags+0x5e/0x140 [ 516.228908][T17231] tun_get_user+0xa15/0x36d0 [ 516.233535][T17231] ? tun_build_skb+0x1010/0x1010 [ 516.238499][T17231] ? lock_downgrade+0x6e0/0x6e0 [ 516.243397][T17231] tun_chr_write_iter+0xdd/0x1a0 [ 516.248401][T17231] do_iter_readv_writev+0x472/0x750 [ 516.253620][T17231] ? new_sync_write+0x660/0x660 [ 516.258494][T17231] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 516.264843][T17231] ? security_file_permission+0xab/0xd0 [ 516.270419][T17231] do_iter_write+0x188/0x710 [ 516.275036][T17231] ? import_iovec+0x10c/0x150 [ 516.279744][T17231] vfs_writev+0x1aa/0x630 [ 516.284098][T17231] ? vfs_iter_write+0xa0/0xa0 [ 516.288792][T17231] ? __fget_files+0x26a/0x470 [ 516.293487][T17231] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 516.299518][T17231] ? __fget_light+0xea/0x280 [ 516.304125][T17231] do_writev+0x139/0x300 [ 516.308383][T17231] ? vfs_writev+0x630/0x630 [ 516.312907][T17231] ? syscall_enter_from_user_mode+0x21/0x70 [ 516.318826][T17231] do_syscall_64+0x35/0xb0 [ 516.323257][T17231] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 516.329269][T17231] RIP: 0033:0x7f6912b93e99 [ 516.333693][T17231] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 516.353311][T17231] RSP: 002b:00007f6911509168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 516.361739][T17231] RAX: ffffffffffffffda RBX: 00007f6912ca6f60 RCX: 00007f6912b93e99 [ 516.369725][T17231] RDX: 0000000000000004 RSI: 0000000020001300 RDI: 0000000000000003 [ 516.377706][T17231] RBP: 00007f69115091d0 R08: 0000000000000000 R09: 0000000000000000 [ 516.385688][T17231] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 516.393667][T17231] R13: 00007ffea42d4b8f R14: 00007f6911509300 R15: 0000000000022000 [ 516.401669][T17231] 03:54:02 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000100)={0x0, @adiantum, 0x0, @desc3}) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={r2, 0x7, 0x9, 0x7f}) sendfile(r5, r4, &(0x7f0000000040)=0x3, 0x661) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)={0x2c, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x2c}}, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) sendfile(r6, r1, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000100)={0x0, @adiantum, 0x0, @desc3}) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={r2, 0x7, 0x9, 0x7f}) (async) sendfile(r5, r4, &(0x7f0000000040)=0x3, 0x661) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)={0x2c, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x2c}}, 0x10) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async) sendfile(r6, r1, 0x0, 0x100000004) (async) 03:54:02 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x5, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:02 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b3568a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:02 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x17, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:02 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) (fail_nth: 4) 03:54:02 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x18, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 516.605547][ T25] kauditd_printk_skb: 164 callbacks suppressed [ 516.605563][ T25] audit: type=1804 audit(1640058842.210:3897): pid=17244 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/447/memory.events" dev="sda1" ino=1182 res=1 errno=0 [ 516.641518][T17243] FAULT_INJECTION: forcing a failure. [ 516.641518][T17243] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 516.706507][T17243] CPU: 0 PID: 17243 Comm: syz-executor.0 Not tainted 5.16.0-rc5-syzkaller #0 [ 516.715327][T17243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 516.725405][T17243] Call Trace: [ 516.728700][T17243] [ 516.731644][T17243] dump_stack_lvl+0xcd/0x134 [ 516.732726][ T25] audit: type=1800 audit(1640058842.250:3898): pid=17244 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1182 res=0 errno=0 [ 516.736253][T17243] should_fail.cold+0x5/0xa [ 516.736325][T17243] _copy_from_iter+0x389/0x1320 [ 516.767543][T17243] ? hash_and_copy_to_iter+0x200/0x200 [ 516.773030][T17243] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 516.779299][T17243] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 516.785561][T17243] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 516.791825][T17243] ? __phys_addr+0xc4/0x140 [ 516.796412][T17243] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 516.802676][T17243] ? __phys_addr_symbol+0x2c/0x70 [ 516.807714][T17243] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 516.813455][T17243] ? __check_object_size+0x16e/0x3f0 [ 516.818911][T17243] skb_copy_datagram_from_iter+0x120/0x6c0 [ 516.824765][T17243] ? lockdep_hardirqs_on+0x79/0x100 [ 516.829985][T17243] ? __local_bh_enable_ip+0xa0/0x120 [ 516.835343][T17243] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 516.842052][T17243] tun_get_user+0x1f6f/0x36d0 [ 516.846772][T17243] ? tun_build_skb+0x1010/0x1010 [ 516.851738][T17243] ? lock_downgrade+0x6e0/0x6e0 [ 516.856632][T17243] tun_chr_write_iter+0xdd/0x1a0 [ 516.856846][ T25] audit: type=1804 audit(1640058842.250:3899): pid=17244 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/447/memory.events" dev="sda1" ino=1182 res=1 errno=0 [ 516.861590][T17243] do_iter_readv_writev+0x472/0x750 [ 516.861624][T17243] ? new_sync_write+0x660/0x660 [ 516.861657][T17243] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 516.861690][T17243] ? security_file_permission+0xab/0xd0 [ 516.908981][T17243] do_iter_write+0x188/0x710 [ 516.913607][T17243] ? import_iovec+0x10c/0x150 [ 516.918314][T17243] vfs_writev+0x1aa/0x630 [ 516.922663][T17243] ? vfs_iter_write+0xa0/0xa0 [ 516.927460][T17243] ? __fget_files+0x26a/0x470 [ 516.932157][T17243] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 516.938186][T17243] ? __fget_light+0xea/0x280 [ 516.942798][T17243] do_writev+0x139/0x300 [ 516.947055][T17243] ? vfs_writev+0x630/0x630 [ 516.951170][ T25] audit: type=1804 audit(1640058842.310:3900): pid=17251 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/447/memory.events" dev="sda1" ino=1182 res=1 errno=0 [ 516.951571][T17243] ? syscall_enter_from_user_mode+0x21/0x70 [ 516.951615][T17243] do_syscall_64+0x35/0xb0 [ 516.987902][T17243] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 516.993820][T17243] RIP: 0033:0x7f6912b93e99 [ 516.998249][T17243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 517.014502][ T25] audit: type=1800 audit(1640058842.310:3901): pid=17251 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1182 res=0 errno=0 [ 517.017861][T17243] RSP: 002b:00007f6911509168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 517.017893][T17243] RAX: ffffffffffffffda RBX: 00007f6912ca6f60 RCX: 00007f6912b93e99 03:54:02 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e256eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:02 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x19, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:02 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x1a, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 517.017912][T17243] RDX: 0000000000000004 RSI: 0000000020001300 RDI: 0000000000000003 [ 517.017929][T17243] RBP: 00007f69115091d0 R08: 0000000000000000 R09: 0000000000000000 [ 517.017944][T17243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 517.017959][T17243] R13: 00007ffea42d4b8f R14: 00007f6911509300 R15: 0000000000022000 [ 517.060508][ T25] audit: type=1804 audit(1640058842.310:3902): pid=17252 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/447/memory.events" dev="sda1" ino=1182 res=1 errno=0 [ 517.064078][T17243] 03:54:02 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r6, r4, 0x0, 0x100000004) 03:54:02 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x1b, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:02 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x6, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 517.393459][T17277] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 517.439952][ T25] audit: type=1804 audit(1640058843.050:3903): pid=17277 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/436/memory.events" dev="sda1" ino=1165 res=1 errno=0 [ 517.472016][ T25] audit: type=1800 audit(1640058843.050:3904): pid=17277 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1165 res=0 errno=0 [ 517.496390][ T25] audit: type=1804 audit(1640058843.050:3905): pid=17277 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/436/memory.events" dev="sda1" ino=1165 res=1 errno=0 03:54:10 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async, rerun: 64) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (rerun: 64) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000100)={0x0, @adiantum, 0x0, @desc3}) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={r2, 0x7, 0x9, 0x7f}) sendfile(r5, r4, &(0x7f0000000040)=0x3, 0x661) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)={0x2c, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x2c}}, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async, rerun: 32) sendfile(r6, r1, 0x0, 0x100000004) (rerun: 32) 03:54:10 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a56e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:10 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) (fail_nth: 5) 03:54:10 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x1c, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x8, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:10 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r6, r4, 0x0, 0x100000004) socket$netlink(0x10, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) syz_genetlink_get_family_id$nl80211(0x0, r0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r6, r4, 0x0, 0x100000004) (async) [ 524.872232][T17282] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 03:54:10 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x1d, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 524.903764][ T25] audit: type=1804 audit(1640058850.510:3906): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/448/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 524.934126][T17295] netlink: 'syz-executor.4': attribute type 8 has an invalid length. [ 524.986229][T17289] FAULT_INJECTION: forcing a failure. [ 524.986229][T17289] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 525.007013][ T25] audit: type=1800 audit(1640058850.510:3907): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1181 res=0 errno=0 [ 525.015158][T17289] CPU: 0 PID: 17289 Comm: syz-executor.0 Not tainted 5.16.0-rc5-syzkaller #0 [ 525.037787][T17289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 525.047855][T17289] Call Trace: [ 525.051147][T17289] [ 525.054090][T17289] dump_stack_lvl+0xcd/0x134 [ 525.058711][T17289] should_fail.cold+0x5/0xa [ 525.063242][T17289] copy_page_from_iter+0x359/0x7c0 [ 525.068391][T17289] skb_copy_datagram_from_iter+0x40d/0x6c0 [ 525.071515][ T25] audit: type=1804 audit(1640058850.510:3908): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/448/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 525.074238][T17289] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 525.074282][T17289] tun_get_user+0x1f6f/0x36d0 [ 525.111412][T17289] ? tun_build_skb+0x1010/0x1010 [ 525.116381][T17289] ? lock_downgrade+0x6e0/0x6e0 [ 525.121260][T17289] tun_chr_write_iter+0xdd/0x1a0 [ 525.126210][T17289] do_iter_readv_writev+0x472/0x750 [ 525.131438][T17289] ? new_sync_write+0x660/0x660 [ 525.136319][T17289] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 525.142569][T17289] ? security_file_permission+0xab/0xd0 [ 525.148131][T17289] do_iter_write+0x188/0x710 [ 525.152732][T17289] ? import_iovec+0x10c/0x150 [ 525.157422][T17289] vfs_writev+0x1aa/0x630 [ 525.161760][T17289] ? vfs_iter_write+0xa0/0xa0 [ 525.166436][T17289] ? __fget_files+0x26a/0x470 [ 525.171227][T17289] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 525.177238][T17289] ? __fget_light+0xea/0x280 [ 525.181834][T17289] do_writev+0x139/0x300 [ 525.186082][T17289] ? vfs_writev+0x630/0x630 [ 525.190598][T17289] ? syscall_enter_from_user_mode+0x21/0x70 [ 525.196503][T17289] do_syscall_64+0x35/0xb0 [ 525.200924][T17289] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 525.206825][T17289] RIP: 0033:0x7f6912b93e99 [ 525.211239][T17289] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 525.230843][T17289] RSP: 002b:00007f6911509168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 525.239257][T17289] RAX: ffffffffffffffda RBX: 00007f6912ca6f60 RCX: 00007f6912b93e99 [ 525.247230][T17289] RDX: 0000000000000004 RSI: 0000000020001300 RDI: 0000000000000003 [ 525.255281][T17289] RBP: 00007f69115091d0 R08: 0000000000000000 R09: 0000000000000000 [ 525.263246][T17289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 525.271215][T17289] R13: 00007ffea42d4b8f R14: 00007f6911509300 R15: 0000000000022000 [ 525.279198][T17289] 03:54:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x9, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:10 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x1e, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 525.307305][ T25] audit: type=1800 audit(1640058850.510:3909): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1181 res=0 errno=0 03:54:11 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x21, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 525.387342][ T25] audit: type=1804 audit(1640058850.510:3910): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/448/memory.events" dev="sda1" ino=1181 res=1 errno=0 03:54:11 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88566f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) [ 525.427873][ T25] audit: type=1800 audit(1640058850.510:3911): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1181 res=0 errno=0 03:54:11 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x22, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 525.513524][ T25] audit: type=1804 audit(1640058850.510:3912): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/448/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 525.585069][ T25] audit: type=1800 audit(1640058850.510:3913): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1181 res=0 errno=0 [ 525.634172][ T25] audit: type=1804 audit(1640058850.510:3914): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/448/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 525.681051][ T25] audit: type=1800 audit(1640058850.510:3915): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1181 res=0 errno=0 03:54:11 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r0, 0x8008f511, &(0x7f0000000100)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0x1}], 0x3, 0x8040000, 0x80000000) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r0, 0xf503, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000860bea58cd88a5af3a4c400101657400"], 0x14}}, 0x4000) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000108ed50c8e3dd8115990235292346530dc77f4852b01c21a624388ca756fdd6433a68586146a408a41dc7a1a1c9bcdc49dbc1b40"], 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f00000003c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0xd}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0x1, 0x4e23, 0x100, 0xa, 0xa0, 0x90, 0x88, r6, 0xee01}, {0x10001, 0x200, 0x100000001, 0xffffffffffffffc1, 0x3, 0x1, 0xabd, 0x60000}, {0x7fffffff000, 0x5, 0x4, 0x2}, 0x80000001, 0x6e6bba, 0x0, 0x0, 0x2}, {{@in=@private=0xa010100, 0x4d2, 0x32}, 0x2, @in6=@local, 0x3501, 0x3, 0x0, 0x21, 0x9, 0xfffffff8, 0x8001}}, 0xe8) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0xa, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:11 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x23, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:11 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) (fail_nth: 6) 03:54:11 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f567851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:11 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r6, r4, 0x0, 0x100000004) socket$netlink(0x10, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) syz_genetlink_get_family_id$nl80211(0x0, r0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r6, r4, 0x0, 0x100000004) (async) 03:54:11 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x2a, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 525.794821][T17336] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 03:54:11 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r0, 0x8008f511, &(0x7f0000000100)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0x1}], 0x3, 0x8040000, 0x80000000) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r0, 0xf503, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000860bea58cd88a5af3a4c400101657400"], 0x14}}, 0x4000) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000108ed50c8e3dd8115990235292346530dc77f4852b01c21a624388ca756fdd6433a68586146a408a41dc7a1a1c9bcdc49dbc1b40"], 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f00000003c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0xd}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0x1, 0x4e23, 0x100, 0xa, 0xa0, 0x90, 0x88, r6, 0xee01}, {0x10001, 0x200, 0x100000001, 0xffffffffffffffc1, 0x3, 0x1, 0xabd, 0x60000}, {0x7fffffff000, 0x5, 0x4, 0x2}, 0x80000001, 0x6e6bba, 0x0, 0x0, 0x2}, {{@in=@private=0xa010100, 0x4d2, 0x32}, 0x2, @in6=@local, 0x3501, 0x3, 0x0, 0x21, 0x9, 0xfffffff8, 0x8001}}, 0xe8) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r0, 0x8008f511, &(0x7f0000000100)) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0x1}], 0x3, 0x8040000, 0x80000000) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r0, 0xf503, 0x0) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000860bea58cd88a5af3a4c400101657400"], 0x14}}, 0x4000) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000108ed50c8e3dd8115990235292346530dc77f4852b01c21a624388ca756fdd6433a68586146a408a41dc7a1a1c9bcdc49dbc1b40"], 0x14}}, 0x0) (async) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) socket$inet6_icmp(0xa, 0x2, 0x3a) (async) setsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f00000003c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0xd}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0x1, 0x4e23, 0x100, 0xa, 0xa0, 0x90, 0x88, r6, 0xee01}, {0x10001, 0x200, 0x100000001, 0xffffffffffffffc1, 0x3, 0x1, 0xabd, 0x60000}, {0x7fffffff000, 0x5, 0x4, 0x2}, 0x80000001, 0x6e6bba, 0x0, 0x0, 0x2}, {{@in=@private=0xa010100, 0x4d2, 0x32}, 0x2, @in6=@local, 0x3501, 0x3, 0x0, 0x21, 0x9, 0xfffffff8, 0x8001}}, 0xe8) (async) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r3, r1, 0x0, 0x100000004) (async) 03:54:11 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217856caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:11 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x2b, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 525.902973][T17338] FAULT_INJECTION: forcing a failure. [ 525.902973][T17338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 525.994534][T17338] CPU: 1 PID: 17338 Comm: syz-executor.0 Not tainted 5.16.0-rc5-syzkaller #0 [ 526.003352][T17338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 526.013425][T17338] Call Trace: [ 526.016712][T17338] [ 526.019648][T17338] dump_stack_lvl+0xcd/0x134 [ 526.024271][T17338] should_fail.cold+0x5/0xa [ 526.028803][T17338] copy_page_from_iter+0x359/0x7c0 [ 526.033950][T17338] skb_copy_datagram_from_iter+0x40d/0x6c0 [ 526.039804][T17338] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 526.046084][T17338] tun_get_user+0x1f6f/0x36d0 [ 526.050810][T17338] ? tun_build_skb+0x1010/0x1010 [ 526.055784][T17338] ? lock_downgrade+0x6e0/0x6e0 [ 526.060684][T17338] tun_chr_write_iter+0xdd/0x1a0 [ 526.065650][T17338] do_iter_readv_writev+0x472/0x750 [ 526.070888][T17338] ? new_sync_write+0x660/0x660 [ 526.075769][T17338] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 526.082036][T17338] ? security_file_permission+0xab/0xd0 [ 526.087661][T17338] do_iter_write+0x188/0x710 [ 526.092320][T17338] ? import_iovec+0x10c/0x150 [ 526.097031][T17338] vfs_writev+0x1aa/0x630 [ 526.101382][T17338] ? vfs_iter_write+0xa0/0xa0 [ 526.106088][T17338] ? __fget_files+0x26a/0x470 [ 526.110791][T17338] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 526.116834][T17338] ? __fget_light+0xea/0x280 [ 526.121454][T17338] do_writev+0x139/0x300 [ 526.125721][T17338] ? vfs_writev+0x630/0x630 [ 526.130367][T17338] ? syscall_enter_from_user_mode+0x21/0x70 [ 526.136305][T17338] do_syscall_64+0x35/0xb0 [ 526.140742][T17338] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 526.146661][T17338] RIP: 0033:0x7f6912b93e99 [ 526.151086][T17338] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 526.170708][T17338] RSP: 002b:00007f6911509168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 526.179215][T17338] RAX: ffffffffffffffda RBX: 00007f6912ca6f60 RCX: 00007f6912b93e99 [ 526.187188][T17338] RDX: 0000000000000004 RSI: 0000000020001300 RDI: 0000000000000003 03:54:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0xb, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:11 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r1, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f0000000340)) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r3, 0x800, 0x0, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xe3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40d0}, 0x10) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r3, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x14, 0x18, {0x8, @bearer=@l2={'eth', 0x3a, 'vlan0\x00'}}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x40001) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r6 = openat$cgroup(r4, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000100)='blkio.throttle.io_service_bytes\x00', 0x7a05, 0x1700) pwritev(r7, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r8 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r8, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r8, r5, 0x0, 0x100000004) 03:54:11 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r0, 0x8008f511, &(0x7f0000000100)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0x1}], 0x3, 0x8040000, 0x80000000) (async) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r0, 0xf503, 0x0) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000860bea58cd88a5af3a4c400101657400"], 0x14}}, 0x4000) (async) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000108ed50c8e3dd8115990235292346530dc77f4852b01c21a624388ca756fdd6433a68586146a408a41dc7a1a1c9bcdc49dbc1b40"], 0x14}}, 0x0) (async) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) r7 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f00000003c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0xd}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0x1, 0x4e23, 0x100, 0xa, 0xa0, 0x90, 0x88, r6, 0xee01}, {0x10001, 0x200, 0x100000001, 0xffffffffffffffc1, 0x3, 0x1, 0xabd, 0x60000}, {0x7fffffff000, 0x5, 0x4, 0x2}, 0x80000001, 0x6e6bba, 0x0, 0x0, 0x2}, {{@in=@private=0xa010100, 0x4d2, 0x32}, 0x2, @in6=@local, 0x3501, 0x3, 0x0, 0x21, 0x9, 0xfffffff8, 0x8001}}, 0xe8) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:11 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x2c, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 526.195158][T17338] RBP: 00007f69115091d0 R08: 0000000000000000 R09: 0000000000000000 [ 526.203127][T17338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.211096][T17338] R13: 00007ffea42d4b8f R14: 00007f6911509300 R15: 0000000000022000 [ 526.219083][T17338] 03:54:11 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50200000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:12 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) (fail_nth: 7) 03:54:12 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async, rerun: 64) r0 = socket(0x10, 0x803, 0x0) (rerun: 64) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r1, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) (async, rerun: 32) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f0000000340)) (rerun: 32) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r3, 0x800, 0x0, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xe3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40d0}, 0x10) (async) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r3, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x14, 0x18, {0x8, @bearer=@l2={'eth', 0x3a, 'vlan0\x00'}}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x40001) (async, rerun: 64) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (rerun: 64) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r6 = openat$cgroup(r4, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000100)='blkio.throttle.io_service_bytes\x00', 0x7a05, 0x1700) pwritev(r7, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r8 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r8, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r8, r5, 0x0, 0x100000004) 03:54:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x10, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:12 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x2d, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:12 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) recvmmsg$unix(r1, &(0x7f0000001180)=[{{&(0x7f0000000140), 0x6e, &(0x7f0000000500)=[{&(0x7f0000000240)=""/120, 0x78}, {&(0x7f00000001c0)=""/10, 0xa}, {&(0x7f0000000300)=""/71, 0x47}, {&(0x7f00000003c0)=""/243, 0xf3}], 0x4, &(0x7f0000000600)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa0}}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000006c0)=""/86, 0x56}, {&(0x7f0000000740)=""/86, 0x56}, {&(0x7f00000007c0)=""/88, 0x58}], 0x3}}, {{&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000900)=""/135, 0x87}, {&(0x7f00000009c0)=""/186, 0xba}, {&(0x7f0000000a80)=""/78, 0x4e}], 0x3, &(0x7f0000000b40)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}}, {{&(0x7f0000000bc0)=@abs, 0x6e, &(0x7f0000001080)=[{&(0x7f0000000c40)=""/162, 0xa2}, {&(0x7f0000000d00)=""/107, 0x6b}, {&(0x7f0000000d80)=""/230, 0xe6}, {&(0x7f0000000e80)=""/202, 0xca}, {&(0x7f0000000f80)=""/244, 0xf4}], 0x5, &(0x7f0000001100)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}], 0x4, 0x12121, &(0x7f0000001280)={0x77359400}) openat$cgroup_ro(r4, &(0x7f00000012c0)='rdma.current\x00', 0x0, 0x0) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000100)={0x1, 0x2, [@dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}]}) 03:54:12 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x2e, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:12 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50300000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) [ 526.612697][T17408] netlink: 'syz-executor.4': attribute type 16 has an invalid length. 03:54:12 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x2f, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 526.656487][T17407] FAULT_INJECTION: forcing a failure. [ 526.656487][T17407] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 526.722559][T17407] CPU: 1 PID: 17407 Comm: syz-executor.0 Not tainted 5.16.0-rc5-syzkaller #0 [ 526.731374][T17407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 526.741448][T17407] Call Trace: [ 526.744740][T17407] [ 526.747690][T17407] dump_stack_lvl+0xcd/0x134 [ 526.752308][T17407] should_fail.cold+0x5/0xa [ 526.756845][T17407] copy_page_from_iter+0x359/0x7c0 [ 526.761991][T17407] skb_copy_datagram_from_iter+0x40d/0x6c0 [ 526.767840][T17407] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 526.774117][T17407] tun_get_user+0x1f6f/0x36d0 [ 526.778849][T17407] ? tun_build_skb+0x1010/0x1010 [ 526.783817][T17407] ? lock_downgrade+0x6e0/0x6e0 [ 526.788716][T17407] tun_chr_write_iter+0xdd/0x1a0 [ 526.793683][T17407] do_iter_readv_writev+0x472/0x750 [ 526.798911][T17407] ? new_sync_write+0x660/0x660 [ 526.803789][T17407] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 526.810059][T17407] ? security_file_permission+0xab/0xd0 [ 526.815642][T17407] do_iter_write+0x188/0x710 [ 526.820260][T17407] ? import_iovec+0x10c/0x150 [ 526.824962][T17407] vfs_writev+0x1aa/0x630 [ 526.829400][T17407] ? vfs_iter_write+0xa0/0xa0 [ 526.834096][T17407] ? __fget_files+0x26a/0x470 [ 526.838793][T17407] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 526.844834][T17407] ? __fget_light+0xea/0x280 [ 526.849447][T17407] do_writev+0x139/0x300 [ 526.853710][T17407] ? vfs_writev+0x630/0x630 [ 526.858236][T17407] ? syscall_enter_from_user_mode+0x21/0x70 [ 526.864159][T17407] do_syscall_64+0x35/0xb0 [ 526.868592][T17407] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 526.874520][T17407] RIP: 0033:0x7f6912b93e99 [ 526.878953][T17407] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 526.898667][T17407] RSP: 002b:00007f6911509168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 526.907104][T17407] RAX: ffffffffffffffda RBX: 00007f6912ca6f60 RCX: 00007f6912b93e99 [ 526.915098][T17407] RDX: 0000000000000004 RSI: 0000000020001300 RDI: 0000000000000003 03:54:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x11, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:12 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x30, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:12 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x31, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:12 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x32, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 526.923080][T17407] RBP: 00007f69115091d0 R08: 0000000000000000 R09: 0000000000000000 [ 526.931070][T17407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.939056][T17407] R13: 00007ffea42d4b8f R14: 00007f6911509300 R15: 0000000000022000 [ 526.947067][T17407] 03:54:12 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) (fail_nth: 8) 03:54:12 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50003000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:12 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async, rerun: 64) r0 = socket(0x10, 0x803, 0x0) (rerun: 64) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async, rerun: 32) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (rerun: 32) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r1, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 32) r3 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) (rerun: 32) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f0000000340)) (async) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r3, 0x800, 0x0, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xe3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40d0}, 0x10) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r3, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x14, 0x18, {0x8, @bearer=@l2={'eth', 0x3a, 'vlan0\x00'}}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x40001) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r6 = openat$cgroup(r4, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000100)='blkio.throttle.io_service_bytes\x00', 0x7a05, 0x1700) pwritev(r7, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r8 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r8, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 64) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (rerun: 64) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r8, r5, 0x0, 0x100000004) 03:54:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x6b, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 527.316679][T17439] FAULT_INJECTION: forcing a failure. [ 527.316679][T17439] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 527.352486][T17439] CPU: 0 PID: 17439 Comm: syz-executor.0 Not tainted 5.16.0-rc5-syzkaller #0 [ 527.361306][T17439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 527.371377][T17439] Call Trace: [ 527.374671][T17439] [ 527.377620][T17439] dump_stack_lvl+0xcd/0x134 [ 527.382235][T17439] should_fail.cold+0x5/0xa [ 527.386771][T17439] _copy_to_user+0x2c/0x150 [ 527.391314][T17439] simple_read_from_buffer+0xcc/0x160 [ 527.396720][T17439] proc_fail_nth_read+0x187/0x220 [ 527.401771][T17439] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 527.407520][T17439] ? security_file_permission+0xab/0xd0 [ 527.413102][T17439] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 527.418846][T17439] vfs_read+0x1b5/0x600 [ 527.423027][T17439] ksys_read+0x12d/0x250 [ 527.427287][T17439] ? vfs_write+0xae0/0xae0 [ 527.431725][T17439] ? syscall_enter_from_user_mode+0x21/0x70 [ 527.437654][T17439] do_syscall_64+0x35/0xb0 [ 527.442086][T17439] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 527.447996][T17439] RIP: 0033:0x7f6912b46a4c [ 527.452417][T17439] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 527.472036][T17439] RSP: 002b:00007f6911509160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 527.480453][T17439] RAX: ffffffffffffffda RBX: 00007f6912ca6f60 RCX: 00007f6912b46a4c [ 527.488433][T17439] RDX: 000000000000000f RSI: 00007f69115091e0 RDI: 0000000000000005 [ 527.496408][T17439] RBP: 00007f69115091d0 R08: 0000000000000000 R09: 0000000000000000 [ 527.504376][T17439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 527.512343][T17439] R13: 00007ffea42d4b8f R14: 00007f6911509300 R15: 0000000000022000 [ 527.520328][T17439] 03:54:13 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) recvmmsg$unix(r1, &(0x7f0000001180)=[{{&(0x7f0000000140), 0x6e, &(0x7f0000000500)=[{&(0x7f0000000240)=""/120, 0x78}, {&(0x7f00000001c0)=""/10, 0xa}, {&(0x7f0000000300)=""/71, 0x47}, {&(0x7f00000003c0)=""/243, 0xf3}], 0x4, &(0x7f0000000600)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa0}}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000006c0)=""/86, 0x56}, {&(0x7f0000000740)=""/86, 0x56}, {&(0x7f00000007c0)=""/88, 0x58}], 0x3}}, {{&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000900)=""/135, 0x87}, {&(0x7f00000009c0)=""/186, 0xba}, {&(0x7f0000000a80)=""/78, 0x4e}], 0x3, &(0x7f0000000b40)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}}, {{&(0x7f0000000bc0)=@abs, 0x6e, &(0x7f0000001080)=[{&(0x7f0000000c40)=""/162, 0xa2}, {&(0x7f0000000d00)=""/107, 0x6b}, {&(0x7f0000000d80)=""/230, 0xe6}, {&(0x7f0000000e80)=""/202, 0xca}, {&(0x7f0000000f80)=""/244, 0xf4}], 0x5, &(0x7f0000001100)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}], 0x4, 0x12121, &(0x7f0000001280)={0x77359400}) openat$cgroup_ro(r4, &(0x7f00000012c0)='rdma.current\x00', 0x0, 0x0) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000100)={0x1, 0x2, [@dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}]}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) recvmmsg$unix(r1, &(0x7f0000001180)=[{{&(0x7f0000000140), 0x6e, &(0x7f0000000500)=[{&(0x7f0000000240)=""/120, 0x78}, {&(0x7f00000001c0)=""/10, 0xa}, {&(0x7f0000000300)=""/71, 0x47}, {&(0x7f00000003c0)=""/243, 0xf3}], 0x4, &(0x7f0000000600)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa0}}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000006c0)=""/86, 0x56}, {&(0x7f0000000740)=""/86, 0x56}, {&(0x7f00000007c0)=""/88, 0x58}], 0x3}}, {{&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000900)=""/135, 0x87}, {&(0x7f00000009c0)=""/186, 0xba}, {&(0x7f0000000a80)=""/78, 0x4e}], 0x3, &(0x7f0000000b40)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}}, {{&(0x7f0000000bc0)=@abs, 0x6e, &(0x7f0000001080)=[{&(0x7f0000000c40)=""/162, 0xa2}, {&(0x7f0000000d00)=""/107, 0x6b}, {&(0x7f0000000d80)=""/230, 0xe6}, {&(0x7f0000000e80)=""/202, 0xca}, {&(0x7f0000000f80)=""/244, 0xf4}], 0x5, &(0x7f0000001100)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}], 0x4, 0x12121, &(0x7f0000001280)={0x77359400}) (async) openat$cgroup_ro(r4, &(0x7f00000012c0)='rdma.current\x00', 0x0, 0x0) (async) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000100)={0x1, 0x2, [@dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}]}) (async) 03:54:13 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:13 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x33, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:13 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5800e000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:13 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r6, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r7, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r7, r5, 0x0, 0x100000004) 03:54:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x117, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:13 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x35, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 527.711104][T17447] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 03:54:13 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x36, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:13 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50e80000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x133, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:13 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) recvmmsg$unix(r1, &(0x7f0000001180)=[{{&(0x7f0000000140), 0x6e, &(0x7f0000000500)=[{&(0x7f0000000240)=""/120, 0x78}, {&(0x7f00000001c0)=""/10, 0xa}, {&(0x7f0000000300)=""/71, 0x47}, {&(0x7f00000003c0)=""/243, 0xf3}], 0x4, &(0x7f0000000600)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa0}}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000006c0)=""/86, 0x56}, {&(0x7f0000000740)=""/86, 0x56}, {&(0x7f00000007c0)=""/88, 0x58}], 0x3}}, {{&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000900)=""/135, 0x87}, {&(0x7f00000009c0)=""/186, 0xba}, {&(0x7f0000000a80)=""/78, 0x4e}], 0x3, &(0x7f0000000b40)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}}, {{&(0x7f0000000bc0)=@abs, 0x6e, &(0x7f0000001080)=[{&(0x7f0000000c40)=""/162, 0xa2}, {&(0x7f0000000d00)=""/107, 0x6b}, {&(0x7f0000000d80)=""/230, 0xe6}, {&(0x7f0000000e80)=""/202, 0xca}, {&(0x7f0000000f80)=""/244, 0xf4}], 0x5, &(0x7f0000001100)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}], 0x4, 0x12121, &(0x7f0000001280)={0x77359400}) openat$cgroup_ro(r4, &(0x7f00000012c0)='rdma.current\x00', 0x0, 0x0) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000100)={0x1, 0x2, [@dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}]}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) recvmmsg$unix(r1, &(0x7f0000001180)=[{{&(0x7f0000000140), 0x6e, &(0x7f0000000500)=[{&(0x7f0000000240)=""/120, 0x78}, {&(0x7f00000001c0)=""/10, 0xa}, {&(0x7f0000000300)=""/71, 0x47}, {&(0x7f00000003c0)=""/243, 0xf3}], 0x4, &(0x7f0000000600)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa0}}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000006c0)=""/86, 0x56}, {&(0x7f0000000740)=""/86, 0x56}, {&(0x7f00000007c0)=""/88, 0x58}], 0x3}}, {{&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000900)=""/135, 0x87}, {&(0x7f00000009c0)=""/186, 0xba}, {&(0x7f0000000a80)=""/78, 0x4e}], 0x3, &(0x7f0000000b40)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}}, {{&(0x7f0000000bc0)=@abs, 0x6e, &(0x7f0000001080)=[{&(0x7f0000000c40)=""/162, 0xa2}, {&(0x7f0000000d00)=""/107, 0x6b}, {&(0x7f0000000d80)=""/230, 0xe6}, {&(0x7f0000000e80)=""/202, 0xca}, {&(0x7f0000000f80)=""/244, 0xf4}], 0x5, &(0x7f0000001100)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}], 0x4, 0x12121, &(0x7f0000001280)={0x77359400}) (async) openat$cgroup_ro(r4, &(0x7f00000012c0)='rdma.current\x00', 0x0, 0x0) (async) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000100)={0x1, 0x2, [@dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}]}) (async) 03:54:13 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x37, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:13 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x38, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:13 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="442da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:13 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000005680000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:13 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x39, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x2001, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:14 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r6, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r7, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r7, r5, 0x0, 0x100000004) socket$netlink(0x10, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r6, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r7, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r7, r5, 0x0, 0x100000004) (async) 03:54:14 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x3a, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:14 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50002000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:14 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r4, 0xffffffffffffffff, 0x0, 0xfffefffc) ioctl$TUNSETLINK(r1, 0x8912, 0x28) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_int(r1, &(0x7f0000000100)=0x7fff, 0x12) ioctl$TUNSETLINK(r5, 0x8912, 0x400308) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) sendfile(r4, r0, 0x0, 0x100000003) 03:54:14 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3744f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x3, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:14 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x3b, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 528.706145][T17530] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 528.722938][T17531] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 03:54:14 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50003000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:14 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x3c, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:14 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d05dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x30, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:14 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x3e, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:14 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r6, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r7, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r7, r5, 0x0, 0x100000004) socket$netlink(0x10, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r6, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r7, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r7, r5, 0x0, 0x100000004) (async) 03:54:14 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000030e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:14 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x41, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 529.116809][T17560] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 529.139122][T17559] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 529.510349][T17527] warn_alloc: 1 callbacks suppressed [ 529.510370][T17527] syz-executor.1: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 529.531181][T17527] CPU: 0 PID: 17527 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0 [ 529.539951][T17527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 529.550020][T17527] Call Trace: [ 529.553300][T17527] [ 529.556220][T17527] dump_stack_lvl+0xcd/0x134 [ 529.560813][T17527] warn_alloc.cold+0x87/0x17a [ 529.565485][T17527] ? zone_watermark_ok_safe+0x290/0x290 [ 529.571024][T17527] ? __kmalloc_node+0x62/0x390 [ 529.575812][T17527] ? __vmalloc_node_range+0x574/0xab0 [ 529.581183][T17527] __vmalloc_node_range+0x883/0xab0 [ 529.586380][T17527] ? vfree_atomic+0xe0/0xe0 [ 529.590974][T17527] ? netlink_sendmsg+0x687/0xdf0 [ 529.595941][T17527] vmalloc+0x67/0x80 [ 529.599834][T17527] ? netlink_sendmsg+0x687/0xdf0 [ 529.604800][T17527] netlink_sendmsg+0x687/0xdf0 [ 529.609568][T17527] ? netlink_unicast+0x7d0/0x7d0 [ 529.614517][T17527] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 529.620598][T17527] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 529.626846][T17527] ? netlink_unicast+0x7d0/0x7d0 [ 529.631789][T17527] sock_sendmsg+0xcf/0x120 [ 529.636210][T17527] sock_no_sendpage+0xf6/0x140 [ 529.640983][T17527] ? sock_no_shutdown+0x10/0x10 [ 529.645892][T17527] ? find_held_lock+0x2d/0x110 [ 529.650665][T17527] kernel_sendpage.part.0+0x1a0/0x340 [ 529.656127][T17527] sock_sendpage+0xe5/0x140 [ 529.660633][T17527] ? __sock_recv_ts_and_drops+0x430/0x430 [ 529.666352][T17527] pipe_to_sendpage+0x2ad/0x380 [ 529.671296][T17527] ? propagate_umount+0x19f0/0x19f0 [ 529.676836][T17527] ? __put_page+0x13d/0x470 [ 529.681406][T17527] __splice_from_pipe+0x43e/0x8a0 [ 529.686439][T17527] ? propagate_umount+0x19f0/0x19f0 [ 529.691641][T17527] generic_splice_sendpage+0xd4/0x140 [ 529.697012][T17527] ? __do_sys_vmsplice+0x9e0/0x9e0 [ 529.702214][T17527] ? security_file_permission+0xab/0xd0 [ 529.707774][T17527] ? __do_sys_vmsplice+0x9e0/0x9e0 [ 529.712882][T17527] direct_splice_actor+0x110/0x180 [ 529.717995][T17527] splice_direct_to_actor+0x34b/0x8c0 [ 529.723369][T17527] ? generic_file_splice_read+0x6d0/0x6d0 [ 529.729099][T17527] ? do_splice_to+0x250/0x250 [ 529.733774][T17527] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 529.740018][T17527] ? security_file_permission+0xab/0xd0 [ 529.745580][T17527] do_splice_direct+0x1b3/0x280 [ 529.750431][T17527] ? splice_direct_to_actor+0x8c0/0x8c0 [ 529.755981][T17527] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 529.762233][T17527] ? security_file_permission+0xab/0xd0 [ 529.767788][T17527] do_sendfile+0xaf2/0x1250 [ 529.772333][T17527] ? do_pwritev+0x270/0x270 [ 529.776924][T17527] ? __context_tracking_exit+0xb8/0xe0 [ 529.782386][T17527] ? lock_downgrade+0x6e0/0x6e0 [ 529.787240][T17527] ? lock_downgrade+0x6e0/0x6e0 [ 529.792094][T17527] __x64_sys_sendfile64+0x1cc/0x210 [ 529.797320][T17527] ? __ia32_sys_sendfile+0x220/0x220 [ 529.802609][T17527] ? syscall_enter_from_user_mode+0x21/0x70 [ 529.808511][T17527] do_syscall_64+0x35/0xb0 [ 529.812927][T17527] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 529.818826][T17527] RIP: 0033:0x7ff9386e2e99 [ 529.823326][T17527] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 529.842932][T17527] RSP: 002b:00007ff937058168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 529.851347][T17527] RAX: ffffffffffffffda RBX: 00007ff9387f5f60 RCX: 00007ff9386e2e99 [ 529.859314][T17527] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000016 [ 529.867279][T17527] RBP: 00007ff93873cff1 R08: 0000000000000000 R09: 0000000000000000 [ 529.875245][T17527] R10: 0000000100000003 R11: 0000000000000246 R12: 0000000000000000 [ 529.883212][T17527] R13: 00007fff499d856f R14: 00007ff937058300 R15: 0000000000022000 [ 529.891195][T17527] [ 529.909872][T17527] Mem-Info: [ 529.913098][T17527] active_anon:915 inactive_anon:80333 isolated_anon:0 [ 529.913098][T17527] active_file:8148 inactive_file:36120 isolated_file:0 [ 529.913098][T17527] unevictable:768 dirty:34 writeback:0 [ 529.913098][T17527] slab_reclaimable:20239 slab_unreclaimable:124811 [ 529.913098][T17527] mapped:28029 shmem:2578 pagetables:647 bounce:0 [ 529.913098][T17527] kernel_misc_reclaimable:0 [ 529.913098][T17527] free:1332841 free_pcp:8304 free_cma:0 [ 529.955353][T17527] Node 0 active_anon:3648kB inactive_anon:320412kB active_file:32520kB inactive_file:144480kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:112116kB dirty:132kB writeback:0kB shmem:7844kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 362496kB writeback_tmp:0kB kernel_stack:10768kB pagetables:2584kB all_unreclaimable? no [ 529.987207][T17527] Node 1 active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:2468kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:4kB all_unreclaimable? no [ 530.016976][T17527] Node 0 DMA free:15360kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 530.046053][T17527] lowmem_reserve[]: 0 2645 2645 2645 2645 [ 530.052224][T17527] Node 0 DMA32 free:1368248kB boost:0kB min:35676kB low:44592kB high:53508kB reserved_highatomic:0KB active_anon:3648kB inactive_anon:320412kB active_file:32520kB inactive_file:144480kB unevictable:1536kB writepending:132kB present:3129332kB managed:2716752kB mlocked:0kB bounce:0kB free_pcp:33284kB local_pcp:20012kB free_cma:0kB [ 530.083443][T17527] lowmem_reserve[]: 0 0 0 0 0 [ 530.088518][T17527] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 530.115497][T17527] lowmem_reserve[]: 0 0 0 0 0 [ 530.121135][T17527] Node 1 Normal free:3947756kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:288kB local_pcp:0kB free_cma:0kB [ 530.152048][T17527] lowmem_reserve[]: 0 0 0 0 0 [ 530.156885][T17527] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 530.170006][T17527] Node 0 DMA32: 6664*4kB (UME) 5233*8kB (UME) 2759*16kB (UME) 1063*32kB (UME) 593*64kB (UME) 289*128kB (UME) 127*256kB (UME) 32*512kB (UME) 2*1024kB (M) 3*2048kB (UME) 266*4096kB (M) = 1368248kB [ 530.190063][T17527] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 530.201858][T17527] Node 1 Normal: 117*4kB (UE) 29*8kB (UE) 27*16kB (UME) 184*32kB (UE) 86*64kB (UME) 24*128kB (UME) 8*256kB (U) 6*512kB (UE) 1*1024kB (E) 3*2048kB (ME) 957*4096kB (M) = 3947756kB [ 530.219808][T17527] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 530.229563][T17527] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 530.239051][T17527] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 530.249047][T17527] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB 03:54:15 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r4, 0xffffffffffffffff, 0x0, 0xfffefffc) ioctl$TUNSETLINK(r1, 0x8912, 0x28) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_int(r1, &(0x7f0000000100)=0x7fff, 0x12) ioctl$TUNSETLINK(r5, 0x8912, 0x400308) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) sendfile(r4, r0, 0x0, 0x100000003) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r4, 0xffffffffffffffff, 0x0, 0xfffefffc) (async) ioctl$TUNSETLINK(r1, 0x8912, 0x28) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) write$cgroup_int(r1, &(0x7f0000000100)=0x7fff, 0x12) (async) ioctl$TUNSETLINK(r5, 0x8912, 0x400308) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async) sendfile(r4, r0, 0x0, 0x100000003) (async) 03:54:15 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x4}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:15 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x42, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:15 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf500800e0e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x68, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:15 executing program 3: ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000480)={0xffffffffffffffff, 0x4, 0xffff, 0x42}) recvmmsg(r0, &(0x7f00000041c0)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000040)=""/45, 0x2d}, {&(0x7f00000003c0)=""/156, 0x9c}], 0x2, &(0x7f00000001c0)=""/15, 0xf}, 0x7fffffff}, {{&(0x7f0000000240)=@l2tp={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000000bc0)=[{&(0x7f0000000600)=""/173, 0xad}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f00000006c0)=""/85, 0x55}, {&(0x7f0000000740)=""/123, 0x7b}, {&(0x7f00000007c0)=""/232, 0xe8}, {&(0x7f00000008c0)=""/153, 0x99}, {&(0x7f0000000980)=""/85, 0x55}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000000b00)=""/139, 0x8b}], 0x9, &(0x7f0000000c80)=""/69, 0x45}, 0x8}, {{0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000000d00)=""/4096, 0x1000}, {&(0x7f0000000340)=""/47, 0x2f}, {&(0x7f0000001d00)=""/134, 0x86}, {&(0x7f0000001dc0)=""/182, 0xb6}, {&(0x7f0000001e80)=""/168, 0xa8}, {&(0x7f0000001f40)=""/217, 0xd9}, {&(0x7f0000000500)=""/11, 0xb}, {&(0x7f0000002040)=""/189, 0xbd}, {&(0x7f0000002100)=""/140, 0x8c}], 0x9, &(0x7f0000002280)=""/62, 0x3e}, 0x136}, {{&(0x7f00000022c0)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000003380)=[{&(0x7f0000002340)=""/4096, 0x1000}, {&(0x7f0000003340)=""/33, 0x21}], 0x2, &(0x7f00000033c0)}, 0x5}, {{&(0x7f0000003400)=@sco={0x1f, @none}, 0x80, &(0x7f00000037c0)=[{&(0x7f0000003480)=""/184, 0xb8}, {&(0x7f0000003540)=""/130, 0x82}, {&(0x7f0000003600)=""/139, 0x8b}, {&(0x7f00000036c0)=""/89, 0x59}, {&(0x7f0000003740)=""/77, 0x4d}], 0x5, &(0x7f0000003840)=""/123, 0x7b}, 0x8000}, {{&(0x7f00000038c0)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000003a40)=[{&(0x7f0000003940)=""/219, 0xdb}], 0x1, &(0x7f0000003a80)=""/57, 0x39}, 0x9}, {{&(0x7f0000003ac0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000004040)=[{&(0x7f0000003b40)=""/100, 0x64}, {&(0x7f0000003bc0)=""/109, 0x6d}, {&(0x7f0000003c40)=""/205, 0xcd}, {&(0x7f0000003d40)=""/62, 0x3e}, {&(0x7f0000003d80)=""/195, 0xc3}, {&(0x7f0000003e80)=""/190, 0xbe}, {&(0x7f0000003f40)=""/71, 0x47}, {&(0x7f0000003fc0)=""/92, 0x5c}], 0x8, &(0x7f00000040c0)=""/251, 0xfb}, 0x6}], 0x7, 0x40010000, &(0x7f0000004380)={0x0, 0x989680}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f0000000000)=0x200000) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r7, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x45}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r7, r4, 0x0, 0x100000004) [ 530.260670][T17527] 18456 total pagecache pages [ 530.265441][T17527] 0 pages in swap cache [ 530.269939][T17527] Swap cache stats: add 0, delete 0, find 0/0 [ 530.276053][T17527] Free swap = 0kB [ 530.280422][T17527] Total swap = 0kB [ 530.284231][T17527] 2097051 pages RAM [ 530.288570][T17527] 0 pages HighMem/MovableOnly [ 530.293594][T17527] 384518 pages reserved [ 530.298045][T17527] 0 pages cma reserved [ 530.347987][T17589] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 530.367649][ T25] kauditd_printk_skb: 130 callbacks suppressed 03:54:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x43, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 530.367666][ T25] audit: type=1804 audit(1640058855.970:4046): pid=17592 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/456/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 530.403821][T17594] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 03:54:16 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r4, 0xffffffffffffffff, 0x0, 0xfffefffc) ioctl$TUNSETLINK(r1, 0x8912, 0x28) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_int(r1, &(0x7f0000000100)=0x7fff, 0x12) ioctl$TUNSETLINK(r5, 0x8912, 0x400308) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) sendfile(r4, r0, 0x0, 0x100000003) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r4, 0xffffffffffffffff, 0x0, 0xfffefffc) (async) ioctl$TUNSETLINK(r1, 0x8912, 0x28) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) write$cgroup_int(r1, &(0x7f0000000100)=0x7fff, 0x12) (async) ioctl$TUNSETLINK(r5, 0x8912, 0x400308) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async) sendfile(r4, r0, 0x0, 0x100000003) (async) [ 530.482535][ T25] audit: type=1800 audit(1640058855.970:4047): pid=17592 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1181 res=0 errno=0 03:54:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x46, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:16 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5000e800e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x6b, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 530.619885][ T25] audit: type=1804 audit(1640058855.970:4048): pid=17592 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/456/memory.events" dev="sda1" ino=1181 res=1 errno=0 03:54:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x48, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 530.721786][ T25] audit: type=1804 audit(1640058856.040:4049): pid=17598 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/445/memory.events" dev="sda1" ino=1182 res=1 errno=0 [ 530.762745][T17626] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 03:54:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x49, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 530.840217][ T25] audit: type=1800 audit(1640058856.040:4050): pid=17598 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1182 res=0 errno=0 03:54:16 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x20000292}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:16 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000400000000000000000000f51e3ad68c40940e3fbbb45c3c00d6a23daa"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:16 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000020e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x4a, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 531.005403][ T25] audit: type=1804 audit(1640058856.050:4051): pid=17598 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/445/memory.events" dev="sda1" ino=1182 res=1 errno=0 [ 531.106969][ T25] audit: type=1804 audit(1640058856.050:4052): pid=17602 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/456/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 531.154361][ T25] audit: type=1800 audit(1640058856.050:4053): pid=17602 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1181 res=0 errno=0 [ 531.198001][ T25] audit: type=1804 audit(1640058856.050:4054): pid=17600 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/456/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 531.231833][ T25] audit: type=1804 audit(1640058856.230:4055): pid=17613 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/457/memory.events" dev="sda1" ino=1162 res=1 errno=0 03:54:16 executing program 3: ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000480)={0xffffffffffffffff, 0x4, 0xffff, 0x42}) recvmmsg(r0, &(0x7f00000041c0)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000040)=""/45, 0x2d}, {&(0x7f00000003c0)=""/156, 0x9c}], 0x2, &(0x7f00000001c0)=""/15, 0xf}, 0x7fffffff}, {{&(0x7f0000000240)=@l2tp={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000000bc0)=[{&(0x7f0000000600)=""/173, 0xad}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f00000006c0)=""/85, 0x55}, {&(0x7f0000000740)=""/123, 0x7b}, {&(0x7f00000007c0)=""/232, 0xe8}, {&(0x7f00000008c0)=""/153, 0x99}, {&(0x7f0000000980)=""/85, 0x55}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000000b00)=""/139, 0x8b}], 0x9, &(0x7f0000000c80)=""/69, 0x45}, 0x8}, {{0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000000d00)=""/4096, 0x1000}, {&(0x7f0000000340)=""/47, 0x2f}, {&(0x7f0000001d00)=""/134, 0x86}, {&(0x7f0000001dc0)=""/182, 0xb6}, {&(0x7f0000001e80)=""/168, 0xa8}, {&(0x7f0000001f40)=""/217, 0xd9}, {&(0x7f0000000500)=""/11, 0xb}, {&(0x7f0000002040)=""/189, 0xbd}, {&(0x7f0000002100)=""/140, 0x8c}], 0x9, &(0x7f0000002280)=""/62, 0x3e}, 0x136}, {{&(0x7f00000022c0)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000003380)=[{&(0x7f0000002340)=""/4096, 0x1000}, {&(0x7f0000003340)=""/33, 0x21}], 0x2, &(0x7f00000033c0)}, 0x5}, {{&(0x7f0000003400)=@sco={0x1f, @none}, 0x80, &(0x7f00000037c0)=[{&(0x7f0000003480)=""/184, 0xb8}, {&(0x7f0000003540)=""/130, 0x82}, {&(0x7f0000003600)=""/139, 0x8b}, {&(0x7f00000036c0)=""/89, 0x59}, {&(0x7f0000003740)=""/77, 0x4d}], 0x5, &(0x7f0000003840)=""/123, 0x7b}, 0x8000}, {{&(0x7f00000038c0)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000003a40)=[{&(0x7f0000003940)=""/219, 0xdb}], 0x1, &(0x7f0000003a80)=""/57, 0x39}, 0x9}, {{&(0x7f0000003ac0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000004040)=[{&(0x7f0000003b40)=""/100, 0x64}, {&(0x7f0000003bc0)=""/109, 0x6d}, {&(0x7f0000003c40)=""/205, 0xcd}, {&(0x7f0000003d40)=""/62, 0x3e}, {&(0x7f0000003d80)=""/195, 0xc3}, {&(0x7f0000003e80)=""/190, 0xbe}, {&(0x7f0000003f40)=""/71, 0x47}, {&(0x7f0000003fc0)=""/92, 0x5c}], 0x8, &(0x7f00000040c0)=""/251, 0xfb}, 0x6}], 0x7, 0x40010000, &(0x7f0000004380)={0x0, 0x989680}) r1 = socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async) ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f0000000000)=0x200000) (async) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r7, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x45}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r7, r4, 0x0, 0x100000004) 03:54:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x4b, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0x117, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:16 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x7ffff000}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:16 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000030e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:17 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x4c, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 531.436763][T17656] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 03:54:17 executing program 3: ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000480)={0xffffffffffffffff, 0x4, 0xffff, 0x42}) recvmmsg(r0, &(0x7f00000041c0)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000040)=""/45, 0x2d}, {&(0x7f00000003c0)=""/156, 0x9c}], 0x2, &(0x7f00000001c0)=""/15, 0xf}, 0x7fffffff}, {{&(0x7f0000000240)=@l2tp={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000000bc0)=[{&(0x7f0000000600)=""/173, 0xad}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f00000006c0)=""/85, 0x55}, {&(0x7f0000000740)=""/123, 0x7b}, {&(0x7f00000007c0)=""/232, 0xe8}, {&(0x7f00000008c0)=""/153, 0x99}, {&(0x7f0000000980)=""/85, 0x55}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000000b00)=""/139, 0x8b}], 0x9, &(0x7f0000000c80)=""/69, 0x45}, 0x8}, {{0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000000d00)=""/4096, 0x1000}, {&(0x7f0000000340)=""/47, 0x2f}, {&(0x7f0000001d00)=""/134, 0x86}, {&(0x7f0000001dc0)=""/182, 0xb6}, {&(0x7f0000001e80)=""/168, 0xa8}, {&(0x7f0000001f40)=""/217, 0xd9}, {&(0x7f0000000500)=""/11, 0xb}, {&(0x7f0000002040)=""/189, 0xbd}, {&(0x7f0000002100)=""/140, 0x8c}], 0x9, &(0x7f0000002280)=""/62, 0x3e}, 0x136}, {{&(0x7f00000022c0)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000003380)=[{&(0x7f0000002340)=""/4096, 0x1000}, {&(0x7f0000003340)=""/33, 0x21}], 0x2, &(0x7f00000033c0)}, 0x5}, {{&(0x7f0000003400)=@sco={0x1f, @none}, 0x80, &(0x7f00000037c0)=[{&(0x7f0000003480)=""/184, 0xb8}, {&(0x7f0000003540)=""/130, 0x82}, {&(0x7f0000003600)=""/139, 0x8b}, {&(0x7f00000036c0)=""/89, 0x59}, {&(0x7f0000003740)=""/77, 0x4d}], 0x5, &(0x7f0000003840)=""/123, 0x7b}, 0x8000}, {{&(0x7f00000038c0)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000003a40)=[{&(0x7f0000003940)=""/219, 0xdb}], 0x1, &(0x7f0000003a80)=""/57, 0x39}, 0x9}, {{&(0x7f0000003ac0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000004040)=[{&(0x7f0000003b40)=""/100, 0x64}, {&(0x7f0000003bc0)=""/109, 0x6d}, {&(0x7f0000003c40)=""/205, 0xcd}, {&(0x7f0000003d40)=""/62, 0x3e}, {&(0x7f0000003d80)=""/195, 0xc3}, {&(0x7f0000003e80)=""/190, 0xbe}, {&(0x7f0000003f40)=""/71, 0x47}, {&(0x7f0000003fc0)=""/92, 0x5c}], 0x8, &(0x7f00000040c0)=""/251, 0xfb}, 0x6}], 0x7, 0x40010000, &(0x7f0000004380)={0x0, 0x989680}) (async, rerun: 32) r1 = socket$netlink(0x10, 0x3, 0x0) (rerun: 32) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async, rerun: 32) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async, rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async, rerun: 32) ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f0000000000)=0x200000) (async, rerun: 32) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r7, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 32) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x45}, 0x0) (async, rerun: 32) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r7, r4, 0x0, 0x100000004) 03:54:17 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x4d, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0x133, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 531.679938][T17671] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 03:54:17 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 32) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000400000000000000000000f51e3ad68c40940e3fbbb45c3c00d6a23daa"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:17 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000005680000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:17 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x4e, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:17 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan1\x00'}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x34, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{}, {}, {}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x34, r0, 0x100, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x7fffffff, 0x49}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000840) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair(0x6, 0x0, 0x9af, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$nl_route(r8, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@setneightbl={0x1c, 0x43, 0x19, 0x70bd2c, 0x25dfdbfe, {0xa}, [@NDTA_THRESH2={0x8, 0x3, 0x768}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400"/20], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000240)={0x4}, 0x4) 03:54:17 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d502122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:17 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0xff0, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:17 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000005680000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:17 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d503122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:17 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0xec, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x2}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 532.255497][T17709] x_tables: duplicate underflow at hook 3 03:54:17 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80020800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:18 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000400000000000000000000f51e3ad68c40940e3fbbb45c3c00d6a23daa"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000400000000000000000000f51e3ad68c40940e3fbbb45c3c00d6a23daa"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:54:18 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d508122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:18 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x790, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:18 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80030800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x3}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:18 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan1\x00'}) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x34, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{}, {}, {}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x34, r0, 0x100, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x7fffffff, 0x49}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000840) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair(0x6, 0x0, 0x9af, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$nl_route(r8, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@setneightbl={0x1c, 0x43, 0x19, 0x70bd2c, 0x25dfdbfe, {0xa}, [@NDTA_THRESH2={0x8, 0x3, 0x768}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400"/20], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r3, r1, 0x0, 0x100000004) (async) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000240)={0x4}, 0x4) 03:54:18 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x2, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:18 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80005600", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:18 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d51c122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:18 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x3, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:19 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r1, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000100)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r0, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r0, 0x0, 0x100000004) 03:54:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x4}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:19 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x4, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:19 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80005600", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:19 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d527122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:19 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x5, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:19 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async, rerun: 64) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r1, 0x0) (async, rerun: 64) r2 = openat$cgroup_ro(r1, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (rerun: 64) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000100)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r0, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r3, r0, 0x0, 0x100000004) 03:54:19 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan1\x00'}) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x34, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{}, {}, {}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x34}}, 0x0) (async) sendmsg$NL80211_CMD_SET_WDS_PEER(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x34, r0, 0x100, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x7fffffff, 0x49}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000840) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair(0x6, 0x0, 0x9af, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$nl_route(r8, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@setneightbl={0x1c, 0x43, 0x19, 0x70bd2c, 0x25dfdbfe, {0xa}, [@NDTA_THRESH2={0x8, 0x3, 0x768}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400"/20], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r3, r1, 0x0, 0x100000004) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000240)={0x4}, 0x4) 03:54:19 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e8000ffff", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:19 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x7fffffe, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:19 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d528122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x5}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:19 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async, rerun: 32) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async, rerun: 32) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r1, 0x0) (async, rerun: 32) r2 = openat$cgroup_ro(r1, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (rerun: 32) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000100)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r0, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async, rerun: 64) sendfile(r3, r0, 0x0, 0x100000004) (rerun: 64) 03:54:19 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d52c122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:19 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x34, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{}, {}, {}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r6, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x6000c011}, 0x20042004) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000000000000030871000000000000000000a836414f56d0533f223c8ff51ea3e1763eefcbfbf5d02e23ac12d371561a57c28acbdcb40a80b30a312d55c6847c8199888c03abc6ea82f39f817df621"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:19 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000802", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x6}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:20 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d544122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:20 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000803", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:20 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r0, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000640)={0xcc, r1, 0xc05, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x40, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3846}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffffffffff43}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5b}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK={0x4c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff7fff}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x20000000}, 0x84) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r4, &(0x7f0000000600)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)=ANY=[@ANYBLOB="8c0000000202010400000000000000000000000408000540000000040800084000000002680001801400018008000100ac14143b08000200e000000106000340000200002a00018014000300fe80000000000000000000000000001914000400fc0000000000000000000000dd000000000000000800010064010102080002007f0000010600034000010000"], 0x8c}, 0x1, 0x0, 0x0, 0x6004c814}, 0x20000000) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x20044040}, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendto$isdn(r3, &(0x7f0000000000)={0x6, 0x9, "de01d6517ef0a48d66972c36005cc27d7103ab4bfcb8b84c962057fcc55a46519cce"}, 0x2a, 0x800, &(0x7f0000000040)={0x22, 0x1, 0x7, 0x72, 0x5}, 0x6) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000e9ffffff0000000000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r6, r2, 0x0, 0x100000004) 03:54:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x7}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 535.425072][ T25] kauditd_printk_skb: 45 callbacks suppressed [ 535.425089][ T25] audit: type=1804 audit(1640058861.030:4101): pid=17818 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/451/memory.events" dev="sda1" ino=1172 res=1 errno=0 [ 535.468653][ T25] audit: type=1800 audit(1640058861.030:4102): pid=17818 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1172 res=0 errno=0 [ 535.497664][ T25] audit: type=1804 audit(1640058861.040:4103): pid=17818 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/451/memory.events" dev="sda1" ino=1172 res=1 errno=0 03:54:21 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x8000000, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:21 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500042fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:21 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x8}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:21 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000880", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:21 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async, rerun: 64) r3 = socket$kcm(0x29, 0x2, 0x0) (rerun: 64) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) (async, rerun: 32) r7 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x34, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{}, {}, {}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x34}}, 0x0) (async) sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r6, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x6000c011}, 0x20042004) (async) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) (async, rerun: 32) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000000000000030871000000000000000000a836414f56d0533f223c8ff51ea3e1763eefcbfbf5d02e23ac12d371561a57c28acbdcb40a80b30a312d55c6847c8199888c03abc6ea82f39f817df621"], 0x14}}, 0x0) (async, rerun: 32) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:21 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d5001204c8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x9}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:21 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e8000080e", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) [ 535.970048][ T25] audit: type=1804 audit(1640058861.580:4104): pid=17837 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/465/memory.events" dev="sda1" ino=1177 res=1 errno=0 03:54:21 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d5001206c8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 536.080188][ T25] audit: type=1800 audit(1640058861.610:4105): pid=17837 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1177 res=0 errno=0 [ 536.163258][ T25] audit: type=1804 audit(1640058861.610:4106): pid=17838 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/465/memory.events" dev="sda1" ino=1177 res=1 errno=0 03:54:22 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r0, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async, rerun: 64) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) (rerun: 64) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000640)={0xcc, r1, 0xc05, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x40, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3846}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffffffffff43}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5b}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK={0x4c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff7fff}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x20000000}, 0x84) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async, rerun: 32) r3 = socket(0x10, 0x803, 0x0) (rerun: 32) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r4, &(0x7f0000000600)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)=ANY=[@ANYBLOB="8c0000000202010400000000000000000000000408000540000000040800084000000002680001801400018008000100ac14143b08000200e000000106000340000200002a00018014000300fe80000000000000000000000000001914000400fc0000000000000000000000dd000000000000000800010064010102080002007f0000010600034000010000"], 0x8c}, 0x1, 0x0, 0x0, 0x6004c814}, 0x20000000) (async) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x20044040}, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async, rerun: 64) sendto$isdn(r3, &(0x7f0000000000)={0x6, 0x9, "de01d6517ef0a48d66972c36005cc27d7103ab4bfcb8b84c962057fcc55a46519cce"}, 0x2a, 0x800, &(0x7f0000000040)={0x22, 0x1, 0x7, 0x72, 0x5}, 0x6) (async, rerun: 64) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000e9ffffff0000000000000000"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r6, r2, 0x0, 0x100000004) 03:54:22 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:22 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x2, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:22 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d5001229c8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:22 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async, rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async, rerun: 64) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x34, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{}, {}, {}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x34}}, 0x0) (async) sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r6, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x6000c011}, 0x20042004) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000000000000030871000000000000000000a836414f56d0533f223c8ff51ea3e1763eefcbfbf5d02e23ac12d371561a57c28acbdcb40a80b30a312d55c6847c8199888c03abc6ea82f39f817df621"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0xe}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:22 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:22 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r0, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000640)={0xcc, r1, 0xc05, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x40, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3846}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffffffffff43}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5b}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK={0x4c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff7fff}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x20000000}, 0x84) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r4, &(0x7f0000000600)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)=ANY=[@ANYBLOB="8c0000000202010400000000000000000000000408000540000000040800084000000002680001801400018008000100ac14143b08000200e000000106000340000200002a00018014000300fe80000000000000000000000000001914000400fc0000000000000000000000dd000000000000000800010064010102080002007f0000010600034000010000"], 0x8c}, 0x1, 0x0, 0x0, 0x6004c814}, 0x20000000) (async) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x20044040}, 0x0) (async) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendto$isdn(r3, &(0x7f0000000000)={0x6, 0x9, "de01d6517ef0a48d66972c36005cc27d7103ab4bfcb8b84c962057fcc55a46519cce"}, 0x2a, 0x800, &(0x7f0000000040)={0x22, 0x1, 0x7, 0x72, 0x5}, 0x6) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000e9ffffff0000000000000000"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r6, r2, 0x0, 0x100000004) [ 536.867946][ T25] audit: type=1804 audit(1640058862.480:4107): pid=17870 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/466/memory.events" dev="sda1" ino=1169 res=1 errno=0 [ 536.936598][ T25] audit: type=1800 audit(1640058862.520:4108): pid=17870 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1169 res=0 errno=0 03:54:22 executing program 3: socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000070600000000000000000f0000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:22 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:22 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x1b0, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:22 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122bc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0xf}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 537.079655][ T25] audit: type=1804 audit(1640058862.520:4109): pid=17870 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/466/memory.events" dev="sda1" ino=1169 res=1 errno=0 03:54:22 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x310, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 537.224380][ T25] audit: type=1800 audit(1640058862.520:4110): pid=17870 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1169 res=0 errno=0 03:54:22 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x3e0, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x60}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:23 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000100)=0x101) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000003c0)={@in6={{0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x7fffffff}}, 0x0, 0x0, 0x41, 0x0, "f8692d9417465c67328ea73709c642ec581a0f0417cf4e54e4ba3ccca5161e9432142ae1f86fc4125382ebf6707f4d348c3ca69fc74f5a299011ceebfe6093771b5f2c6cc608da0f544362db27aed9aa"}, 0xd8) 03:54:23 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e800008aa", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:23 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122cc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:23 executing program 3: socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) (async) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async, rerun: 32) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async, rerun: 32) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000070600000000000000000f0000000000"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:23 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x548, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:23 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x1fffffbf, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:23 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:23 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500123ac8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:23 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e8000087f", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:23 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500123cc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0x2}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:24 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000100)=0x101) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000003c0)={@in6={{0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x7fffffff}}, 0x0, 0x0, 0x41, 0x0, "f8692d9417465c67328ea73709c642ec581a0f0417cf4e54e4ba3ccca5161e9432142ae1f86fc4125382ebf6707f4d348c3ca69fc74f5a299011ceebfe6093771b5f2c6cc608da0f544362db27aed9aa"}, 0xd8) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r1, 0x5452, &(0x7f0000000100)=0x101) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000003c0)={@in6={{0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x7fffffff}}, 0x0, 0x0, 0x41, 0x0, "f8692d9417465c67328ea73709c642ec581a0f0417cf4e54e4ba3ccca5161e9432142ae1f86fc4125382ebf6707f4d348c3ca69fc74f5a299011ceebfe6093771b5f2c6cc608da0f544362db27aed9aa"}, 0xd8) (async) 03:54:24 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0x3}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:24 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a04e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:24 executing program 3: socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) (async) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000070600000000000000000f0000000000"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:24 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x20000678, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:24 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r1, r0, 0x0, 0xfffefffc) r2 = openat$cgroup_ro(r0, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r4, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r5 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) r7 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={0xffffffffffffffff}, 0x4) sendfile(r6, r7, &(0x7f0000000040)=0x80000001, 0xeb5) ioctl$PPPOEIOCDFWD(r2, 0xb101, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x329079cb688da0e6}, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r0) sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000227bd7000fbdbdf250a00000034000380080002008a07000008000100ffff000008000300e874ffff08000100000000000800020002000000080003007f0000001c000980080002000200000008000200ff07000008000200060000001800078008000200cc0000000c00030009000000000000000800068004000200"], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r5, r3, 0x0, 0x100000004) 03:54:24 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:24 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000d80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0x4}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:24 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000100)=0x101) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000003c0)={@in6={{0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x7fffffff}}, 0x0, 0x0, 0x41, 0x0, "f8692d9417465c67328ea73709c642ec581a0f0417cf4e54e4ba3ccca5161e9432142ae1f86fc4125382ebf6707f4d348c3ca69fc74f5a299011ceebfe6093771b5f2c6cc608da0f544362db27aed9aa"}, 0xd8) 03:54:24 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0x7, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:24 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r1, r0, 0x0, 0xfffefffc) (async) r2 = openat$cgroup_ro(r0, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r4, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r5 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 32) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) r7 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={0xffffffffffffffff}, 0x4) sendfile(r6, r7, &(0x7f0000000040)=0x80000001, 0xeb5) (async) ioctl$PPPOEIOCDFWD(r2, 0xb101, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x329079cb688da0e6}, 0x0) (async) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r0) sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000227bd7000fbdbdf250a00000034000380080002008a07000008000100ffff000008000300e874ffff08000100000000000800020002000000080003007f0000001c000980080002000200000008000200ff07000008000200060000001800078008000200cc0000000c00030009000000000000000800068004000200"], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r5, r3, 0x0, 0x100000004) 03:54:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0x5}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:24 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:24 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50200000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:24 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xc7, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:24 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r1, r0, 0x0, 0xfffefffc) r2 = openat$cgroup_ro(r0, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r4, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r5 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) r7 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={0xffffffffffffffff}, 0x4) sendfile(r6, r7, &(0x7f0000000040)=0x80000001, 0xeb5) ioctl$PPPOEIOCDFWD(r2, 0xb101, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x329079cb688da0e6}, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r0) sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000227bd7000fbdbdf250a00000034000380080002008a07000008000100ffff000008000300e874ffff08000100000000000800020002000000080003007f0000001c000980080002000200000008000200ff07000008000200060000001800078008000200cc0000000c00030009000000000000000800068004000200"], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r5, r3, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r1, r0, 0x0, 0xfffefffc) (async) openat$cgroup_ro(r0, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r4, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={0xffffffffffffffff}, 0x4) (async) sendfile(r6, r7, &(0x7f0000000040)=0x80000001, 0xeb5) (async) ioctl$PPPOEIOCDFWD(r2, 0xb101, 0x0) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14, 0x7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x329079cb688da0e6}, 0x0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r0) (async) sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000227bd7000fbdbdf250a00000034000380080002008a07000008000100ffff000008000300e874ffff08000100000000000800020002000000080003007f0000001c000980080002000200000008000200ff07000008000200060000001800078008000200cc0000000c00030009000000000000000800068004000200"], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r5, r3, 0x0, 0x100000004) (async) 03:54:25 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50300000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0x6}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:25 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xc8, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:25 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:25 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = socket(0x1a, 0xa, 0x80) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24004040}, 0x44040) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r0, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="142000000700ff00000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:25 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed, 0x4, 0x2}, 0xe) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000000), 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffffffffffffd) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='memory.events\x00', 0xb00000000065808, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) ioctl$FITRIM(r3, 0xc0185879, &(0x7f0000000000)={0x3, 0x800}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x7a05, 0x1700) pwritev(r4, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r5 = socket$kcm(0x29, 0x2, 0x0) openat$cgroup_ro(r4, &(0x7f0000000140)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1800000007060000000000000000000000000000aa184c771c694fd051c291a2f7a73b1916a5e8f366b9c0424d6d910997611527e26b88d6afed0fd49288ecd1e72a1a8464bead934371ca41375e681604e71bd0402deaf244154e6381c478499ed763e5c657c45b4924bfd826ffd7e0c2fed674582e446077b06f404274543392bf46415e7a1b105fa99f8a1c1067069a0650b7b4731381a890efca87d7270179f797b16f11270000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r5, r2, 0x0, 0x100000004) 03:54:25 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xdd, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:25 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:25 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50800000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0x7}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:25 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0x1b0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:25 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed, 0x4, 0x2}, 0xe) (async) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000000), 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffffffffffffd) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='memory.events\x00', 0xb00000000065808, 0x0) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) ioctl$FITRIM(r3, 0xc0185879, &(0x7f0000000000)={0x3, 0x800}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x7a05, 0x1700) pwritev(r4, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r5 = socket$kcm(0x29, 0x2, 0x0) openat$cgroup_ro(r4, &(0x7f0000000140)='cpuset.effective_mems\x00', 0x0, 0x0) (async) ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1800000007060000000000000000000000000000aa184c771c694fd051c291a2f7a73b1916a5e8f366b9c0424d6d910997611527e26b88d6afed0fd49288ecd1e72a1a8464bead934371ca41375e681604e71bd0402deaf244154e6381c478499ed763e5c657c45b4924bfd826ffd7e0c2fed674582e446077b06f404274543392bf46415e7a1b105fa99f8a1c1067069a0650b7b4731381a890efca87d7270179f797b16f11270000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r5, r2, 0x0, 0x100000004) 03:54:25 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:25 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf51c00000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:25 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0x310, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:25 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0x8}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:26 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed, 0x4, 0x2}, 0xe) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000000), 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffffffffffffd) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='memory.events\x00', 0xb00000000065808, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) ioctl$FITRIM(r3, 0xc0185879, &(0x7f0000000000)={0x3, 0x800}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x7a05, 0x1700) pwritev(r4, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r5 = socket$kcm(0x29, 0x2, 0x0) openat$cgroup_ro(r4, &(0x7f0000000140)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1800000007060000000000000000000000000000aa184c771c694fd051c291a2f7a73b1916a5e8f366b9c0424d6d910997611527e26b88d6afed0fd49288ecd1e72a1a8464bead934371ca41375e681604e71bd0402deaf244154e6381c478499ed763e5c657c45b4924bfd826ffd7e0c2fed674582e446077b06f404274543392bf46415e7a1b105fa99f8a1c1067069a0650b7b4731381a890efca87d7270179f797b16f11270000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r5, r2, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async) bind$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed, 0x4, 0x2}, 0xe) (async) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000000), 0x2) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffffffffffffd) (async) openat$cgroup_ro(r1, &(0x7f0000000100)='memory.events\x00', 0xb00000000065808, 0x0) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) ioctl$FITRIM(r3, 0xc0185879, &(0x7f0000000000)={0x3, 0x800}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x7a05, 0x1700) (async) pwritev(r4, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) openat$cgroup_ro(r4, &(0x7f0000000140)='cpuset.effective_mems\x00', 0x0, 0x0) (async) ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1800000007060000000000000000000000000000aa184c771c694fd051c291a2f7a73b1916a5e8f366b9c0424d6d910997611527e26b88d6afed0fd49288ecd1e72a1a8464bead934371ca41375e681604e71bd0402deaf244154e6381c478499ed763e5c657c45b4924bfd826ffd7e0c2fed674582e446077b06f404274543392bf46415e7a1b105fa99f8a1c1067069a0650b7b4731381a890efca87d7270179f797b16f11270000000000"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r5, r2, 0x0, 0x100000004) (async) 03:54:26 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) (async) r3 = socket(0x1a, 0xa, 0x80) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24004040}, 0x44040) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r0, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="142000000700ff00000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:26 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0x3e0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:26 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x56}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:26 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf52700000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:26 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0x548, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:26 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = socket(0xb, 0x1, 0x7) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r3, r4, &(0x7f0000000100)=0x8001, 0xfffffffffffffc00) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r5, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)={0xfc, 0x0, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0xe8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'netdevsim0\x00'}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x978}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x200}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x80, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x4040010) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x8000, 0x12) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000700000000020000000000000000809300001a20a0e952631dc92d40a6b10008c8e0eb58f4cb06e2f0ac21e90eb6737f41b326c0ab761a8ae3"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) [ 541.195811][ T25] kauditd_printk_skb: 150 callbacks suppressed [ 541.195826][ T25] audit: type=1804 audit(1640058866.800:4261): pid=18081 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/471/memory.events" dev="sda1" ino=1182 res=1 errno=0 03:54:26 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0x7, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 541.318366][ T25] audit: type=1800 audit(1640058866.860:4262): pid=18081 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1182 res=0 errno=0 03:54:27 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf52800000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0x9}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:27 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2000002c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:27 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xc7, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 541.470738][ T25] audit: type=1804 audit(1640058866.860:4263): pid=18082 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/471/memory.events" dev="sda1" ino=1182 res=1 errno=0 03:54:27 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xc8, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 541.615324][ T25] audit: type=1804 audit(1640058866.950:4264): pid=18090 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/463/memory.events" dev="sda1" ino=1177 res=1 errno=0 [ 541.745143][ T25] audit: type=1800 audit(1640058866.950:4265): pid=18090 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1177 res=0 errno=0 [ 541.804309][ T25] audit: type=1804 audit(1640058866.950:4266): pid=18090 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/463/memory.events" dev="sda1" ino=1177 res=1 errno=0 03:54:27 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) (async, rerun: 32) r3 = socket(0x1a, 0xa, 0x80) (rerun: 32) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24004040}, 0x44040) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r0, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="142000000700ff00000000"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:54:27 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf52c00000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:27 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x7fffefee}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0xe}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:27 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xdd, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 542.272516][ T25] audit: type=1804 audit(1640058867.880:4267): pid=18117 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/472/memory.events" dev="sda1" ino=1182 res=1 errno=0 [ 542.354343][ T25] audit: type=1800 audit(1640058867.880:4268): pid=18117 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1182 res=0 errno=0 [ 542.449236][ T25] audit: type=1804 audit(1640058867.880:4269): pid=18116 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/472/memory.events" dev="sda1" ino=1182 res=1 errno=0 03:54:28 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async, rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (rerun: 64) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = socket(0xb, 0x1, 0x7) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r3, r4, &(0x7f0000000100)=0x8001, 0xfffffffffffffc00) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r5, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)={0xfc, 0x0, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0xe8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'netdevsim0\x00'}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x978}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x200}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x80, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x4040010) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x8000, 0x12) (async, rerun: 32) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 32) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000700000000020000000000000000809300001a20a0e952631dc92d40a6b10008c8e0eb58f4cb06e2f0ac21e90eb6737f41b326c0ab761a8ae3"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:28 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0x1b0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:28 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf54400000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:28 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a756c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0xf}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:28 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0x310, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 542.660365][ T25] audit: type=1804 audit(1640058868.270:4270): pid=18134 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/464/memory.events" dev="sda1" ino=1177 res=1 errno=0 03:54:28 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x12}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:28 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = accept4$x25(r0, &(0x7f0000000100), &(0x7f0000000140)=0x12, 0x40800) r5 = openat$cgroup(r1, &(0x7f0000000180)='syz1\x00', 0x200002, 0x0) sendfile(r4, r5, 0x0, 0x5) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) sendfile(r6, r3, &(0x7f00000001c0)=0x1, 0x4) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x4, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:28 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0x3e0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:28 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50003000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x0, 0x60}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:28 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x56}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:28 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async, rerun: 32) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async, rerun: 64) r2 = socket$kcm(0x29, 0x2, 0x0) (async, rerun: 64) r3 = socket(0xb, 0x1, 0x7) (async, rerun: 32) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async, rerun: 32) sendfile(r3, r4, &(0x7f0000000100)=0x8001, 0xfffffffffffffc00) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r5, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)={0xfc, 0x0, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0xe8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'netdevsim0\x00'}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x978}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x200}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x80, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x4040010) (async) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x8000, 0x12) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 32) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000700000000020000000000000000809300001a20a0e952631dc92d40a6b10008c8e0eb58f4cb06e2f0ac21e90eb6737f41b326c0ab761a8ae3"], 0x14}}, 0x0) (rerun: 32) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:54:28 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0x548, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:29 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x20000204}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:29 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5800e000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:29 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0x7, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:29 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000000000000000100000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:30 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async, rerun: 64) r2 = socket$kcm(0x29, 0x2, 0x0) (rerun: 64) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = accept4$x25(r0, &(0x7f0000000100), &(0x7f0000000140)=0x12, 0x40800) (async) r5 = openat$cgroup(r1, &(0x7f0000000180)='syz1\x00', 0x200002, 0x0) sendfile(r4, r5, 0x0, 0x5) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async, rerun: 32) sendfile(r6, r3, &(0x7f00000001c0)=0x1, 0x4) (async, rerun: 32) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async, rerun: 64) sendfile(r0, r3, &(0x7f0000000040)=0x4, 0x400) (async, rerun: 64) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:30 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x20000284}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:30 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xc7, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:30 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5001c000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x2}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:30 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xc8, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:30 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x7fffefc2}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:30 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50027000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:30 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xdd, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x3}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:30 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0x1b0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:30 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000000000000000100000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:54:31 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = accept4$x25(r0, &(0x7f0000000100), &(0x7f0000000140)=0x12, 0x40800) (async) r5 = openat$cgroup(r1, &(0x7f0000000180)='syz1\x00', 0x200002, 0x0) sendfile(r4, r5, 0x0, 0x5) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r6, 0x8912, 0x400308) (async) sendfile(r6, r3, &(0x7f00000001c0)=0x1, 0x4) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x4, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:54:31 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="562b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:31 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50028000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:31 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0x310, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x4}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:31 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0x3e0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:31 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5002c000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:31 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0x548, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:31 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="335607d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:31 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000380)='blkio.bfq.io_serviced_recursive\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r4 = socket$kcm(0x29, 0x0, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x4010, r3, 0x2b147000) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r5, 0x8912, 0x400308) sendfile(r2, r5, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x13) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="10002dbd7000fcdbdf253b0000000c0099000200000039000000080057002709000004006c00080027000200000008009f000500000008002201c9000000050018012200000008002201dd00000008009f0004000000050018011a00000005001901080000000400870004006c00d8934331ecdf9679a68960cd472947f57dd2f0bcc353468023885d820b62a090d771f7cf929ad1b7d9e2300ff5b0f9ca5af3dbdcbc0f5630a3b74999a51d34ce23d147"], 0x74}, 0x1, 0x0, 0x0, 0x810}, 0x40) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x5c) sendfile(r4, r2, 0x0, 0x100000004) 03:54:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x5}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:31 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000000000000000100000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000007060000000000000000100000000000"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:54:31 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:31 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b56d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:31 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50044000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x6}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:31 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r0, 0x0) (async) r1 = openat$cgroup_ro(r0, &(0x7f0000000380)='blkio.bfq.io_serviced_recursive\x00', 0x26e1, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r4 = socket$kcm(0x29, 0x0, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x4010, r3, 0x2b147000) (async) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r5, 0x8912, 0x400308) (async) sendfile(r2, r5, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) r6 = socket$netlink(0x10, 0x3, 0x13) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="10002dbd7000fcdbdf253b0000000c0099000200000039000000080057002709000004006c00080027000200000008009f000500000008002201c9000000050018012200000008002201dd00000008009f0004000000050018011a00000005001901080000000400870004006c00d8934331ecdf9679a68960cd472947f57dd2f0bcc353468023885d820b62a090d771f7cf929ad1b7d9e2300ff5b0f9ca5af3dbdcbc0f5630a3b74999a51d34ce23d147"], 0x74}, 0x1, 0x0, 0x0, 0x810}, 0x40) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x5c) (async) sendfile(r4, r2, 0x0, 0x100000004) 03:54:31 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x2, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 546.330531][ T25] kauditd_printk_skb: 223 callbacks suppressed [ 546.330547][ T25] audit: type=1804 audit(1640058871.940:4494): pid=18266 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/468/memory.events" dev="sda1" ino=1182 res=1 errno=0 [ 546.365159][ T25] audit: type=1800 audit(1640058871.940:4495): pid=18266 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1182 res=0 errno=0 03:54:32 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:32 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50e80000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x7}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 546.453426][ T25] audit: type=1804 audit(1640058871.970:4496): pid=18266 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/468/memory.events" dev="sda1" ino=1182 res=1 errno=0 03:54:32 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d956966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) [ 546.541077][ T25] audit: type=1804 audit(1640058872.120:4497): pid=18278 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/468/memory.events" dev="sda1" ino=1182 res=1 errno=0 03:54:32 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0x548, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:32 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x4, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:32 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[], 0x208e24b) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r0, 0x0) (async, rerun: 64) r1 = openat$cgroup_ro(r0, &(0x7f0000000380)='blkio.bfq.io_serviced_recursive\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r4 = socket$kcm(0x29, 0x0, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x4010, r3, 0x2b147000) (async, rerun: 64) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 64) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r5, 0x8912, 0x400308) (async) sendfile(r2, r5, &(0x7f0000000040)=0x3, 0x400) (async, rerun: 32) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async, rerun: 32) r6 = socket$netlink(0x10, 0x3, 0x13) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="10002dbd7000fcdbdf253b0000000c0099000200000039000000080057002709000004006c00080027000200000008009f000500000008002201c9000000050018012200000008002201dd00000008009f0004000000050018011a00000005001901080000000400870004006c00d8934331ecdf9679a68960cd472947f57dd2f0bcc353468023885d820b62a090d771f7cf929ad1b7d9e2300ff5b0f9ca5af3dbdcbc0f5630a3b74999a51d34ce23d147"], 0x74}, 0x1, 0x0, 0x0, 0x810}, 0x40) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x5c) sendfile(r4, r2, 0x0, 0x100000004) [ 546.666329][ T25] audit: type=1800 audit(1640058872.120:4498): pid=18278 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1182 res=0 errno=0 03:54:32 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000005280000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:32 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x6, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:32 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c563d061d18311bc2d7e24356a2", 0x14}], 0x56) [ 546.718240][T18295] Cannot find add_set index 0 as target 03:54:32 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = socket(0xb, 0x1, 0x7) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r3, r4, &(0x7f0000000100)=0x8001, 0xfffffffffffffc00) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r5, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)={0xfc, 0x0, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0xe8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'netdevsim0\x00'}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x978}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x200}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x80, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x4040010) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x8000, 0x12) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000700000000020000000000000000809300001a20a0e952631dc92d40a6b10008c8e0eb58f4cb06e2f0ac21e90eb6737f41b326c0ab761a8ae3"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:32 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='memory.swap.current\x00', 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="147f00f3ff1d77acad38f62a038c5cf3df991c989be7972625ebc49313efff552e18ed45b058bbf787797d5e30e774049198b37057c7f4c2254f1f8d1855ac34c2d0d36042f98c47bab3c5807918b8704e07af71c7782cf70da3aa9b387c1b45e2f5fba9002592e6bd4d47"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xb) sendfile(r2, r0, 0x0, 0x100000004) write$binfmt_misc(r1, &(0x7f0000000300)={'syz0', "4d4909647077fb10abc63beab61acb2fd369f65b23148e22c337cc7e21b23ce83421d4747837d3be1b01cb5ac65a3d182fa4010fd1c0a8d7d7467f9cfa0be57a8c27e7da3335b02863c1b04943f832133b7898b05b9833e8113b20442571877c6fb359ddbd7a82f17b516441a93fbfc707df241c65535181eea6244b5c08ffe05357c3b0ac145d2a599057b8364675b1244a99727e"}, 0x99) 03:54:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x8}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:32 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x7, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 546.910326][ T25] audit: type=1804 audit(1640058872.520:4499): pid=18313 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/470/memory.events" dev="sda1" ino=1155 res=1 errno=0 03:54:32 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x10, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x9}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 547.043243][ T25] audit: type=1800 audit(1640058872.580:4500): pid=18313 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=1155 res=0 errno=0 03:54:32 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000028080000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:32 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x12, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 547.116066][ T25] audit: type=1804 audit(1640058872.580:4501): pid=18320 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/470/memory.events" dev="sda1" ino=1155 res=1 errno=0 03:54:32 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c1456061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:32 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x2c, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 547.229086][ T25] audit: type=1804 audit(1640058872.630:4502): pid=18324 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/479/memory.events" dev="sda1" ino=1182 res=1 errno=0 [ 547.360473][ T25] audit: type=1800 audit(1640058872.630:4503): pid=18324 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1182 res=0 errno=0 03:54:33 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3d, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:33 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf52000029280000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:33 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c1456061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:33 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='memory.swap.current\x00', 0x0, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="147f00f3ff1d77acad38f62a038c5cf3df991c989be7972625ebc49313efff552e18ed45b058bbf787797d5e30e774049198b37057c7f4c2254f1f8d1855ac34c2d0d36042f98c47bab3c5807918b8704e07af71c7782cf70da3aa9b387c1b45e2f5fba9002592e6bd4d47"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xb) sendfile(r2, r0, 0x0, 0x100000004) (async) write$binfmt_misc(r1, &(0x7f0000000300)={'syz0', "4d4909647077fb10abc63beab61acb2fd369f65b23148e22c337cc7e21b23ce83421d4747837d3be1b01cb5ac65a3d182fa4010fd1c0a8d7d7467f9cfa0be57a8c27e7da3335b02863c1b04943f832133b7898b05b9833e8113b20442571877c6fb359ddbd7a82f17b516441a93fbfc707df241c65535181eea6244b5c08ffe05357c3b0ac145d2a599057b8364675b1244a99727e"}, 0x99) 03:54:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0xe}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:33 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d561d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:33 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x4c, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:33 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf57fffffff80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:33 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x66, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:33 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = socket(0xb, 0x1, 0x7) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r3, r4, &(0x7f0000000100)=0x8001, 0xfffffffffffffc00) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r5, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)={0xfc, 0x0, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0xe8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'netdevsim0\x00'}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x978}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x200}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x80, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x4040010) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x8000, 0x12) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000700000000020000000000000000809300001a20a0e952631dc92d40a6b10008c8e0eb58f4cb06e2f0ac21e90eb6737f41b326c0ab761a8ae3"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:33 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50002000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:33 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='memory.swap.current\x00', 0x0, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="147f00f3ff1d77acad38f62a038c5cf3df991c989be7972625ebc49313efff552e18ed45b058bbf787797d5e30e774049198b37057c7f4c2254f1f8d1855ac34c2d0d36042f98c47bab3c5807918b8704e07af71c7782cf70da3aa9b387c1b45e2f5fba9002592e6bd4d47"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xb) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) write$binfmt_misc(r1, &(0x7f0000000300)={'syz0', "4d4909647077fb10abc63beab61acb2fd369f65b23148e22c337cc7e21b23ce83421d4747837d3be1b01cb5ac65a3d182fa4010fd1c0a8d7d7467f9cfa0be57a8c27e7da3335b02863c1b04943f832133b7898b05b9833e8113b20442571877c6fb359ddbd7a82f17b516441a93fbfc707df241c65535181eea6244b5c08ffe05357c3b0ac145d2a599057b8364675b1244a99727e"}, 0x99) 03:54:33 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d065618311bc2d7e24356a2", 0x14}], 0x56) 03:54:33 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x70, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0xf}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:33 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x74, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:34 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50003000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:34 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x8a, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:34 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d56311bc2d7e24356a2", 0x14}], 0x56) 03:54:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x60}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:34 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x8c, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:34 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0x548, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:34 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50008000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:34 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='hugetlb.2MB.usage_in_bytes\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:34 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18561bc2d7e24356a2", 0x14}], 0x56) 03:54:34 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0xd0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:35 executing program 3: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000d80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 549.347330][T18404] Cannot find add_set index 0 as target 03:54:35 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0xd2, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:35 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5001c000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:35 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='hugetlb.2MB.usage_in_bytes\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async, rerun: 64) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async, rerun: 64) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:35 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d183156c2d7e24356a2", 0x14}], 0x56) 03:54:35 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0xe8, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0x2}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:35 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='hugetlb.2MB.usage_in_bytes\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='hugetlb.2MB.usage_in_bytes\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:54:35 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0xec, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:35 executing program 3: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000100)=0x101) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000003c0)={@in6={{0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x7fffffff}}, 0x0, 0x0, 0x41, 0x0, "f8692d9417465c67328ea73709c642ec581a0f0417cf4e54e4ba3ccca5161e9432142ae1f86fc4125382ebf6707f4d348c3ca69fc74f5a299011ceebfe6093771b5f2c6cc608da0f544362db27aed9aa"}, 0xd8) 03:54:35 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50027000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:35 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0xf8, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:35 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e25656a2", 0x14}], 0x56) 03:54:35 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14a834ff2aa6ea3e2ae4f1560000000000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:35 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x110, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0x3}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:35 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x11e, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:35 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50028000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:35 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24302a2", 0x14}], 0x56) 03:54:35 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x13a, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:35 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5002c000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:36 executing program 3: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d544122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0x4}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:36 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24303a2", 0x14}], 0x56) 03:54:36 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x15d, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:36 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50044000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:36 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14a834ff2aa6ea3e2ae4f1560000000000000000"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:54:36 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x161, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:36 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24304a2", 0x14}], 0x56) 03:54:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0x5}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:36 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x178, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:36 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000030e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:36 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000802", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x56) 03:54:36 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x183, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:37 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24305a2", 0x14}], 0x56) 03:54:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0x6}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:37 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x188, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:37 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf500800e0e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:37 executing program 3: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d508122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:37 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14a834ff2aa6ea3e2ae4f1560000000000000000"], 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14a834ff2aa6ea3e2ae4f1560000000000000000"], 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:54:37 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x18a, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0x7}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:37 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf500001c0e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:37 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24306a2", 0x14}], 0x56) 03:54:37 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x190, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 552.166299][ T25] kauditd_printk_skb: 24 callbacks suppressed [ 552.166315][ T25] audit: type=1804 audit(1640058877.770:4528): pid=18542 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/487/memory.events" dev="sda1" ino=1161 res=1 errno=0 03:54:37 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1a2, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:37 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24307a2", 0x14}], 0x56) 03:54:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0x8}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 552.256281][ T25] audit: type=1800 audit(1640058877.770:4529): pid=18542 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1161 res=0 errno=0 03:54:37 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000270e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 552.353778][T18541] warn_alloc: 6 callbacks suppressed [ 552.353795][T18541] syz-executor.1: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) 03:54:38 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1a6, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:38 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1a2, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 552.380781][ T25] audit: type=1804 audit(1640058877.800:4530): pid=18542 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/487/memory.events" dev="sda1" ino=1161 res=1 errno=0 [ 552.485223][T18566] Cannot find add_set index 0 as target [ 552.486720][ T25] audit: type=1804 audit(1640058877.930:4531): pid=18550 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/487/memory.events" dev="sda1" ino=1161 res=1 errno=0 [ 552.518699][ T25] audit: type=1804 audit(1640058877.940:4532): pid=18551 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/487/memory.events" dev="sda1" ino=1161 res=1 errno=0 [ 552.570004][T18541] ,cpuset=syz1,mems_allowed=0-1 [ 552.608032][T18541] CPU: 1 PID: 18541 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0 [ 552.616829][T18541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 552.626898][T18541] Call Trace: [ 552.630181][T18541] [ 552.633120][T18541] dump_stack_lvl+0xcd/0x134 [ 552.637729][T18541] warn_alloc.cold+0x87/0x17a [ 552.642419][T18541] ? zone_watermark_ok_safe+0x290/0x290 [ 552.647971][T18541] ? __kmalloc_node+0x62/0x390 [ 552.652772][T18541] ? __vmalloc_node_range+0x574/0xab0 [ 552.658163][T18541] __vmalloc_node_range+0x883/0xab0 [ 552.663397][T18541] ? vfree_atomic+0xe0/0xe0 [ 552.667919][T18541] ? rcu_read_lock_sched_held+0x3a/0x70 [ 552.672937][ T25] audit: type=1800 audit(1640058877.950:4533): pid=18550 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1161 res=0 errno=0 [ 552.673477][T18541] ? kernel_clone+0xe7/0xab0 [ 552.673503][T18541] copy_process+0x926/0x75a0 [ 552.704398][T18541] ? kernel_clone+0xe7/0xab0 [ 552.708978][T18541] ? lock_chain_count+0x20/0x20 [ 552.713813][T18541] ? lock_chain_count+0x20/0x20 [ 552.718669][T18541] ? find_held_lock+0x2d/0x110 [ 552.723420][T18541] ? __cleanup_sighand+0xb0/0xb0 [ 552.728339][T18541] ? lock_downgrade+0x6e0/0x6e0 [ 552.733183][T18541] ? __lock_acquire+0x162f/0x54a0 [ 552.738195][T18541] ? kernel_clone+0x314/0xab0 [ 552.742855][T18541] kernel_clone+0xe7/0xab0 [ 552.747262][T18541] ? create_io_thread+0xf0/0xf0 [ 552.752100][T18541] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 552.758068][T18541] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 552.764042][T18541] ? find_held_lock+0x2d/0x110 [ 552.768793][T18541] __do_sys_clone+0xc8/0x110 [ 552.773379][T18541] ? kernel_clone+0xab0/0xab0 [ 552.778038][T18541] ? lock_downgrade+0x6e0/0x6e0 [ 552.783028][T18541] ? syscall_enter_from_user_mode+0x21/0x70 [ 552.788913][T18541] do_syscall_64+0x35/0xb0 [ 552.793317][T18541] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 552.799360][T18541] RIP: 0033:0x7ff9386e42c1 [ 552.803771][T18541] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 552.823973][T18541] RSP: 002b:00007fff499d84b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 552.832418][T18541] RAX: ffffffffffffffda RBX: 00007ff936f2f700 RCX: 00007ff9386e42c1 [ 552.840378][T18541] RDX: 00007ff936f2f9d0 RSI: 00007ff936f2f2f0 RDI: 00000000003d0f00 [ 552.848333][T18541] RBP: 00007fff499d8700 R08: 00007ff936f2f700 R09: 00007ff936f2f700 [ 552.856290][T18541] R10: 00007ff936f2f9d0 R11: 0000000000000206 R12: 00007fff499d856e [ 552.864262][T18541] R13: 00007fff499d856f R14: 00007ff936f2f300 R15: 0000000000022000 [ 552.872263][T18541] [ 552.887814][T18541] Mem-Info: [ 552.890944][T18541] active_anon:921 inactive_anon:80353 isolated_anon:0 [ 552.890944][T18541] active_file:8204 inactive_file:36120 isolated_file:0 [ 552.890944][T18541] unevictable:768 dirty:43 writeback:0 [ 552.890944][T18541] slab_reclaimable:20329 slab_unreclaimable:121839 [ 552.890944][T18541] mapped:28029 shmem:2585 pagetables:680 bounce:0 [ 552.890944][T18541] kernel_misc_reclaimable:0 [ 552.890944][T18541] free:1336646 free_pcp:7242 free_cma:0 [ 552.933583][T18541] Node 0 active_anon:3672kB inactive_anon:320492kB active_file:32744kB inactive_file:144480kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:112116kB dirty:168kB writeback:0kB shmem:7872kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 362496kB writeback_tmp:0kB kernel_stack:10772kB pagetables:2716kB all_unreclaimable? no [ 552.967323][T18541] Node 1 active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:2468kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:4kB all_unreclaimable? no [ 552.999298][T18541] Node 0 DMA free:15360kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 553.027725][T18541] lowmem_reserve[]: 0 2645 2645 2645 2645 [ 553.033624][T18541] Node 0 DMA32 free:1383216kB boost:0kB min:35676kB low:44592kB high:53508kB reserved_highatomic:0KB active_anon:3672kB inactive_anon:320492kB active_file:32744kB inactive_file:144480kB unevictable:1536kB writepending:168kB present:3129332kB managed:2716752kB mlocked:0kB bounce:0kB free_pcp:28964kB local_pcp:9540kB free_cma:0kB [ 553.065274][T18541] lowmem_reserve[]: 0 0 0 0 0 [ 553.070097][T18541] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 553.096939][T18541] lowmem_reserve[]: 0 0 0 0 0 [ 553.103375][T18541] Node 1 Normal free:3948008kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:36kB local_pcp:36kB free_cma:0kB [ 553.132644][T18541] lowmem_reserve[]: 0 0 0 0 0 [ 553.137457][T18541] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 553.150199][T18541] Node 0 DMA32: 6738*4kB (UME) 3711*8kB (UME) 2965*16kB (UME) 1763*32kB (UME) 607*64kB (UME) 249*128kB (UME) 126*256kB (UME) 35*512kB (UME) 2*1024kB (M) 3*2048kB (UME) 267*4096kB (M) = 1383216kB [ 553.170237][T18541] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 553.181859][T18541] Node 1 Normal: 152*4kB (UE) 35*8kB (UE) 27*16kB (UME) 184*32kB (UE) 87*64kB (UME) 24*128kB (UME) 8*256kB (U) 6*512kB (UE) 1*1024kB (E) 3*2048kB (ME) 957*4096kB (M) = 3948008kB [ 553.199868][T18541] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 553.211127][T18541] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 553.220511][T18541] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 553.230119][T18541] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 553.239748][T18541] 18519 total pagecache pages [ 553.244426][T18541] 0 pages in swap cache [ 553.248653][T18541] Swap cache stats: add 0, delete 0, find 0/0 [ 553.254806][T18541] Free swap = 0kB 03:54:38 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14, 0x7, 0x6, 0x5}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:38 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r6, r4, 0x0, 0x100000004) 03:54:38 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24308a2", 0x14}], 0x56) 03:54:38 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1d7, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0x9}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:38 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000280e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 553.258961][T18541] Total swap = 0kB [ 553.262684][T18541] 2097051 pages RAM [ 553.266474][T18541] 0 pages HighMem/MovableOnly [ 553.271221][T18541] 384518 pages reserved [ 553.275370][T18541] 0 pages cma reserved 03:54:38 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1dc, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 553.333985][T18580] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 553.369316][ T25] audit: type=1804 audit(1640058878.980:4534): pid=18582 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/488/memory.events" dev="sda1" ino=1181 res=1 errno=0 [ 553.458906][ T25] audit: type=1800 audit(1640058879.010:4535): pid=18582 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1181 res=0 errno=0 03:54:39 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf500002c0e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:39 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1e8, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:39 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24309a2", 0x14}], 0x56) 03:54:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0xe}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 553.543733][ T25] audit: type=1804 audit(1640058879.010:4536): pid=18582 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/488/memory.events" dev="sda1" ino=1181 res=1 errno=0 03:54:39 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1ee, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 553.707584][ T25] audit: type=1804 audit(1640058879.110:4537): pid=18580 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir135504159/syzkaller.9MY1hR/480/memory.events" dev="sda1" ino=1182 res=1 errno=0 03:54:39 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14, 0x7, 0x6, 0x5}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14, 0x7, 0x6, 0x5}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:54:40 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r6, r4, 0x0, 0x100000004) 03:54:40 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1f2, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:40 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000440e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:40 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2430aa2", 0x14}], 0x56) 03:54:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0xf}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:40 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x210, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {0x0, 0x60}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 554.557131][T18627] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 03:54:40 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x213, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:40 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async, rerun: 64) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14, 0x7, 0x6, 0x5}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:40 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2430ba2", 0x14}], 0x56) 03:54:40 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x220, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:40 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf5000e800e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:41 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x252, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:41 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000d80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:41 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2430ca2", 0x14}], 0x56) 03:54:41 executing program 1: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@getchain={0x34, 0x66, 0x4, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff3, 0x8}, {0xffee, 0xf}}, [{0x8, 0xb, 0xffff7fff}, {0x8, 0xb, 0x8001}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000000}, 0x4041) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="1400ec0007054600000000dd1c932a23b938065589d400000000000000006f90ad473a6cbbcc6f2dc71c6ce2501616edefbbe7905e90493b0c8cd9fa80d8c4e297b8e9359dadceb40be43e8f545b786537c3f2ff396a6d2ff3fa4befd1884f8d7dbb70bc1f1162c87e7ee6f9ae1297c10a9a4bd4ffb6c778b57a07222ced12bbb2fdbbbca31632587aa9e58518f3ed2b313fe4b9cf3f25199e9979d058f7f9e523d6ba9648a8a7eaef4e750b9c485f5b4a4c5317203eab79500bf850f1114c162baa2a1979bbe5513b5afc747c3033e01a85de4c9c7cba1756a831344748"], 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000100)={0x7bc, 0x7, 0x77, 0xff, 0x7e, 0x7, 0x224b}, 0xc) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES16=r0], 0x14}}, 0x24000080) getsockname$packet(0xffffffffffffffff, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000480)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:41 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r5, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000080)=0xae) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r6, r4, 0x0, 0x100000004) 03:54:41 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x25b, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 555.725080][T18669] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 03:54:41 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x278, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x2}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:41 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000020e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:41 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2430da2", 0x14}], 0x56) 03:54:41 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x286, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:42 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x1b, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:42 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x288, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:42 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000030e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:42 executing program 1: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}}}, 0x24}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@getchain={0x34, 0x66, 0x4, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff3, 0x8}, {0xffee, 0xf}}, [{0x8, 0xb, 0xffff7fff}, {0x8, 0xb, 0x8001}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000000}, 0x4041) (async) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="1400ec0007054600000000dd1c932a23b938065589d400000000000000006f90ad473a6cbbcc6f2dc71c6ce2501616edefbbe7905e90493b0c8cd9fa80d8c4e297b8e9359dadceb40be43e8f545b786537c3f2ff396a6d2ff3fa4befd1884f8d7dbb70bc1f1162c87e7ee6f9ae1297c10a9a4bd4ffb6c778b57a07222ced12bbb2fdbbbca31632587aa9e58518f3ed2b313fe4b9cf3f25199e9979d058f7f9e523d6ba9648a8a7eaef4e750b9c485f5b4a4c5317203eab79500bf850f1114c162baa2a1979bbe5513b5afc747c3033e01a85de4c9c7cba1756a831344748"], 0x14}}, 0x0) (async) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000100)={0x7bc, 0x7, 0x77, 0xff, 0x7e, 0x7, 0x224b}, 0xc) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES16=r0], 0x14}}, 0x24000080) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000480)=0x14) (async) sendfile(r3, r1, 0x0, 0x100000004) 03:54:42 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2430ea2", 0x14}], 0x56) 03:54:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x3}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:42 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x28a, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:42 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2430fa2", 0x14}], 0x56) 03:54:42 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x290, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:42 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000080e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:42 executing program 3: r0 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000dd8b840e02c02add2a"], 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r4, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x2400004c}, 0x8000) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f0000000340)) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), r0) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r5, 0x800, 0x0, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xe3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40d0}, 0x10) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x34, r3, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x11, 0x17, {0x16, 0x22605, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x24044880}, 0x4090) sendmsg$nl_route(r1, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)=@ipv4_getroute={0x1c, 0x1a, 0x800, 0x70bd2d, 0x25dfdbfd, {0x2, 0x90, 0x10, 0x7, 0xfe, 0x0, 0x0, 0x4, 0xc00}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x80) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) socketpair(0xa, 0x3, 0xff, &(0x7f0000000000)) 03:54:42 executing program 3: r0 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000dd8b840e02c02add2a"], 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r4, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x2400004c}, 0x8000) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f0000000340)) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), r0) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r5, 0x800, 0x0, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xe3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40d0}, 0x10) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x34, r3, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x11, 0x17, {0x16, 0x22605, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x24044880}, 0x4090) sendmsg$nl_route(r1, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)=@ipv4_getroute={0x1c, 0x1a, 0x800, 0x70bd2d, 0x25dfdbfd, {0x2, 0x90, 0x10, 0x7, 0xfe, 0x0, 0x0, 0x4, 0xc00}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x80) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) socketpair(0xa, 0x3, 0xff, &(0x7f0000000000)) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000dd8b840e02c02add2a"], 0x14}}, 0x0) (async) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) pipe(&(0x7f00000000c0)) (async) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r4, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x2400004c}, 0x8000) (async) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f0000000340)) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000500), r0) (async) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r5, 0x800, 0x0, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xe3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40d0}, 0x10) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x34, r3, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x11, 0x17, {0x16, 0x22605, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x24044880}, 0x4090) (async) sendmsg$nl_route(r1, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)=@ipv4_getroute={0x1c, 0x1a, 0x800, 0x70bd2d, 0x25dfdbfd, {0x2, 0x90, 0x10, 0x7, 0xfe, 0x0, 0x0, 0x4, 0xc00}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x80) (async) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) socketpair(0xa, 0x3, 0xff, &(0x7f0000000000)) (async) 03:54:42 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x29a, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:42 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24310a2", 0x14}], 0x56) 03:54:42 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf500001c0e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:43 executing program 1: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@getchain={0x34, 0x66, 0x4, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff3, 0x8}, {0xffee, 0xf}}, [{0x8, 0xb, 0xffff7fff}, {0x8, 0xb, 0x8001}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000000}, 0x4041) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="1400ec0007054600000000dd1c932a23b938065589d400000000000000006f90ad473a6cbbcc6f2dc71c6ce2501616edefbbe7905e90493b0c8cd9fa80d8c4e297b8e9359dadceb40be43e8f545b786537c3f2ff396a6d2ff3fa4befd1884f8d7dbb70bc1f1162c87e7ee6f9ae1297c10a9a4bd4ffb6c778b57a07222ced12bbb2fdbbbca31632587aa9e58518f3ed2b313fe4b9cf3f25199e9979d058f7f9e523d6ba9648a8a7eaef4e750b9c485f5b4a4c5317203eab79500bf850f1114c162baa2a1979bbe5513b5afc747c3033e01a85de4c9c7cba1756a831344748"], 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000100)={0x7bc, 0x7, 0x77, 0xff, 0x7e, 0x7, 0x224b}, 0xc) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES16=r0], 0x14}}, 0x24000080) getsockname$packet(0xffffffffffffffff, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000480)=0x14) sendfile(r3, r1, 0x0, 0x100000004) socket(0x10, 0x803, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x28, 0xd39, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}}}, 0x24}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@getchain={0x34, 0x66, 0x4, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff3, 0x8}, {0xffee, 0xf}}, [{0x8, 0xb, 0xffff7fff}, {0x8, 0xb, 0x8001}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000000}, 0x4041) (async) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="1400ec0007054600000000dd1c932a23b938065589d400000000000000006f90ad473a6cbbcc6f2dc71c6ce2501616edefbbe7905e90493b0c8cd9fa80d8c4e297b8e9359dadceb40be43e8f545b786537c3f2ff396a6d2ff3fa4befd1884f8d7dbb70bc1f1162c87e7ee6f9ae1297c10a9a4bd4ffb6c778b57a07222ced12bbb2fdbbbca31632587aa9e58518f3ed2b313fe4b9cf3f25199e9979d058f7f9e523d6ba9648a8a7eaef4e750b9c485f5b4a4c5317203eab79500bf850f1114c162baa2a1979bbe5513b5afc747c3033e01a85de4c9c7cba1756a831344748"], 0x14}}, 0x0) (async) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000100)={0x7bc, 0x7, 0x77, 0xff, 0x7e, 0x7, 0x224b}, 0xc) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES16=r0], 0x14}}, 0x24000080) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000480)=0x14) (async) sendfile(r3, r1, 0x0, 0x100000004) (async) 03:54:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x4}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:43 executing program 3: r0 = socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000dd8b840e02c02add2a"], 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r4, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x2400004c}, 0x8000) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f0000000340)) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), r0) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r5, 0x800, 0x0, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xe3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40d0}, 0x10) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x34, r3, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x11, 0x17, {0x16, 0x22605, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x24044880}, 0x4090) sendmsg$nl_route(r1, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)=@ipv4_getroute={0x1c, 0x1a, 0x800, 0x70bd2d, 0x25dfdbfd, {0x2, 0x90, 0x10, 0x7, 0xfe, 0x0, 0x0, 0x4, 0xc00}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x80) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) socketpair(0xa, 0x3, 0xff, &(0x7f0000000000)) socket(0x10, 0x803, 0x0) (async) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000007060000000000000000000000000000dd8b840e02c02add2a"], 0x14}}, 0x0) (async) getsockname$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) pipe(&(0x7f00000000c0)) (async) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r4, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x2400004c}, 0x8000) (async) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f0000000340)) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000500), r0) (async) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r5, 0x800, 0x0, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xe3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40d0}, 0x10) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x34, r3, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x11, 0x17, {0x16, 0x22605, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x24044880}, 0x4090) (async) sendmsg$nl_route(r1, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)=@ipv4_getroute={0x1c, 0x1a, 0x800, 0x70bd2d, 0x25dfdbfd, {0x2, 0x90, 0x10, 0x7, 0xfe, 0x0, 0x0, 0x4, 0xc00}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x80) (async) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) socketpair(0xa, 0x3, 0xff, &(0x7f0000000000)) (async) 03:54:43 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x2b8, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:43 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000270e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:43 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24311a2", 0x14}], 0x56) 03:54:43 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x2bc, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 557.935069][ T25] kauditd_printk_skb: 22 callbacks suppressed [ 557.935085][ T25] audit: type=1804 audit(1640058883.540:4560): pid=18752 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/493/memory.events" dev="sda1" ino=1167 res=1 errno=0 [ 558.004971][ T25] audit: type=1800 audit(1640058883.590:4561): pid=18752 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1167 res=0 errno=0 03:54:43 executing program 3: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000080e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:43 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x2c6, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:43 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000280e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) [ 558.035445][ T25] audit: type=1804 audit(1640058883.590:4562): pid=18752 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/493/memory.events" dev="sda1" ino=1167 res=1 errno=0 [ 558.156557][ T25] audit: type=1804 audit(1640058883.750:4563): pid=18752 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/493/memory.events" dev="sda1" ino=1167 res=1 errno=0 03:54:43 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) splice(r3, &(0x7f0000000100)=0xffffffffffffffe0, r1, &(0x7f0000000140)=0x5, 0x9, 0xc) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:43 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x2f6, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x5}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 558.195030][ T25] audit: type=1800 audit(1640058883.750:4564): pid=18752 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1167 res=0 errno=0 03:54:43 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x300, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:43 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24312a2", 0x14}], 0x56) [ 558.316402][ T25] audit: type=1804 audit(1640058883.920:4565): pid=18775 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/494/memory.events" dev="sda1" ino=1168 res=1 errno=0 03:54:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="8800000030003dfb00000000000000000000000074000100700001000f00010074756e6e656c5f6b657900004000028008000400ac1414bb08000300ac1414aa1c0002000000000000000000000000000000000000000000010000000800070000000000060009004e240000040006000c00070000000000000000000c000800000000000000000024ba956d53565a387955723466b39929cb3e74c97ce801f207a9b9bc4e2f4d765cda48abd61b3cc5c48244f8827da0291afc687eb091f855edd3b71b29f21bb8b640420da62a28cc7dacbb9dd8d6e0ef572f53c4e4c75f4be177a2114908454b207a82104b1e4324717d23af7aacfb745e4dcea1fbffe247c3e32065129d1b91ececdab01ad7117208d335b55e47b768565d33c88d8a6c10921159661efb30c51dbac87fbda3b39d82ac33610477850dda57c6367c2aae0ce2f24ca0c8b7e8758fbcead94d3d9ccdbf784237d59ed35a56774b7e2d8d92a499d99636bf3edb1b19386c15138480d6e2c83dc6bbb11af4459c3ce93fd639d465e9a6743c445abd410744134c2e29f2b6cf898c0e1ae7493699fc16be21c7b792c402f21a64f2d5ce3bac8fc3070083de9df81087741fdf06ef8cd81b9214454b4719f775898588bddbe393625be60ab73829a0ec61aaef16261cc941b96ea7f8e0c9bc808b145df78b57e86150f08d24b8c5"], 0x88}}, 0x0) [ 558.451790][ T25] audit: type=1800 audit(1640058883.920:4566): pid=18775 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1168 res=0 errno=0 03:54:44 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x312, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 558.499087][T18787] [ 558.505025][T18787] ============================= [ 558.515945][T18787] WARNING: suspicious RCU usage [ 558.527256][T18787] 5.16.0-rc5-syzkaller #0 Not tainted [ 558.535048][ T25] audit: type=1804 audit(1640058883.930:4567): pid=18775 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/494/memory.events" dev="sda1" ino=1168 res=1 errno=0 [ 558.575745][T18787] ----------------------------- 03:54:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x6}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:44 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x314, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 558.596027][T18787] include/net/tc_act/tc_tunnel_key.h:33 suspicious rcu_dereference_protected() usage! [ 558.609147][T18787] [ 558.609147][T18787] other info that might help us debug this: [ 558.609147][T18787] [ 558.625386][T18787] [ 558.625386][T18787] rcu_scheduler_active = 2, debug_locks = 1 [ 558.637006][T18787] 1 lock held by syz-executor.3/18787: [ 558.649228][T18787] #0: ffffffff8d315528 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3be/0xb80 [ 558.665711][T18787] [ 558.665711][T18787] stack backtrace: [ 558.682502][T18787] CPU: 1 PID: 18787 Comm: syz-executor.3 Not tainted 5.16.0-rc5-syzkaller #0 03:54:44 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x338, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 558.691304][T18787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 558.701379][T18787] Call Trace: [ 558.704663][T18787] [ 558.707599][T18787] dump_stack_lvl+0xcd/0x134 [ 558.712211][T18787] tcf_tunnel_key_offload_act_setup+0x4f2/0xa20 [ 558.718535][T18787] ? tunnel_key_init+0x1c30/0x1c30 [ 558.723667][T18787] tcf_action_offload_add_ex+0x279/0x550 [ 558.729389][T18787] ? tc_lookup_action_n+0xf0/0xf0 [ 558.734439][T18787] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 558.740506][T18787] tcf_action_init+0x601/0x860 [ 558.745304][T18787] ? find_held_lock+0x2d/0x110 03:54:44 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x33c, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 558.750098][T18787] ? tcf_action_init_1+0x690/0x690 [ 558.755281][T18787] ? __kernel_text_address+0x9/0x30 [ 558.760559][T18787] ? unwind_get_return_address+0x51/0x90 [ 558.766210][T18787] ? create_prof_cpu_mask+0x20/0x20 [ 558.771447][T18787] ? arch_stack_walk+0x93/0xe0 [ 558.776289][T18787] ? kasan_save_stack+0x38/0x50 [ 558.781160][T18787] ? kasan_save_stack+0x1e/0x50 [ 558.786027][T18787] ? kasan_set_track+0x21/0x30 [ 558.790869][T18787] ? kasan_set_free_info+0x20/0x30 [ 558.796002][T18787] ? __kasan_slab_free+0xff/0x130 [ 558.801041][T18787] ? slab_free_freelist_hook+0x8b/0x1c0 [ 558.806611][T18787] ? kmem_cache_free+0xbd/0x5d0 [ 558.811485][T18787] ? kfree_skbmem+0xef/0x1b0 [ 558.816096][T18787] ? consume_skb+0xcf/0x160 [ 558.820620][T18787] ? nlmon_xmit+0xa4/0xe0 [ 558.825030][T18787] ? dev_hard_start_xmit+0x1eb/0x920 [ 558.830384][T18787] tcf_action_add+0xf9/0x480 [ 558.835003][T18787] ? tca_action_gd+0xe60/0xe60 [ 558.839841][T18787] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 558.846118][T18787] ? __nla_parse+0x3d/0x50 [ 558.850636][T18787] tc_ctl_action+0x346/0x470 [ 558.855255][T18787] ? tcf_action_add+0x480/0x480 [ 558.860125][T18787] ? rtnetlink_rcv_msg+0x388/0xb80 [ 558.865271][T18787] ? tcf_action_add+0x480/0x480 [ 558.870140][T18787] rtnetlink_rcv_msg+0x413/0xb80 [ 558.875101][T18787] ? rtnl_newlink+0xa0/0xa0 [ 558.879628][T18787] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 558.884949][T18787] netlink_rcv_skb+0x153/0x420 [ 558.889741][T18787] ? rtnl_newlink+0xa0/0xa0 [ 558.894262][T18787] ? netlink_ack+0xa60/0xa60 [ 558.898879][T18787] ? netlink_deliver_tap+0x1a2/0xc30 [ 558.904204][T18787] ? netlink_deliver_tap+0x1b1/0xc30 [ 558.909529][T18787] netlink_unicast+0x533/0x7d0 [ 558.914326][T18787] ? netlink_attachskb+0x880/0x880 [ 558.919459][T18787] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 558.925729][T18787] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 558.932000][T18787] ? __phys_addr_symbol+0x2c/0x70 [ 558.937044][T18787] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 558.942789][T18787] ? __check_object_size+0x16e/0x3f0 [ 558.948109][T18787] netlink_sendmsg+0x904/0xdf0 [ 558.952908][T18787] ? netlink_unicast+0x7d0/0x7d0 [ 558.957879][T18787] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 558.964153][T18787] ? netlink_unicast+0x7d0/0x7d0 [ 558.969129][T18787] sock_sendmsg+0xcf/0x120 [ 558.973659][T18787] ____sys_sendmsg+0x6e8/0x810 [ 558.978448][T18787] ? kernel_sendmsg+0x50/0x50 [ 558.983140][T18787] ? do_recvmmsg+0x6d0/0x6d0 [ 558.987850][T18787] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 558.993853][T18787] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 559.000117][T18787] ? futex_wait+0x533/0x670 [ 559.004734][T18787] ___sys_sendmsg+0xf3/0x170 [ 559.009381][T18787] ? sendmsg_copy_msghdr+0x160/0x160 [ 559.014695][T18787] ? lock_downgrade+0x6e0/0x6e0 [ 559.019581][T18787] ? __fget_files+0x28c/0x470 [ 559.024289][T18787] ? __fget_light+0xea/0x280 [ 559.028894][T18787] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 559.035247][T18787] __sys_sendmsg+0xe5/0x1b0 [ 559.039770][T18787] ? __sys_sendmsg_sock+0x30/0x30 [ 559.044828][T18787] ? syscall_enter_from_user_mode+0x21/0x70 [ 559.050753][T18787] do_syscall_64+0x35/0xb0 [ 559.055185][T18787] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 559.061102][T18787] RIP: 0033:0x7f95fb85ce99 [ 559.065535][T18787] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 559.085163][T18787] RSP: 002b:00007f95fa1d2168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 559.093598][T18787] RAX: ffffffffffffffda RBX: 00007f95fb96ff60 RCX: 00007f95fb85ce99 [ 559.101597][T18787] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 559.109590][T18787] RBP: 00007f95fb8b6ff1 R08: 0000000000000000 R09: 0000000000000000 [ 559.117681][T18787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 559.125668][T18787] R13: 00007ffca886689f R14: 00007f95fa1d2300 R15: 0000000000022000 [ 559.133675][T18787] 03:54:44 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf500002c0e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:45 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async, rerun: 32) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async, rerun: 32) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) splice(r3, &(0x7f0000000100)=0xffffffffffffffe0, r1, &(0x7f0000000140)=0x5, 0x9, 0xc) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:45 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x349, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:45 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24313a2", 0x14}], 0x56) 03:54:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="8800000030003dfb00000000000000000000000074000100700001000f00010074756e6e656c5f6b657900004000028008000400ac1414bb08000300ac1414aa1c0002000000000000000000000000000000000000000000010000000800070000000000060009004e240000040006000c00070000000000000000000c000800000000000000000024ba956d53565a387955723466b39929cb3e74c97ce801f207a9b9bc4e2f4d765cda48abd61b3cc5c48244f8827da0291afc687eb091f855edd3b71b29f21bb8b640420da62a28cc7dacbb9dd8d6e0ef572f53c4e4c75f4be177a2114908454b207a82104b1e4324717d23af7aacfb745e4dcea1fbffe247c3e32065129d1b91ececdab01ad7117208d335b55e47b768565d33c88d8a6c10921159661efb30c51dbac87fbda3b39d82ac33610477850dda57c6367c2aae0ce2f24ca0c8b7e8758fbcead94d3d9ccdbf784237d59ed35a56774b7e2d8d92a499d99636bf3edb1b19386c15138480d6e2c83dc6bbb11af4459c3ce93fd639d465e9a6743c445abd410744134c2e29f2b6cf898c0e1ae7493699fc16be21c7b792c402f21a64f2d5ce3bac8fc3070083de9df81087741fdf06ef8cd81b9214454b4719f775898588bddbe393625be60ab73829a0ec61aaef16261cc941b96ea7f8e0c9bc808b145df78b57e86150f08d24b8c5"], 0x88}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="8800000030003dfb00000000000000000000000074000100700001000f00010074756e6e656c5f6b657900004000028008000400ac1414bb08000300ac1414aa1c0002000000000000000000000000000000000000000000010000000800070000000000060009004e240000040006000c00070000000000000000000c000800000000000000000024ba956d53565a387955723466b39929cb3e74c97ce801f207a9b9bc4e2f4d765cda48abd61b3cc5c48244f8827da0291afc687eb091f855edd3b71b29f21bb8b640420da62a28cc7dacbb9dd8d6e0ef572f53c4e4c75f4be177a2114908454b207a82104b1e4324717d23af7aacfb745e4dcea1fbffe247c3e32065129d1b91ececdab01ad7117208d335b55e47b768565d33c88d8a6c10921159661efb30c51dbac87fbda3b39d82ac33610477850dda57c6367c2aae0ce2f24ca0c8b7e8758fbcead94d3d9ccdbf784237d59ed35a56774b7e2d8d92a499d99636bf3edb1b19386c15138480d6e2c83dc6bbb11af4459c3ce93fd639d465e9a6743c445abd410744134c2e29f2b6cf898c0e1ae7493699fc16be21c7b792c402f21a64f2d5ce3bac8fc3070083de9df81087741fdf06ef8cd81b9214454b4719f775898588bddbe393625be60ab73829a0ec61aaef16261cc941b96ea7f8e0c9bc808b145df78b57e86150f08d24b8c5"], 0x88}}, 0x0) (async) 03:54:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x7}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:45 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000440e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:45 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x356, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:45 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x36f, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="8800000030003dfb00000000000000000000000074000100700001000f00010074756e6e656c5f6b657900004000028008000400ac1414bb08000300ac1414aa1c0002000000000000000000000000000000000000000000010000000800070000000000060009004e240000040006000c00070000000000000000000c000800000000000000000024ba956d53565a387955723466b39929cb3e74c97ce801f207a9b9bc4e2f4d765cda48abd61b3cc5c48244f8827da0291afc687eb091f855edd3b71b29f21bb8b640420da62a28cc7dacbb9dd8d6e0ef572f53c4e4c75f4be177a2114908454b207a82104b1e4324717d23af7aacfb745e4dcea1fbffe247c3e32065129d1b91ececdab01ad7117208d335b55e47b768565d33c88d8a6c10921159661efb30c51dbac87fbda3b39d82ac33610477850dda57c6367c2aae0ce2f24ca0c8b7e8758fbcead94d3d9ccdbf784237d59ed35a56774b7e2d8d92a499d99636bf3edb1b19386c15138480d6e2c83dc6bbb11af4459c3ce93fd639d465e9a6743c445abd410744134c2e29f2b6cf898c0e1ae7493699fc16be21c7b792c402f21a64f2d5ce3bac8fc3070083de9df81087741fdf06ef8cd81b9214454b4719f775898588bddbe393625be60ab73829a0ec61aaef16261cc941b96ea7f8e0c9bc808b145df78b57e86150f08d24b8c5"], 0x88}}, 0x0) 03:54:45 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) splice(r3, &(0x7f0000000100)=0xffffffffffffffe0, r1, &(0x7f0000000140)=0x5, 0x9, 0xc) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) splice(r3, &(0x7f0000000100)=0xffffffffffffffe0, r1, &(0x7f0000000140)=0x5, 0x9, 0xc) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:54:45 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24314a2", 0x14}], 0x56) 03:54:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x8}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:45 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000005280000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:45 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x374, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:45 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24312a2", 0x14}], 0x56) [ 559.721085][ T25] audit: type=1804 audit(1640058885.330:4568): pid=18830 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/496/memory.events" dev="sda1" ino=1165 res=1 errno=0 03:54:45 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x379, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 559.811379][ T25] audit: type=1800 audit(1640058885.330:4569): pid=18830 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1165 res=0 errno=0 03:54:45 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24315a2", 0x14}], 0x56) 03:54:45 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:45 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000028080000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:45 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3b6, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x9}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:45 executing program 3: unshare(0x6c060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x0, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) unshare(0x20000000) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r2) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=r3, @ANYBLOB="03040600000000003c0012800b00010067726574617000002c00028006000e000200000006000f00e5be000008000700e0"], 0x5c}}, 0x0) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x0, r3}, 0x14) sendto$inet6(r0, &(0x7f0000000100)="05003e0000000200c52c000000dd", 0xe, 0x0, 0x0, 0x0) 03:54:45 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3bc, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:45 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24316a2", 0x14}], 0x56) 03:54:45 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3be, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:45 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000d80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:45 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3dc, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0xe}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:46 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24317a2", 0x14}], 0x56) [ 560.836266][T18863] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. 03:54:46 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3e0, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:46 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000005280000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:46 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24318a2", 0x14}], 0x56) 03:54:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0xf}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:46 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:54:46 executing program 3: unshare(0x6c060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$tipc(0x1e, 0x0, 0x0, 0x0) (async) r0 = socket$packet(0x11, 0x3, 0x300) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) unshare(0x20000000) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r2) (async) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=r3, @ANYBLOB="03040600000000003c0012800b00010067726574617000002c00028006000e000200000006000f00e5be000008000700e0"], 0x5c}}, 0x0) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x0, r3}, 0x14) (async) sendto$inet6(r0, &(0x7f0000000100)="05003e0000000200c52c000000dd", 0xe, 0x0, 0x0, 0x0) 03:54:46 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3e2, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:46 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24319a2", 0x14}], 0x56) 03:54:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x60}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:46 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3e8, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:47 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3f2, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:47 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e43140800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:47 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2431aa2", 0x14}], 0x56) 03:54:47 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)={0x14}, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) (async) 03:54:47 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3fd, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:47 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3fe, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 562.014431][T18892] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. 03:54:47 executing program 3: unshare(0x6c060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x0, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) unshare(0x20000000) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r2) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=r3, @ANYBLOB="03040600000000003c0012800b00010067726574617000002c00028006000e000200000006000f00e5be000008000700e0"], 0x5c}}, 0x0) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x0, r3}, 0x14) sendto$inet6(r0, &(0x7f0000000100)="05003e0000000200c52c000000dd", 0xe, 0x0, 0x0, 0x0) unshare(0x6c060000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$tipc(0x1e, 0x0, 0x0, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) unshare(0x20000000) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r2) (async) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) (async) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=r3, @ANYBLOB="03040600000000003c0012800b00010067726574617000002c00028006000e000200000006000f00e5be000008000700e0"], 0x5c}}, 0x0) (async) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x0, r3}, 0x14) (async) sendto$inet6(r0, &(0x7f0000000100)="05003e0000000200c52c000000dd", 0xe, 0x0, 0x0, 0x0) (async) 03:54:47 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e43440800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:47 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2431ba2", 0x14}], 0x56) 03:54:47 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x548, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:47 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3000001, 0x20010, r4, 0xcf7f5000) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0xff8b, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14c1006329000706000000faff01003e37000000"], 0x14}, 0x1, 0x0, 0x0, 0x840}, 0x20000101) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r2, r0, 0x0, 0x100000004) 03:54:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0x2}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:47 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x600, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:47 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x700, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:48 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2431ca2", 0x14}], 0x56) 03:54:48 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1001, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:48 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0x3}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:48 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1002, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 562.599634][ T1230] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.605962][ T1230] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.050996][T18967] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. [ 563.087333][T18966] syz-executor.3: vmalloc error: size 28672, page order 0, failed to allocate pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 563.129179][T18966] CPU: 1 PID: 18966 Comm: syz-executor.3 Not tainted 5.16.0-rc5-syzkaller #0 [ 563.137993][T18966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 563.148062][T18966] Call Trace: [ 563.151345][T18966] [ 563.154280][T18966] dump_stack_lvl+0xcd/0x134 [ 563.158891][T18966] warn_alloc.cold+0x87/0x17a [ 563.163585][T18966] ? zone_watermark_ok_safe+0x290/0x290 [ 563.169140][T18966] ? __kmalloc_node+0x62/0x390 [ 563.173938][T18966] ? __vmalloc_node_range+0x574/0xab0 [ 563.179331][T18966] __vmalloc_node_range+0x883/0xab0 [ 563.184553][T18966] ? vfree_atomic+0xe0/0xe0 [ 563.189070][T18966] ? rcu_read_lock_sched_held+0x3a/0x70 [ 563.194721][T18966] ? kernel_clone+0xe7/0xab0 [ 563.199311][T18966] copy_process+0x926/0x75a0 [ 563.203898][T18966] ? kernel_clone+0xe7/0xab0 [ 563.208488][T18966] ? lock_chain_count+0x20/0x20 [ 563.213338][T18966] ? lock_chain_count+0x20/0x20 [ 563.218189][T18966] ? find_held_lock+0x2d/0x110 [ 563.222958][T18966] ? __cleanup_sighand+0xb0/0xb0 [ 563.227889][T18966] ? lock_downgrade+0x6e0/0x6e0 [ 563.232746][T18966] ? __lock_acquire+0x162f/0x54a0 [ 563.237772][T18966] ? kernel_clone+0x314/0xab0 [ 563.242450][T18966] kernel_clone+0xe7/0xab0 [ 563.246878][T18966] ? create_io_thread+0xf0/0xf0 [ 563.251742][T18966] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 563.257732][T18966] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 563.263737][T18966] ? find_held_lock+0x2d/0x110 [ 563.268514][T18966] __do_sys_clone+0xc8/0x110 [ 563.273101][T18966] ? kernel_clone+0xab0/0xab0 [ 563.277781][T18966] ? lock_downgrade+0x6e0/0x6e0 [ 563.282736][T18966] ? syscall_enter_from_user_mode+0x21/0x70 [ 563.288656][T18966] do_syscall_64+0x35/0xb0 [ 563.293078][T18966] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 563.298974][T18966] RIP: 0033:0x7f95fb85e2c1 [ 563.303389][T18966] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 563.322994][T18966] RSP: 002b:00007ffca88667e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 563.331407][T18966] RAX: ffffffffffffffda RBX: 00007f95fa0eb700 RCX: 00007f95fb85e2c1 [ 563.339374][T18966] RDX: 00007f95fa0eb9d0 RSI: 00007f95fa0eb2f0 RDI: 00000000003d0f00 [ 563.347339][T18966] RBP: 00007ffca8866a30 R08: 00007f95fa0eb700 R09: 00007f95fa0eb700 [ 563.355303][T18966] R10: 00007f95fa0eb9d0 R11: 0000000000000206 R12: 00007ffca886689e [ 563.363265][T18966] R13: 00007ffca886689f R14: 00007f95fa0eb300 R15: 0000000000022000 [ 563.371248][T18966] [ 563.465483][T18966] Mem-Info: [ 563.469068][T18966] active_anon:927 inactive_anon:83189 isolated_anon:0 [ 563.469068][T18966] active_file:8227 inactive_file:36120 isolated_file:0 [ 563.469068][T18966] unevictable:768 dirty:53 writeback:0 [ 563.469068][T18966] slab_reclaimable:20239 slab_unreclaimable:123583 [ 563.469068][T18966] mapped:30883 shmem:5445 pagetables:685 bounce:0 [ 563.469068][T18966] kernel_misc_reclaimable:0 [ 563.469068][T18966] free:1328440 free_pcp:10463 free_cma:0 [ 563.543718][T18966] Node 0 active_anon:3696kB inactive_anon:329840kB active_file:32836kB inactive_file:144480kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:123532kB dirty:208kB writeback:0kB shmem:19312kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 360448kB writeback_tmp:0kB kernel_stack:10720kB pagetables:2736kB all_unreclaimable? no [ 563.576443][T18966] Node 1 active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:2468kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:4kB all_unreclaimable? no [ 563.607025][T18966] Node 0 DMA free:15360kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 563.650566][T18966] lowmem_reserve[]: 0 2645 2645 2645 2645 [ 563.656443][T18966] Node 0 DMA32 free:1354784kB boost:0kB min:35676kB low:44592kB high:53508kB reserved_highatomic:0KB active_anon:3700kB inactive_anon:329824kB active_file:32836kB inactive_file:144480kB unevictable:1536kB writepending:208kB present:3129332kB managed:2716752kB mlocked:0kB bounce:0kB free_pcp:41780kB local_pcp:21096kB free_cma:0kB [ 563.698190][T18966] lowmem_reserve[]: 0 0 0 0 0 [ 563.703508][T18966] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 563.742928][T18966] lowmem_reserve[]: 0 0 0 0 0 [ 563.755539][T18966] Node 1 Normal free:3948044kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:12kB inactive_anon:920kB active_file:72kB inactive_file:0kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 563.792839][T18966] lowmem_reserve[]: 0 0 0 0 0 [ 563.799426][T18966] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 563.812908][T18966] Node 0 DMA32: 360*4kB (UME) 3316*8kB (UME) 2810*16kB (UME) 1464*32kB (UME) 621*64kB (UME) 254*128kB (UME) 124*256kB (UME) 35*512kB (UME) 3*1024kB (UM) 6*2048kB (UME) 268*4096kB (M) = 1354784kB [ 563.832768][T18966] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 563.844722][T18966] Node 1 Normal: 161*4kB (UE) 35*8kB (UE) 27*16kB (UME) 184*32kB (UE) 87*64kB (UME) 24*128kB (UME) 8*256kB (U) 6*512kB (UE) 1*1024kB (E) 3*2048kB (ME) 957*4096kB (M) = 3948044kB [ 563.863944][T18966] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 563.882998][T18966] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 563.895467][T18966] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 563.913443][T18966] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 563.923765][T18966] 21419 total pagecache pages [ 563.928944][T18966] 0 pages in swap cache [ 563.933181][T18966] Swap cache stats: add 0, delete 0, find 0/0 [ 563.939718][T18966] Free swap = 0kB [ 563.943513][T18966] Total swap = 0kB [ 563.947296][T18966] 2097051 pages RAM [ 563.951656][T18966] 0 pages HighMem/MovableOnly [ 563.956406][T18966] 384518 pages reserved [ 563.961088][T18966] 0 pages cma reserved 03:54:49 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1001, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:49 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1200, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:49 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2431da2", 0x14}], 0x56) 03:54:49 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e43ac0800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:49 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0x4}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:49 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3000001, 0x20010, r4, 0xcf7f5000) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0xff8b, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14c1006329000706000000faff01003e37000000"], 0x14}, 0x1, 0x0, 0x0, 0x840}, 0x20000101) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:54:49 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1203, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 564.121664][ T25] kauditd_printk_skb: 17 callbacks suppressed [ 564.121681][ T25] audit: type=1804 audit(1640058889.730:4587): pid=18999 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/501/memory.events" dev="sda1" ino=1177 res=1 errno=0 [ 564.226163][ T25] audit: type=1800 audit(1640058889.730:4588): pid=18999 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1177 res=0 errno=0 [ 564.249838][ T25] audit: type=1804 audit(1640058889.730:4589): pid=19004 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/501/memory.events" dev="sda1" ino=1177 res=1 errno=0 03:54:49 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0x5}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 564.277791][T19010] Cannot find add_set index 0 as target 03:54:49 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e2431ea2", 0x14}], 0x56) 03:54:49 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1302, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:49 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1200, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:50 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80020800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:50 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1403, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 564.469265][T19021] Cannot find add_set index 0 as target 03:54:50 executing program 3: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000005280000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:50 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x1e01, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:50 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24321a2", 0x14}], 0x56) 03:54:50 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0x6}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:50 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x8912, 0x400308) (async) sendfile(r0, r3, &(0x7f0000000040)=0x3, 0x400) (async) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3000001, 0x20010, r4, 0xcf7f5000) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0xff8b, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14c1006329000706000000faff01003e37000000"], 0x14}, 0x1, 0x0, 0x0, 0x840}, 0x20000101) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r2, r0, 0x0, 0x100000004) 03:54:50 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x2002, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:50 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80030800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:50 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r2, 0x1, 0x0, 0x0, {0x24}}, 0x14}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000500)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x38, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc}}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x38}}, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r7, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x0, 0x3, r6}]}, 0x7}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000500)={'wpan0\x00'}) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r8) 03:54:50 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24322a2", 0x14}], 0x56) 03:54:50 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0x7}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:50 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x2c00, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 565.142310][ T25] audit: type=1804 audit(1640058890.750:4590): pid=19050 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/502/memory.events" dev="sda1" ino=1168 res=1 errno=0 03:54:50 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r2, 0x1, 0x0, 0x0, {0x24}}, 0x14}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000500)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x38, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc}}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x38}}, 0x0) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r7, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x0, 0x3, r6}]}, 0x7}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000500)={'wpan0\x00'}) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r8) 03:54:50 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3803, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:50 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24323a2", 0x14}], 0x56) [ 565.279130][ T25] audit: type=1800 audit(1640058890.780:4591): pid=19050 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1168 res=0 errno=0 03:54:50 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80060800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:50 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0x8}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 565.317327][ T25] audit: type=1804 audit(1640058890.780:4592): pid=19050 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/502/memory.events" dev="sda1" ino=1168 res=1 errno=0 03:54:51 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="6a32260f1d401521f51fdad661d1661bd02ab35f4e8df411bb15da50b0ed3968924d000c6ccf2d9c0ebf8a6094a0fa3ea3bb270438c62ea058da13b4a98dc15f913a1c2cda692113d7e3abef32366caf25b5bd0447725e5dae280f8ca83518e2ff96a3e9ac73f6b04d0210703fb2eb4e0ecce4ba25d4a3004abd15966f70ac161e9ac8038ddbfd06eb3e615ae4d7ff6f059d5bff3498c94e4449bd3221255636ad6504", 0xa3}, {&(0x7f00000003c0)="4d04ff148dc91bcd1c2debfc87f9689e503bc5a8affee3933436d3da5e4006699884d66901d8f9ec028cfab552f40a07a9f3c955b2f14823bfafaa6e2c6d529b381d954ae44d453a8a61a757ec262d1501cadf7885365b7d86a20615fe9a10249ceafd0e46642c8b251e4a5522758429dd5d81516a272978f2a5c6497bbe579f7e055dd140847bc967f44ee3885a08e04c5ed0eeda103ee03c76f8bb11cf366d0d7618c0830e", 0xa6}], 0x2}, 0x4) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[], 0x14}}, 0x20000040) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) 03:54:51 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3a01, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:51 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r2, 0x1, 0x0, 0x0, {0x24}}, 0x14}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000500)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x38, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc}}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x38}}, 0x0) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r7, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x0, 0x3, r6}]}, 0x7}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) (async) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000500)={'wpan0\x00'}) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r8) 03:54:51 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24324a2", 0x14}], 0x56) 03:54:51 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80080800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:51 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0x9}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:52 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3c03, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:52 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e801c0800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:52 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r2, 0x0, 0xf03b0000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x13, r0, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000180000000000000000000009500002000000000"], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d6163767461", @ANYRES32], 0x44}}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r6, r5, 0x0, 0xfffefffc) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000100)={@cgroup=r1, r5, 0x1e}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000d00)=[{{&(0x7f0000000840)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c}, 0x80, &(0x7f00000009c0)}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=""/27, 0x1b}}], 0x2, 0x40002003, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/18, 0x30c000, 0x800}, 0x200d6f) 03:54:52 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24325a2", 0x14}], 0x56) [ 566.496534][ T25] audit: type=1804 audit(1640058892.100:4593): pid=19091 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/503/memory.events" dev="sda1" ino=1154 res=1 errno=0 03:54:52 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x3d00, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 566.626765][ T25] audit: type=1800 audit(1640058892.100:4594): pid=19091 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=1154 res=0 errno=0 03:54:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0xe}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) [ 566.731316][ T25] audit: type=1804 audit(1640058892.100:4595): pid=19091 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/503/memory.events" dev="sda1" ino=1154 res=1 errno=0 03:54:53 executing program 1: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="6a32260f1d401521f51fdad661d1661bd02ab35f4e8df411bb15da50b0ed3968924d000c6ccf2d9c0ebf8a6094a0fa3ea3bb270438c62ea058da13b4a98dc15f913a1c2cda692113d7e3abef32366caf25b5bd0447725e5dae280f8ca83518e2ff96a3e9ac73f6b04d0210703fb2eb4e0ecce4ba25d4a3004abd15966f70ac161e9ac8038ddbfd06eb3e615ae4d7ff6f059d5bff3498c94e4449bd3221255636ad6504", 0xa3}, {&(0x7f00000003c0)="4d04ff148dc91bcd1c2debfc87f9689e503bc5a8affee3933436d3da5e4006699884d66901d8f9ec028cfab552f40a07a9f3c955b2f14823bfafaa6e2c6d529b381d954ae44d453a8a61a757ec262d1501cadf7885365b7d86a20615fe9a10249ceafd0e46642c8b251e4a5522758429dd5d81516a272978f2a5c6497bbe579f7e055dd140847bc967f44ee3885a08e04c5ed0eeda103ee03c76f8bb11cf366d0d7618c0830e", 0xa6}], 0x2}, 0x4) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[], 0x14}}, 0x20000040) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendfile(r3, r1, 0x0, 0x100000004) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) (async) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) (async) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="6a32260f1d401521f51fdad661d1661bd02ab35f4e8df411bb15da50b0ed3968924d000c6ccf2d9c0ebf8a6094a0fa3ea3bb270438c62ea058da13b4a98dc15f913a1c2cda692113d7e3abef32366caf25b5bd0447725e5dae280f8ca83518e2ff96a3e9ac73f6b04d0210703fb2eb4e0ecce4ba25d4a3004abd15966f70ac161e9ac8038ddbfd06eb3e615ae4d7ff6f059d5bff3498c94e4449bd3221255636ad6504", 0xa3}, {&(0x7f00000003c0)="4d04ff148dc91bcd1c2debfc87f9689e503bc5a8affee3933436d3da5e4006699884d66901d8f9ec028cfab552f40a07a9f3c955b2f14823bfafaa6e2c6d529b381d954ae44d453a8a61a757ec262d1501cadf7885365b7d86a20615fe9a10249ceafd0e46642c8b251e4a5522758429dd5d81516a272978f2a5c6497bbe579f7e055dd140847bc967f44ee3885a08e04c5ed0eeda103ee03c76f8bb11cf366d0d7618c0830e", 0xa6}], 0x2}, 0x4) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000080)=0xae) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) (async) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) (async) sendfile(r1, r4, &(0x7f0000000040)=0x3, 0x400) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[], 0x14}}, 0x20000040) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendfile(r3, r1, 0x0, 0x100000004) (async) 03:54:53 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80270800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:53 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x4805, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) 03:54:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001840), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004940)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{}, {}, {0x0, 0xf}, {}], "2643586519de8bd6"}}]}, 0x30}}, 0x0) 03:54:53 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24326a2", 0x14}], 0x56) 03:54:53 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (async) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r2, 0x0, 0xf03b0000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x13, r0, 0x0) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000180000000000000000000009500002000000000"], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d6163767461", @ANYRES32], 0x44}}, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r6, r5, 0x0, 0xfffefffc) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000100)={@cgroup=r1, r5, 0x1e}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) (async) recvmmsg(0xffffffffffffffff, &(0x7f0000000d00)=[{{&(0x7f0000000840)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c}, 0x80, &(0x7f00000009c0)}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=""/27, 0x1b}}], 0x2, 0x40002003, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/18, 0x30c000, 0x800}, 0x200d6f) 03:54:53 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x618, 0xd0, 0xd0, 0xd0, 0x4903, 0x0, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@private1, @local, [], [], 'ipvlan0\x00', 'veth1_to_batadv\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'team_slave_1\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@loopback, @mcast1, [], [], 'bond_slave_1\x00', 'veth0_vlan\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@private1, @rand_addr=' \x01\x00', [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0x140, 0x168, 0x0, {}, [@common=@inet=@multiport={{0x50}}, @common=@hbh={{0x48}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) [ 567.648960][ T25] audit: type=1804 audit(1640058893.260:4596): pid=19122 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir797019045/syzkaller.CX7ZEF/504/memory.events" dev="sda1" ino=1159 res=1 errno=0 03:54:53 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80000800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="332b07d934966c143d061d18311bc2d7e24327a2", 0x14}], 0x56) 03:54:53 executing program 0: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="689a0000005caf43592a33dc7d157a0072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000280)="2c2da2ee918a3730f7b1fdb3c8bea25d86dd", 0x12}, {&(0x7f0000000000)="92d6e8d500122fc8eae5d1b32d8a7fb78fa898e227eee68a05e661ba88386f217851caf50000000e80280800", 0x2c}, {&(0x7f0000000200)="a726c3b8", 0x4}, {&(0x7f00000002c0)="452b07d934966c143d061d18311bc2d7e24356a2", 0x14}], 0x4) 03:54:53 executing program 5: r0 = socket$inet6_udp(0xa,