0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:05 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2000000080002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00', 0x20, 0x2, 0x238, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200005c0], 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000110000000000000081006263736630000000000800000000000073697430000002000000ffff00000000626f6e64300000000000000000000000766574382d863573e35cea0000000000ffffffffffff0000000000000000000000000000000000000000d0000000d000000000010000766c616e000000ff030000000000000000000000000000000000000000000000080000000000007f0000000000000100766c616e000000000000000000000000000000000000000000000000000000000800000000000000000000000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff01000000030000000000000000006970365f76746930000000000000000073797a6b616c6c6572300000000000006263736630000000000000000000000076657468305f746f5f7465616d000000aaaaaaaaaabb000000000000aaaaaaaaaaaa00000000000000007000000070000000a8000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff00000000"]}, 0x2b0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000001c0)=@broute={'broute\x00\x00\x00\x00\x00P\xe0\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000100], 0x2, 0x0, &(0x7f0000000100)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x108) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) [ 340.655831][T12758] ebtables: ebtables: counters copy to user failed while replacing table 20:32:06 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xa}, 0x0, 0x0) 20:32:06 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2000000080002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00', 0x20, 0x2, 0x238, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200005c0], 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000110000000000000081006263736630000000000800000000000073697430000002000000ffff00000000626f6e64300000000000000000000000766574382d863573e35cea0000000000ffffffffffff0000000000000000000000000000000000000000d0000000d000000000010000766c616e000000ff030000000000000000000000000000000000000000000000080000000000007f0000000000000100766c616e000000000000000000000000000000000000000000000000000000000800000000000000000000000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff01000000030000000000000000006970365f76746930000000000000000073797a6b616c6c6572300000000000006263736630000000000000000000000076657468305f746f5f7465616d000000aaaaaaaaaabb000000000000aaaaaaaaaaaa00000000000000007000000070000000a8000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff00000000"]}, 0x2b0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000001c0)=@broute={'broute\x00\x00\x00\x00\x00P\xe0\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000100], 0x2, 0x0, &(0x7f0000000100)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x108) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) 20:32:06 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e22, @local}}, 0xfffffffffffffef9) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) listen(r1, 0x9) perf_event_open(&(0x7f0000000100)={0x3, 0x70, 0x1ff, 0x8000, 0x0, 0x3, 0x0, 0x9, 0x8, 0x2, 0x9, 0x10000, 0x1, 0x7fff, 0x2, 0x0, 0x0, 0x8, 0x4, 0x4, 0x9, 0x10001, 0x100000000, 0x7, 0x5, 0x1, 0x0, 0x1000, 0x800, 0xffffffff, 0x8, 0x5, 0xfffffffffffffffe, 0x8001, 0x8, 0xf389, 0x605, 0x2, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0xa}, 0x0, 0x1534, 0xbd9, 0x7, 0x5, 0x4, 0x7}, 0xffffffffffffffff, 0x2, r0, 0x9) 20:32:06 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2000000080002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00', 0x20, 0x2, 0x238, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200005c0], 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000110000000000000081006263736630000000000800000000000073697430000002000000ffff00000000626f6e64300000000000000000000000766574382d863573e35cea0000000000ffffffffffff0000000000000000000000000000000000000000d0000000d000000000010000766c616e000000ff030000000000000000000000000000000000000000000000080000000000007f0000000000000100766c616e000000000000000000000000000000000000000000000000000000000800000000000000000000000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff01000000030000000000000000006970365f76746930000000000000000073797a6b616c6c6572300000000000006263736630000000000000000000000076657468305f746f5f7465616d000000aaaaaaaaaabb000000000000aaaaaaaaaaaa00000000000000007000000070000000a8000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff00000000"]}, 0x2b0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000001c0)=@broute={'broute\x00\x00\x00\x00\x00P\xe0\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000100], 0x2, 0x0, &(0x7f0000000100)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x108) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) 20:32:06 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xf}, 0x0, 0x0) [ 340.985042][T12773] ebtables: ebtables: counters copy to user failed while replacing table [ 341.019672][T12772] ebtables: ebtables: counters copy to user failed while replacing table 20:32:06 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) lseek(r0, 0x100, 0x1) r1 = add_key(&(0x7f0000000000)='ceph\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="b97028e93747b4b1f9c657ac359e5922c2832e25235aed8893d32579affade3d3da5568c47fcef6b15cd1ecd47b5ddde75e27099a1d6255a6d9248d9bb4747f5498263545e8c5370e1a91962c537115982327a2267657f860a2467c9467c4a882589a377c07e5483d396a4088d056be9c81bd219f5d63bc2563a30cdeec923e7d360647fe6d508fcaef0fa00207f6aff38722e0bfac2ab56069b0596305f8b226a7eef911150f468cb4c5a1946864270fb7c83cd9bb11c7016b5f540c9dc591650b1dd00cc1daf0322e45bf18e581c6ebc99fa", 0xd3, 0xfffffffffffffffa) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vga_arbiter\x00', 0x2000, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000400)) keyctl$update(0x2, r1, &(0x7f00000001c0)="b27cfb8945640d6225ca19dc197ede727f57d6f88bb19b0a92b98e0a896f846c06f5966ac67d46e325b51eea9830654867f42d7f7fcce78a173e3551686493c1d9e670e548cae35b0c5e9a03772853f6e2eb965513dbb31365d984888bac9f331256ac54816bda553fffd910fd46e347ddb9447a7236b08b48d73268964a3ff9da2c330f208c81324d65bf5119e6e241843a2bd4866630e98196d9097dac79e600bca51dff5b2f1c91801f76925c27018e6f2d0df444e2532fca", 0xba) getdents64(r0, &(0x7f0000000280)=""/255, 0xff) 20:32:06 executing program 0: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x2, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast1}, &(0x7f0000000040)=0x10, 0x80000) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000080)=@gcm_128={{0x304}, "870b813620f071f3", "fa07af107f31f04a073e468efa71e2db", "0a2da047", "d8e8b868202c1669"}, 0x28) r2 = syz_open_dev$admmidi(&(0x7f0000000200)='/dev/admmidi#\x00', 0x4, 0x200000) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001280)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f0000001440)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001400)={&(0x7f00000012c0)={0x78, r3, 0x8, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x10, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x22}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7f}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e23}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6773eccc}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x44000}, 0x1) read$FUSE(r0, &(0x7f0000000240), 0x2305e2b7) write$FUSE_CREATE_OPEN(r0, &(0x7f0000001340)={0xa0, 0x0, 0x2}, 0xa0) sendto$packet(r0, &(0x7f0000000100)="008153ac57eb39b2dc79c8b41bc9a1a6237493e7bd52af06a0244ec89dbd9c7d9fe160de5a70de9514f2a2865de1636ef10b88aab78dcfe29b6e1318a547c01dbc203806ef12154271f2c1649f981e2926b7a6d5b465c6404aa7aa877868441cdfd618bd75843fa1b9531d1f6baddcaed01e591f6354ab22df75544b630859bd77f99e9bb957edc0c846b9bcb6f6dccde2226282b2d43854bb0219d918afa86eda896e46c1371215d4088a2d7f7b967a4c921ef10448b63fa66bcc59c7afb89b73f59b5c23286b6ed0", 0xc9, 0x4000004, 0x0, 0x0) 20:32:06 executing program 3: r0 = socket$inet6(0xa, 0x80803, 0x87) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0xbcc4, 0x8000) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000300)=0x7) sendto$x25(r1, &(0x7f0000000200)="dead2240bd9a23997e13515e632a04313401716eb00b82d897f399aa565f90c148c95f104cad1a9a1cd4bb03a5e7e14ad52945cf1b52f28359060a4384c04cd30c4a1985eaebdb304977b33ab228817e354c49378c5ed43522d5a5cf6c4a2b67e286aecc903054804d568d26f6ab74ebcb98b567fcb1e48415ad380c3a4752606bfefb5a600d7be06986e3e79e4b18094277a376ad261ea8c076f34f9f3106421b9dc5072e35982013c76081b62e21743b802662c106f3c2332c642a1972349a2a8a18fdf406d7f79de1fc61fbbc428b8d12df71ab11cd5414a0f7c4c8", 0xdd, 0x10, &(0x7f0000000180)={0x9, @null=' \x00'}, 0x12) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x0, 0x0) sendto$packet(r2, &(0x7f0000000100)="a6afa8d38fc89537cbdaec1a241d04328b519c243b999930ce39e651705059c3c1f06a2ac8080d28d455fd27a21a91fff759d8c71dd7d48413b2abba0c23913bc2d945c562a073a061616b2bc3b491ac690f5a6a0d6be2a39f9086964b547d92c4032e938d0358b53d5cdfa4d113996cf0c58ae333480d9b8d12b7c0be6f", 0x7e, 0x4008004, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dlm_plock\x00', 0x400042, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x322) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev, 0x0, 0x2b}, 0x0, @in6=@empty, 0x0, 0x0, 0x0, 0x90}}, 0xe8) connect$inet6(r0, &(0x7f00000000c0), 0x1c) 20:32:06 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x48}, 0x0, 0x0) [ 343.001673][T12800] IPVS: ftp: loaded support on port[0] = 21 [ 343.352305][T12800] chnl_net:caif_netlink_parms(): no params data found [ 343.379430][T12800] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.386647][T12800] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.394687][T12800] device bridge_slave_0 entered promiscuous mode [ 343.562426][T12800] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.570446][T12800] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.579143][T12800] device bridge_slave_1 entered promiscuous mode [ 343.758319][T12800] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 343.771171][T12800] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 343.947147][T12800] team0: Port device team_slave_0 added [ 343.959184][T12800] team0: Port device team_slave_1 added [ 344.000201][T12800] device hsr_slave_0 entered promiscuous mode [ 344.067340][T12800] device hsr_slave_1 entered promiscuous mode [ 344.137090][T12800] debugfs: Directory 'hsr0' with parent '/' already present! [ 344.323939][T12800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 344.477512][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 344.485268][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 344.495882][T12800] 8021q: adding VLAN 0 to HW filter on device team0 [ 344.512764][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 344.522962][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 344.532266][ T2920] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.539417][ T2920] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.548339][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 344.557395][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 344.566166][ T2920] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.573933][ T2920] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.582518][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 344.737492][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 344.745518][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 344.767925][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 344.776688][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 344.786502][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 344.795537][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 344.804997][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 344.813800][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 344.822304][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 344.836005][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 344.845225][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 344.860390][T12800] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 344.873099][ T9973] device bridge_slave_1 left promiscuous mode [ 344.879727][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.948124][ T9973] device bridge_slave_0 left promiscuous mode [ 344.954625][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.010621][ T9973] device bridge_slave_1 left promiscuous mode [ 345.017326][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.067755][ T9973] device bridge_slave_0 left promiscuous mode [ 345.073932][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.927500][ T9973] device hsr_slave_0 left promiscuous mode [ 348.987100][ T9973] device hsr_slave_1 left promiscuous mode [ 349.054961][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 349.073516][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 349.085622][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 349.163598][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 349.257121][ T9973] bond0 (unregistering): Released all slaves [ 349.397617][ T9973] device hsr_slave_0 left promiscuous mode [ 349.457137][ T9973] device hsr_slave_1 left promiscuous mode [ 349.504762][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 349.520220][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 349.531272][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 349.573937][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 349.670886][ T9973] bond0 (unregistering): Released all slaves [ 349.792490][T12800] 8021q: adding VLAN 0 to HW filter on device batadv0 20:32:15 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:15 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) lseek(r0, 0x100, 0x1) r1 = add_key(&(0x7f0000000000)='ceph\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="b97028e93747b4b1f9c657ac359e5922c2832e25235aed8893d32579affade3d3da5568c47fcef6b15cd1ecd47b5ddde75e27099a1d6255a6d9248d9bb4747f5498263545e8c5370e1a91962c537115982327a2267657f860a2467c9467c4a882589a377c07e5483d396a4088d056be9c81bd219f5d63bc2563a30cdeec923e7d360647fe6d508fcaef0fa00207f6aff38722e0bfac2ab56069b0596305f8b226a7eef911150f468cb4c5a1946864270fb7c83cd9bb11c7016b5f540c9dc591650b1dd00cc1daf0322e45bf18e581c6ebc99fa", 0xd3, 0xfffffffffffffffa) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vga_arbiter\x00', 0x2000, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000400)) keyctl$update(0x2, r1, &(0x7f00000001c0)="b27cfb8945640d6225ca19dc197ede727f57d6f88bb19b0a92b98e0a896f846c06f5966ac67d46e325b51eea9830654867f42d7f7fcce78a173e3551686493c1d9e670e548cae35b0c5e9a03772853f6e2eb965513dbb31365d984888bac9f331256ac54816bda553fffd910fd46e347ddb9447a7236b08b48d73268964a3ff9da2c330f208c81324d65bf5119e6e241843a2bd4866630e98196d9097dac79e600bca51dff5b2f1c91801f76925c27018e6f2d0df444e2532fca", 0xba) getdents64(r0, &(0x7f0000000280)=""/255, 0xff) 20:32:15 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x4c}, 0x0, 0x0) 20:32:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = add_key(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$setperm(0x5, r1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xd9e9, 0x40000) ioctl$MON_IOCQ_URB_LEN(r2, 0x9201) 20:32:15 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x2, 0x6d, 0x20000000000001, 0x0, 0x0}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r0, &(0x7f00000001c0), &(0x7f00000002c0)}, 0x20) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) iopl(0x7fffffff) setsockopt$netrom_NETROM_T2(r2, 0x103, 0x2, &(0x7f0000000100)=0x6, 0x4) lsetxattr$security_ima(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='security.ima\x00', &(0x7f00000002c0)=@ng={0x4, 0x9, "99e09e9728d8200be247be14c7481e"}, 0x11, 0x5f82d8b26acbd516) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r0, &(0x7f0000000080)='=', &(0x7f0000000180)=""/134}, 0x18) sendfile(r2, r2, &(0x7f0000000140), 0x2) syz_mount_image$xfs(&(0x7f0000000400)='xfs\x00', &(0x7f0000000440)='./file1\x00', 0x8, 0x5, &(0x7f0000000700)=[{&(0x7f0000000480)="7b16c3abd554403d93bc9cc1c24d6ddabefe2e57dea24c9bda4c25a6c6d2c286fda08cf301664b7b89c28e5eeb7b8227bc0fe5207136fa899dd7d38b846cb838c9", 0x41, 0x1}, {&(0x7f0000000500)="d536bffecd6d573b12f03fc5734f9e50ee4283f9b969a66937891d89f2485f59d61db573724b828ab27f03461ab2cd16be9e55d940209bbe8eed6ca2729393e54566b74cf153a2574a7c076f9d2762ab256d93747aca851510bc45b136af25245018f8b99da90bf0bfe79a3915f9fb6af3bf266c370806b8eb21fcc66e57f0", 0x7f, 0x20}, {&(0x7f0000000580)="f859dab096cb1405219335759f6d6da89243ebcb924a4a0e3b8347f5e65c793d3c69b6bd7391c3be07e4d344ac1ba6b9b50883bcc3ad877f93f026d2bd66a9d816b0399851a5c08a69fa9f226f8fdd9e2e3e4b84e50598f710c617be5b2ece736a82b63a2c0ea192cdea2e8d5946db90a39d786c0359d446a1a6194b2ffa19de5771a919cc76f2d48518525cc3d59b8dd332030726f505cd72637d031f1b2aad5df9bd4aee1c61d18e7147408c6f3f8862aa1de4437cae8a584a2b68b9b1", 0xbe, 0x20}, {&(0x7f0000000640)="a61208724b5e6702f3236f8ff6a2c352f09d72bdedc07af4a350f50efc89fa3aee5c31c7400d94ce879b50c4f02787e68626600f817c1163ab17f2067da294dfe85641d30d6a11e768d6fc690780da346c73d49d515e7fe15ce5458b", 0x5c, 0x4}, {&(0x7f00000006c0)="a474b17ce8131ddb00df95949da606c5f89b8dcae32e3667257c4a7455a65b", 0x1f, 0x1}], 0x100000, &(0x7f0000000780)=ANY=[@ANYBLOB="6ec87dc46f616c69676e2c716e6f656e666f726364d15c83766fff6e6f61747472322c71756f74612c6d61736b3d5e4d41595f5245410000000000"]) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000300)=@assoc_value={0x0, 0x5}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f00000003c0)={0x6822, 0x5, 0xd8, 0x0, r3}, 0x10) 20:32:15 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:15 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x68}, 0x0, 0x0) 20:32:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xffffffffffffffff) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f00000000c0)={0x7b, 0x5, [0x570], [0xc1]}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1c00}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01007ffffffffbdbdf250b00000008000600dd1c0000080005001f0000910700220000800000"], 0x3}, 0x1, 0x0, 0x0, 0x4000010}, 0x40) r4 = openat$cgroup_ro(r1, &(0x7f0000000240)='cpuacct.usage_percpu\x00', 0x0, 0x0) getsockname$llc(r4, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000140)=0x10) 20:32:15 executing program 0: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000001300)={0x0, 0x0}) r2 = fcntl$getown(0xffffffffffffffff, 0x9) lstat(&(0x7f0000001540)='./file0\x00', &(0x7f0000001580)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x1, &(0x7f0000001600)=[0x0]) r5 = accept4$netrom(0xffffffffffffffff, &(0x7f0000001640)={{0x3, @default}, [@default, @bcast, @rose, @null, @bcast, @default, @remote, @bcast]}, &(0x7f00000016c0)=0x48, 0x80800) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000001700)='/dev/video37\x00', 0x2, 0x0) r7 = socket$inet_smc(0x2b, 0x1, 0x0) r8 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r9 = gettid() stat(&(0x7f0000001740)='./file0\x00', &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000001800)='./file0\x00', &(0x7f0000001840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = syz_open_dev$sndctrl(&(0x7f00000018c0)='/dev/snd/controlC#\x00', 0x88, 0x40000) r13 = socket$nl_crypto(0x10, 0x3, 0x15) r14 = userfaultfd(0x80800) sendmsg$netlink(r0, &(0x7f00000019c0)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000140)={0x1190, 0x21, 0x1, 0x70bd2b, 0x25dfdbfc, "", [@typed={0x8, 0x24, @u32=0x9}, @typed={0x8, 0x8a, @u32=0x2}, @generic="1b83d765c1e1095c240d8807a774160c142685f9a05a3ad16031b19d389badc92be731aa428c012d22244353727ed289a1275e741d14b78139642fb396e8c276be18e2dc24abf462c6c7bbd75ac14b6171b725f42f570454598885a0ff56b76cc3e618cbc9b230ef884570576ef9f8e107ec542638d5a83252bdccebdd5a41f34fe4", @typed={0x14, 0x54, @ipv6=@rand_addr="6cfbf6898caa056f79c3369a4411ef1d"}, @generic="2d7687e4806747c2e52b45ad31c56654905e934117ac16fcaf374e6b823fa20bfc410c311f9a432d9d816a0b024fcba62d928b75f0c67c8e26d834b2042bda2966c430f8d58b4e3affe2e00670c9210c21aa667e707a3ed4231b4b3931a11c74a343d930c5427e146eb0bb520927929ab5c8b0c82050eb1e7e6be26e2bf41642c7cd4f45e212ba199ad2c94e057a038cf6f554ad27b2d8e64e2a9a285ebce421b7a53b64eb473c1b5953ca0d318f14ba576a52ed02ea55984bd546199de8b2d88e80adad0cdf1abd0e44d400cc82d4cd828158", @typed={0x4, 0x5e}, @generic="c9fc5931b3f128bea0bbb192fcf4c89a014567ffde7d0d39e601c7206c4930082570c75809ec4ef47f09bc4f65dad473b8efd0971172d8ef947c7c2ea5b048718630acd75ff4c1384f24259bfbd922ea0ff103187c05bc84856582bc95d0fd94bb08669d6c08d3e04eb0d51c206275e2682235bde49c412bf1118b93acaad6318837a44eabf2630cba9500aebd22c70788cf5682ef96493fd4473ec4e9a66c8ab7c2dbe98b4f58e460e2209d8d156cc02cca97f2e657c4c0fb8673d86da0433e8aae51c4de08312b85e0e299bad81d79b14a8c710c7345f6b054428f4d13ec1f194b5c4a26f7de9ff24a5c25b20f38d22edae87f6d10cc5b46e082c9f86a0577c40d599110bb247f23ced63272aae053a9ddb4da6b1720dc55887e275114d6a4bead3ac9c6a638e593a74d2892236e24377c751bb29272eef4d6c128134bf3a03d6b1fc01f57e3305d8e755d3591046ea95cd9df2a1cc1ad15a96518ebdf207e77f2c0531e3dc6e1fe4dc0efb78b5a893ec078df60a2a318f13ecd3043f48feb694ca39c05a6816d709f4251f9013a34c4c94e5164a8a19a5b26174051c91e0914baeef0c61d33caaadf498e8f90d3ff152cb2a1651a76311912e74b78b67b30f1259f22402157a6a101f63df97ac2eda5091ecc02b22c4c76bf1283b62e7b6053e210cef020e2f6b1025e6a22e8c8b4d0e26bad36457649826175513bf4d6052273bdfa3986ab9f2494e5fccd8460facc71340b69f7094f194b2d93179462868e0ec8fc17867074a762ba0d3b0b6c40f7acaf251f5ff10e2bad4435db6ab1efd2e489553670a0b7c2f4a343fce0cd75f8a159b6a14b083235065ff8df141ecd6b028d8cd052db6168c73b610cb37922c4dff29ed12c76ace3c56e2c38e7947ffa051981ccaf962322ad8d320a176748db3ae4b50ede9615eaeccde7014272c16571a0ad4626e0f0be80c2121973b32efa17d36bf683a1b9302d9bdf5e8c248f077cca1faa39fac5e1ee2f08aeed99e45326e383be824c49b82d94a3e7d0ab4a254957cabf65bfe6e2776ed0a57d360430a965ff653960b63defc647108f727f77abcbf7fc8f29d62ca2fe0366a8b403cfb965a352fd47a625986d539c10c3eba81e3613149b228f2ffbe5e76c340e13d01a80d56f5d7c21c9e9f10720272a868c54f7d51dfefee45988d2f645133ce0c9ba64f76503cbe79744be9bae0158928251326972c5ca2b010c39d2a2c067c7ab20ddf8a3f02f30eae7ee8c76e35737cfffa8b9450a110a5330ee0050a70ccbfc6f21cb133e9d8bf9e3d6a17efdb7a5b3fafa030cf20ff4a45f49037906b11c1d3e50caca08d4f6992499adf139f12a21ba6bf2a8bc65a006f01c536bb916634f7f5b2bc24d52ec03af1e72fc3dd90230f6c2e92a40f0bce9fa7e8ea522056f13739bbc7260ff1a0df9b7bf99c4874abe1f9a2b1d99040b96867d56d7e48e88ac2a4d311173c042e914ee76bae2d9a6296fdca6c4aaa4e8a81cd567cd5efe68f4c7eb39c540e8994f427f9b16e79561f6e1e970f551532d24275414efe8dcfb68f7012d1a93488045cfd90eeb1c195e5387b59d7d11a2ef7c7d418c200ffc2404b75d9c617b14e4772ea051670546f5d6731cf47f1464d692a4f42a98e3234ee47f24c81836193db89866c96b0296deb086c4583bb3f65f7f9c27d2814c72b0460cb19b4f142545fa0457291797d41c1faacb201da56a3dbdd586a5606b5bb60913593c1e1f684865741d553bff391069690028da5970749a91e2298a6486b43c14abd1c8c156daa8b7e27fd018e36be0b421e2e35351be9bcf0cd0324cf28261918a90afbf5234393266dce2fb7395047649f76b0b38a231181d9c6453c62ccc0df39b2911f45c153cc0bc3878a923b24c92aa9f8527ca10bd1224194cebc50b5be04faa5608901deb6e64a3626853a634effebc446a752244d33fb7a01fe918b92b079bc5b7c788e9d0de9de4faa5423acb7137830b44e05c160c857518171056488c51fb352dc084ab1452c36aafa3db5441c6161b73c58b8fabdca7e26098147d2a5b069b8da43e37d5d4d9def501797623611a40265134d6faea7e5f7f3dfca36f114cd65424ac62fd88b8a32bb5b2cd9e47302abc7953756efc48cb35808a34146777e4695870326027420939af3718b7c3d7b5fa39f2ba5b86813401aa317eeceab749eae3347cfe092477133dcc83334c145f59255685d196f95fc31560a20b45bdf73b51508b19da3d55f7238ef61ddb19cdde5793cb66df3de8bc974e09040a9fa034c4c77dabe9a097aae4a587fee8ae619e179b41454931ea157ef36500717d87538911bb8d2191464958f460efb23fad5fe45d509e3d9b4cef6d2d7490b2201c5a865ff72cf41bd60ef8fac63edda4295a5514989bfd2ebed3a7a4086fd40e9761429e997ac7f60636e74db2fa3cfdf6170ae6ca57e4d0fee3ad5e16d79f76feb755f1853eff307435f359f02283762268f818d6fae1ac0787aad97ae6d5606de254df1de07093267bbb45e370c85dd763067f42b4ad9af2504661d368cce91caffe911bd2f35b9e54ac75519b9255f407c069dadd6965da81279609a252b55dc5cd43abc1d0cf09c82c16887c64b53291cd3379157e60f1920bce60bfde31f3769539139b7ec2a8c970b930ec585c5d3b04d198aff8db22f83c6f3536bd3ae29bd07d772441bdc7ef8cc7ebd10ca91fb86ca6ae1fe0e8bd12574b8f8901a69cc39ca51a8816e6bfff3bffd81316daea2d1899841179dfe0e26ad9497094e6344645c3793bfd6682650796a2c5b43f83baa516de511ae7df1ef012554dc0f3c57e00dbc4673bdf76401d78d04e5baabadf146bfe0ab31848848b3ce5411eb9a4e2eda32d28bd4b5caa62ff1a41fdf1d4336de38bfa8853f3bf9039703e7663eb7ca23d55168e8b8ff4cabd8434820c0f6ee3d58b055052dadb504fe463e768a918b3226763960d908f33f53550d37d71d61943b1a8099b058a53612af0f3481f8a010094a158889aa1c924862496942c2d685095991db3c353faefa51ba4a146416f81cfa2d46fef5fc5bfa2824a1c9307f1564e0e1da081dd4f2ed3308e03e57009f7c0885d36dfe0a14e696ba2ce84f356670bf9c6ffa2574e4504e2b2b60faff595456eb2108ac587f1d7311ef6844ce18609c36de87b00596d9714423b930dcb61a300e2603138135002088d6d53aadc5179010388cee36e9209826e7805413f0c97f2268a27407e527ac3e64713f9f7853e2b577c1f034f6b6eef4f945216d2075d52f08e8adb0d4334ac3c6d7af6626d953ae78c6e3d53e19424aa81c4646069138b36c488ce34417268d90ad0a1318a1d490f9d943b69aedb0bb1415fc6b63623223b3017c0d036d1f34ecaac250a44b4413b4bd8e0029c8c520db3432abe842288f4bb086fc84c8b377099a807ab4a5e3907aef017f6cf62f438a8e1614b9c171fdd2768adf3d8aa38e6c195b2a4820d3ee94fc8ebaf010d489d96441a2d6a038abb6fc813107f315c3e10f113808d443d4ad509c634bd27946b019154c959ab4a8035d707c8443ea3be62f4ffb37a8183e8a0728884a2d903ae2930ef4ff6da90e7c3880ae346a51f5c59a51ddbc41d11d2066c911ac7c30fa91b8d59bc70c13c91d9e1269af231222ed34ff82cb058773acfad7aee6290f4a001ec7bd126d5d0195ecd8cb6232ff0cf6560d8cf5e74c6a47f49140a1a8390227dedbe455eb3db956c48f73a84efd8fc8574cda94130ab762fefa8fa4075485639474f635f5b42cdcb3fa39d87d10f5f1d2127004a8a72dbcf9758bfadaf739f1ab15c2a12adf446983e240c2c203572a97efba4fc4421bae2b1bc0f1ec99d81054b96b3382465c684f0920f3625a3dcc9c3ad6ac203203e7fc2c203b59ad6fe855161944f3018ad3934cf86d64072b1ff0882ab1767c8ea011227369c74cda6a3d3fdf67303deb9c78113d6ed0e7cd2331d87575befa08f8a1ad64fe82957d66c089ab22032cf215cccf483f1f8e1052d676edfc5332e240dd93a933206745ec1e01a59d0b13bd86b07c0caf06a1e61f3abc8cd4a27d959e8423b1ebfa59d68d5a7a0e467509a50cbc0c86684dd69d73576e44384890a57b4709762a9733f6c4f9c47d50794203a000bfceb2eedb1b5d12fa9bdf89943ce3c08928432ab7b902481819013d6c137639dcb9a3116897d70bbe3e6475bbd92dbd3a7d3e738d276d2703531c81f8052d2a381f3e01117682e2b56db677a5fb09f64f22e9c88325620f482318c4bf8dc46ef8b0f8eed0b6fa68dfcabf38938c79d502b9ee9cb781b9360531fc33744ef53af06ffe0d45a8e3c56778003b2ec2d81b23015e336ab12164e4af15ae5ab10579e2a5581456867c77f8828f75e7ca42b2301b2ab8664e2978230c88a10b464fb15a27ed2d5c4d652c19495db5399db4bf38b63a4f4194892e3fbbfa7da0f9ce1f22682c4df02f60ef28264027822a1bd5dda8f29948784648e335405c01be338da0a8993cba213bb47c9f82d7fcef0e77af95f7c228db2a14c00cf92c9b3a19bc8beb5b3237be1f1fc51e004da7a408078a8e61dc138066a2e01419923f029dbd20e2cc2bf3557eb9f1976617495b0417b9dc268296850af7d8eb537a9472af043027900abe84f7848f4cdbcff26c8739fae38be018d252103b70f58e7d0d005c25d58bf1e3e22998e055063e4f227a010be25c87e5560d9d309b0a46979701e14c2663b871374d6c4b80df57a242bd21aa1e0f05743eeb92914d858100bb6d9faa9d8f21d3864eb192d482f53fab576224b3ef39f7c68a94fb70898ba0d615c5fc9797120c64d661a3a56af48699ab6b8420eac1cb56fffa9a5a397d19a7f6db1e1cb880b99b4ecd36ef98834e529bd736e3c90072964f3d6a099a9685739f8a745eac99b84815e6a194bf76b229ce3d7e77e5b518b508891e1b9309f2b460048de2dc386996d7d4e7285cba47aa5997234b7a0022c84f43274210a82ae96bb3e67cbaf19de3980593a864f7a78843383c735257c3b0cd1f9d908a47d368a663f39e04e477ffee104e9ff6a157aaba4ad95449091951093cfbfce70e436c4ca22039f37e0e7838b30ae712b041a18d510435eef6dde336959f64458ee566b1b5d2930cefcc6ea7bb5d4076190d8a907059993a46b39cbc43f38f07f74424e657d222c124e2db8bf21d0bbba85e78f138c74adaf1c32dd9bb10c943c5b58c138e10dc35315847cee87d29d011476c5a26f648c52edee30371c9cf9093c98e13f60f1401254de7c25876b7ced4243a22c840be9dfe3e317645929c0250708048e0a5aac5d5e489a430bf5e3325340e8a4dad808c14a0bfdfcb1a37746e788b37fa4fcc8834315e7cbbd2aa2a0d8729611b59de3ee3dcb80868028cd4f031c144df2397b58a05d2c0923dadee21fbeb7020e2556a1874ee92de24583225b3f557db3da5803c6e881afac4521420695784068e56bc89f3096011ae5e51a732e0b5bd88a4309d8bd567c5d27b2447fb6ca0ac996e8315b21e7ed33c42def3161de6b645d58b2e28ed25aca909cd5719ce35f24a2ebaa68af078bc8d2742533f606a3d5f3af34c29109a254be020f61872adbdac2fd1b97033da6025f2aae0cca4fc04c4756aa8a51d94a6565cb4c04f20f048a9ee5e08ebd88ccdd8f0436faa3a001f6fd7c09a53149319eb0d9098fa1bfbcd11806c812cd4743e8ae8db5ccd3ad9a85a661135bfff7d16baa2cac2b114626eee08cd0ada709be6c57d40bf8116a3e569f"]}, 0x1190}, {&(0x7f0000001340)={0x18c, 0x28, 0x200, 0x70bd2a, 0x25dfdbfe, "", [@typed={0x4, 0x7e}, @typed={0x8, 0x72, @pid=r1}, @nested={0x170, 0x60, [@typed={0x94, 0x79, @binary="230dafbf45e48f505565cb2f7a0a1d0944aae530b05903ebd7332f4269dc068c01a9eeea47f221a11a9800810c36660662c4dacb92ec3a37393afd783f4ccc16e634e21d13f6fa62989917f166cca288050a90fae1817ff37a0ac0bb86b5d25559dfebc2e35616198356e5408f53588c26b7b1340d467ca99c994a891d8ab72c76a4ad983c83ccfb3e33ed346150"}, @generic="946c1b4c8fbccf1585afa12b92751cfe11f84e018b37146d64b369440d50a6182ff3e1ae29cd912ae844174f9a3eee493f7e4b628923841560f22741762e0a46e1cef4157e34f1b3ce0e5ebdf50a99d9e9fd33e938f17edb18aff9b050807cc47bedbd7017159adec76e281687ad06548b22d250285f311809f0397ba74455c79f65501d72eeb22a3448eaee320d2b2e9a4b6c7f9a87e5315a558b81bf5ab96659acb5d2c8a2cee73cdb06168576cfebce8d7afc29ee541d1f5570a74aa7a4a02a3ebadb6972578a4a", @typed={0x4, 0x48}, @typed={0x8, 0x4, @ipv4=@remote}]}]}, 0x18c}], 0x2, &(0x7f0000001900)=[@cred={{0x1c, 0x1, 0x2, {r2, r3, r4}}}, @rights={{0x18, 0x1, 0x1, [r5, r6]}}, @rights={{0x18, 0x1, 0x1, [r7, r8]}}, @cred={{0x1c, 0x1, 0x2, {r9, r10, r11}}}, @rights={{0x1c, 0x1, 0x1, [r12, r13, r14]}}], 0x90, 0x41}, 0x4000000) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/sequencer2\x00', 0x14000, 0x0) r15 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r16 = socket$inet6(0xa, 0x2, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000), 0x1c) r17 = socket$packet(0x11, 0x3, 0x300) connect$inet6(r16, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) recvmmsg(r17, &(0x7f0000000300), 0x121, 0x0, 0x0) ioctl$FIBMAP(r15, 0x1, &(0x7f0000000040)=0x8001) r18 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0xe0000000000000, 0x1) ioctl$EVIOCGSND(r18, 0x8040451a, &(0x7f0000000100)=""/36) sendmmsg(r16, &(0x7f00000092c0), 0x4000000000001b9, 0x0) 20:32:15 executing program 2: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) ioctl$sock_TIOCOUTQ(r0, 0x89e7, &(0x7f0000000000)) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x9, 0x2000) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000080)={{{@in=@remote, @in=@empty}}, {{@in6=@local}, 0x0, @in=@dev}}, &(0x7f0000000180)=0xe8) 20:32:15 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x6c}, 0x0, 0x0) 20:32:15 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x74}, 0x0, 0x0) [ 350.916840][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 350.923444][ C1] protocol 88fb is buggy, dev hsr_slave_1 20:32:16 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:16 executing program 3: pipe(&(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000140)={0xffffffff, 0x3}) r2 = socket$kcm(0x29, 0x2, 0x0) vmsplice(r1, &(0x7f00000026c0)=[{&(0x7f0000000200)="a88e4fd532d69d5d573207ae91f7e3d730b2e6d3ba2d142647f633be3d4c731277362cc495ad312d8aecdc9e9064bb5656722b4d2dd25f087910a7aa0b9fa69da4eee5d0adb6458cb816655c53eeaefaf6d8dc8e55884ffd44fd79972196a021d2d7a90707f7e6779f496aa563b5c532f84c09df4aa1ec058ed60d3448b6d305c4be5c86cb226cc5fcc895afdc7b0397273653e08eeeb82cb0f53449464cefc3fc06bb8ed167b40133352502841e842633951ddc03afcb235ed9813d7ced337b6daae5db93f23e8d10b4b8b529d5d0a46aaa5950945d93b23bf6ebb04263089c6a5666eb2c215343e85cafe5c15c96227a2543687558e4c10f51dee22d0d268cd0009ff0ef75e415b3f5f1cb452e2b91b41db22a2ca67dcb240fa88c1069009c1b2c7910163a57c4ca75977a87229bb667cec53cd1b1e102a76cfd6602172a36f13f8fddd4697beb54b44d6d86522c3714ae12183a91eff0f9e291a2d0a06612b89a9b7f288de0459c53e6d49e3d3de5e0c2908eb9b153dc304873e6d32b6666ce85fdfde988ee25e64933fef3bb6c38472ab41cc8e2067ed75e526012a6b3e3adc6ab4fd0b0722499337c4aa532389b57047e32318883b217727f44a545d3b81dde79c00756d3550cbcfb6bea83ed2193db16c5b18f870583d60a838e1e640aae18a1a86c3ea1eab30116c640be21d0bdf628102070eed740c7a8cc347995425b1d6604488c18946ef266b17a74b2cc728579b0feab1668c9dfdfffd9272c472851f1ae0890d158e7812263a95025cce89b39e6b0ea1d8f9f08dba3601a0f76fedd1db70d56f4046b63a81baa87f11a11fdc6c47f2d46fe997166b48c8bb3d5c6638344efd8ee47230191229ab37796c49e6e56ac3cb4273cd0112421124fb51c0d86253beadeddc80ce7034a8e81bdd9fad32bcf499067358ef43e9e995810262cfb62d20d6ebe943cbba64ec1a1aabb895501d81fadb72113ca9de146530b73000c8629180022fb8117e2f96a77cc0427bec362f35b612b19f14322be89b2e0ef61e2e81d5583ce1985e7ff91b68c4101f93096246b52dfe84b5d132f821dd77985fa77d472220c66c92cebb8a0c8d779fa69b414af766df02fe29fadf0207758600ca23d39271d829509d5aacc96f182a1850c9b430d4ed33264c6b1ed8f234f866608042e05ec4eee9cfff63d899b41459310f11703554a46d529d013c11ab0eeb63a6442faf38a3dace2b71d67f3798db0eb6ca31256cb8ea18c9a5093c23eaf849104007f9cd44a9946bcc9b783e14a58d71dec8649c672e91b75c572fd68d7a7944a35e41c83fb7b91cbd16dbe394536f4c1fd68a026df8b46b4d3594557087d8eb865490b08e769db1f2b34ce038ec6377cf5306b6f68ea0d60d146510224a74c501942aa5f18e4fe8ef7d0dd940b2ac4ee9c2ce22179988db3746352ec51c9e0094904855c33f1904bcbd92255abb783fa878a948caa6e71be70bda6503a01c08769bc33695c1a668ccf83fb8d1e129c2a42bdfe270623273ab47aae932a0ec4ad86f60e65997223e781ab864c5fa7d6f6db6fcc941a2216943899a701468e20298586f5bbfbc049db9d86469460ec6250cd0cdad38a16d30efe45b8e4289540bcc48b94792f37f2b167392efc24606fae93a0877877aab45632c894a19857aecb2158eaf1e21d710d90d670c32c57d4db48ce568237870644a098d0427d340ee209206a3249793fbe4b98f8b3aeb5b943dfa11a1d2c087c2bd447415529cab0155abd3c5273b3798f1dab40252df4f1ddb84ed19e9eb67e579f1dfcd8f7de3733ac30699ec7c7592e5d30eca7ee29e88dc16b1850f91437e3563eda2fdbd5d0831d830cac6ea3d9e98b75e564149cf51ce895d524ac7ed8ef3faf735d6f072ff2ae11d6840e05b5ddc6f57ca7c4c1322fff65de59c2ada2a50559240c46d77c4919e8d596c005dab75c1012a16bfaa2d09ff377259e9a6e39fc14dea7a103299c78ea8e6fdc60c0a0a5f0c75a6a343184c9135ec6def6e8e0408a88b5622d649db47fee761576a1f1e0ce09da35a948c6ce76a230c60bed85ceab865e7a66bc17d53c59932e193f23ac93115ef368a0b2f560ecf8d3d51390510ed6a8383fb9bac27c7564b673c545e258298bad00e79d9ca384af3c8e283e021a1318ccc23e26c2d4d2cc19308150c45e56410eeba0359b4d57482a0d7c2c88a287f5257ce24dd7cc7300b9d4346318244268f51352c5b388f274967c04ab2fdd77090c61ec0e5f92f5ee09ab0dcfbf1c447f8734f5cc1e90324f1c9cb8294119e2ce71a4ca7c3485c1114a53f86d7f28aed0c3c9d203d3ad747f0531c44b7403614ca22c810c8cd35cd33f04273dbdf7a2fcb93d2e6c5976129492049a751a5484f2682ee2b77ad879f83901de6a8bc6d7e85c39243f0c801309982c0bd98a87cf506855d2ce4cc4329df110e78b0b153fe74bddb78924af0fe4aa02283e69657739f43325653d8ad91c2fc6867bc97f0afb08a7ee4d5a4af4ec0e6bc9f70d76f9c2e25ccb08f6869566ccad9bb91472de406fa19d87f518560953207522e895a0d4761dcea956057fa0c169cbc7c4815636aadec0c1eff1e9a00835ff08aa59796c32a629ac83f0da6627100c21567002a4fefe3ea55d303194a48802acedbcf53c5dbf67a2fc872ff91775cb165a2ec1d0f85a328ce74cd5bb2682364fac59588aa5944cf087df59e323df1a50c05a6875e998486aa262f8095218f366ed30551203e92fdc7d2ffb219948e2616b97fb48b39b5de11d59323ca5dba7e3c4b0d21ec0d8823d28e117d40f72e367e99d283b4a0b2572c2c4e9d0375f4ae39fe9bde0eb75793074b21feb446ba2cd2f31bfe16d25b8ef799c51b71218a6c70652346c286c45a2cc49c00963af5ca9c517512e6b2b229a7f98b75c71ba326a649bd159a72cb973c34eac8523934321b5faf3933c16cfc40942fd5375d5fa1dd59a298e756499823e6456a013ce7be260d4e5276c1a44c550079f16f4504e0e3c6a89cf663c2400792ffc4bc426d8c70a44fe0328fef403f054cf590693a253b8e223e64ddaa80a595b4c8e905ae54f74eec24d9df75900787a53f060278a4a2d386475d7d5a6a7fd985002b45fe8b38332afdd47f9b54e6daf7f17bd5272237b4d666ded7e179267df6b7d8f9e49260c728096e792dc55eb9c611d06d4be586b4ae9cb67cc18b2451f9728d55e9d07db42e6761e19e2d2a78746b2f0dfe0bd21b323280f4fdd32c7f2958ab9f083328edd3a91a64cac5123e05358356e89e7309567b9843efa6f5eb136a86c59463e80a4821c365fb5dd22d33357874cd1ad862d33e7c7617b0c4ee35f2d1afc51c49de096323664b1f4cc3250650bddc589595a96c88338223a4ce56d6cc4900963811baaf97104c41a19d039506b3948c15cab187421f7a74a0870f491c2d25b66d40e18cec50e9c97fc43fc55c4906390a9ed5af5f4c6a4dcf053e07b006c49e0bb30dc6273157b03d82e2cf58ab70cd56f786e0d9cae9cb2d59ca9978d8868cc513c1e5fc7200bffde3c9b92ffc5edf58064fd262b34836434448084fc21247fb2d4c0d263b036bb143e28e941c8c58a373154ea604ef56002a2a8e0fad2414b551dfcd7c36d31fa8cf92e3a6660d447e261fcfa692889d4333ab562cb19d6738459d1b2c5aab0bc3347816e07b63de6273d846d92b08f2a8f42bf78c22a1a00de460fa10d7f50f5a8a09b7145c1c35716d24dbe9f7b067e3e8d3cb31468878ba0aa8902f4a5d3a1d20341df27f7fb6efe527452252a778868c6555ce4af5afebb503f558af0bbb18d06c46a67bdef3101fe9c8e335e90dbfb52e410233f72c4648e15c70f388cf4e3906ad5cb4f7a854b4400439f9816f433d47af01b637e161a6d7c960b90b18d06a5f5b02b2fdc21ae75226c396f2a645a2bcb2bede41561e442b29b1e8435fbde8835e0ab876b52b7164997a80a5833536440dc49297c49bde70e9ce4159c620f82ba65336cf6bc99bb8be955dbff98daf877bdd9b087e0b963f7e48d467e74719458bb368a7141bd6e25397fdd5cf6dbca7057cda5be18280eb4a387748336b1d6f4af57a3e73bb4026e1ff1eab218e73e2a5462c8f352355163f30a4bcc295e91e572229e4fb72108640e40ee14325308abae386d357b12816fabb2da089a5b9b1ddda8b55de12bef3806b606fd0a94ec34de66b8818d119730d3f2e4535d0e4cb7efede9c8cc1efb5798003272d8d951fd2e65d5b2fba0f53d714863b22fc56c25e5296424dbc232e19d8db2dabafdfb37b8828696b02fc644e87ad60726a756818fbc5074be4f3e37a661c261264ebf03364cf46727839478bdad230d3062805aca9355ffebc12bf4aa4a81c872ffb91947ee9c3847f9b81a520960daded5758a7683c7a50744b78a221810aab2b9f11854dc5b0923157e4189e9b699703404b4b21f9230f5497df914f17cd485d859b7ee8199ef3c59b0d9318c23e53f12157891b43710d6b3314ccd1c9420006414f4b18bf811d411f2bb29b8f0aa4779d577b36575535db897ee015b410498dc1a14e007c2b63b273a91458607fba6aa2f5e799f2a10975f5f56cf4ef86291ea4a00cc5874756976a8fd4b3dd4d445dc1b3024256043b14e1448629cbfeb1bf51bc909958462e02b01886c8e496468c1c2659f7572b798aecc5577460bb202798c67a4cf2f14d94c650647dfeeb645b6b994cf85c77ab26b83d71756c3184105dc71752e126c19583ec2ff3bfc0ece18f4694477cabde7bd1b2554c234c5350aa0a1775a98298949f752a8a74e0c893beed1c4db47adc0395f16e99342eaecd574e1fedb9bdbeddd5819de2a8edfe40893bfea5a775589f8e59a2f0d8cbcbf3789d352423b17ca39ab15da139a099294bccf2a3bfc3acf42362c3a0614e68612ea2c4458238e7c6c6c3a7675de78b66ed1c96c84effe6b3e965983303920e3e4d584c142937c45e8c252611b1b22c122d0bd226aa82c9672dab63e395206274e88c969925adc5632bdc0fa3da55a46b713f971bff2668dd06408", 0xe01}, {&(0x7f00000012c0)="d7", 0x1}], 0x2, 0x0) splice(r0, 0x0, r2, 0x0, 0x103fffffd, 0x0) ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x1) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000040)="8bdb6ab230fcc95af1a7dd741a9b54b1d34e009684b51e87de5f963ee9d0962d0d2ae0eee1d5bc4da47198c8dafe365efad8af118151452eb46f252d961e803044498186d0de98d7866fe8416aa2a731566572a4550ca9032418cd52cc66d6c2aa297a979f3a9910b4cee8f083a6f27a7704aaed5142063f4888a052113b4a2f2ec91554437647e76a5bf84c0e85a4b0248a9281144125eab86d1ea6b9e283545331a9cb18812b2583da5b527ff5ef50e3f3026dc45cd59a912db06cdc8c2cc059ed2c63008da075d40eca81d322cb96f409931087e6e728277fbc27665f8320ade5d6ec4509f8bfa83d9dbf1624f175aeae41063e9ac256b0d028b222a742c9") 20:32:16 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@migrate={0xac, 0x21, 0x21, 0x0, 0x0, {{@in=@local}}, [@migrate={0x5c, 0x11, [{@in6=@loopback, @in=@local}, {@in=@broadcast, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}]}]}, 0xac}}, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) 20:32:16 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x7a}, 0x0, 0x0) 20:32:16 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x300}, 0x0, 0x0) [ 352.273097][T12855] IPVS: ftp: loaded support on port[0] = 21 [ 352.354442][T12855] chnl_net:caif_netlink_parms(): no params data found [ 352.384034][T12855] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.391483][T12855] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.400913][T12855] device bridge_slave_0 entered promiscuous mode [ 352.409338][T12855] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.416477][T12855] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.424429][T12855] device bridge_slave_1 entered promiscuous mode [ 352.448270][T12855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 352.459569][T12855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 352.483670][T12855] team0: Port device team_slave_0 added [ 352.491224][T12855] team0: Port device team_slave_1 added [ 352.560116][T12855] device hsr_slave_0 entered promiscuous mode [ 352.607295][T12855] device hsr_slave_1 entered promiscuous mode [ 352.647052][T12855] debugfs: Directory 'hsr0' with parent '/' already present! [ 352.663565][T12855] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.671098][T12855] bridge0: port 2(bridge_slave_1) entered forwarding state [ 352.679009][T12855] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.686408][T12855] bridge0: port 1(bridge_slave_0) entered forwarding state [ 352.726018][T12855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 352.740337][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 352.755943][ T8922] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.764242][ T8922] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.774213][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 352.786601][T12855] 8021q: adding VLAN 0 to HW filter on device team0 [ 352.950179][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 352.959727][ T8919] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.967131][ T8919] bridge0: port 1(bridge_slave_0) entered forwarding state [ 352.979002][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 352.987768][ T8919] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.995196][ T8919] bridge0: port 2(bridge_slave_1) entered forwarding state [ 353.083111][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 353.104671][T12855] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 353.116202][T12855] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 353.129429][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 353.138463][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 353.147152][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 353.155944][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 353.243495][T12855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 353.252296][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 20:32:18 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:18 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open$dir(&(0x7f0000000080)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000180)='./file1\x00', 0x0) stat(0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="7472616e733d78656e2c6861732da500"]) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f0000000140)=0xe8) mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file1\x00', &(0x7f0000000100)='9p\x00', 0x100000c, &(0x7f00000002c0)={'trans=tcp,', {'port', 0x3d, 0x4e24}, 0x2c, {[{@debug={'debug', 0x3d, 0x20000000000000}}, {@privport='privport'}, {@dfltuid={'dfltuid', 0x3d, r1}}, {@nodevmap='nodevmap'}, {@msize={'msize', 0x3d, 0x2}}, {@loose='loose'}, {@debug={'debug', 0x3d, 0x20}}, {@mmap='mmap'}, {@cache_loose='cache=loose'}], [{@subj_type={'subj_type'}}]}}) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/null\x00', 0x305400, 0x0) setsockopt$inet_sctp6_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000200)=0xbc5, 0x4) 20:32:18 executing program 3: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) r1 = dup(r0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/4\x00') ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f00000000c0)={0x2, r2}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x4000, 0x0) 20:32:18 executing program 0: r0 = syz_open_procfs(0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x1b, 0x0}}], 0x1, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00042abd7000fbdbdf25010000000000000007410000001c00180000006f5f62726964676500"/50], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x4040850) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$keyring(&(0x7f00000009c0)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r2 = syz_open_procfs(0x0, &(0x7f0000000600)='net/fib_trie\x00') listxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000a00)=""/4096, 0x1000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(r2, &(0x7f00000017c0), 0x199, 0x0) 20:32:18 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:18 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x500}, 0x0, 0x0) 20:32:19 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x600}, 0x0, 0x0) [ 353.641566][T12871] 9pnet: Could not find request transport: xen 20:32:19 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 353.770553][T12878] 9pnet: Could not find request transport: xen 20:32:19 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x700}, 0x0, 0x0) 20:32:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) write$binfmt_elf64(r0, &(0x7f0000000440)={{0x7f, 0x45, 0x4c, 0x46, 0xeb45, 0x2, 0xff, 0x6, 0x80000000, 0x3, 0x3e, 0x3, 0x258, 0x40, 0x19c, 0x3, 0x200, 0x38, 0x2, 0xfffffffffffffffc, 0x6, 0x2}, [{0x6474e551, 0xffffffff, 0x380000000000000, 0x1f, 0x400, 0x9}], "81cba267a59c3e6cbe24bca1e02b8f073898e01b76bce90059c62a02d3d6998f0be89e64e98f8d46157fa9c636e0027c01438884d01ff5597814a331d462df3a12a2e72779eb492b532e62f7dc667123eaaadf96b295f1be2bdf1ae1893bf0fadce84de4d422c2b5bb8d8a8c3e09b9e8a07dc6adb06f0ccad3253626084ef191c2aed05b081996bf76aabd03263e657b7836437cd2b98b452def58516af98d9c76ce8c1748321c86dac434d0ccc7d8d4ec22139c8c51d7ad40e4e11812ebd12e547fcb1d00ac68e751ecad4fd740aba4a83d248c16", [[], [], [], [], [], [], [], []]}, 0x94d) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000240)={0xa}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=@ipmr_getroute={0x1b, 0x1a, 0x525, 0x0, 0x0, {0xa000002}}, 0x1c}}, 0x0) 20:32:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) futex(&(0x7f0000000000)=0x1, 0x3, 0x0, &(0x7f00000000c0)={0x0, 0x989680}, &(0x7f0000000100), 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000010aaa0388d4378154009ddf407000000bad032a81b5d1532bff3c191849f7db0c9effcba723ed0"], 0x0, 0x1a}, 0x20) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0xffffffffffffffff, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 20:32:19 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0xfffffffffffffd62, 0x2) lseek(r0, 0x0, 0x4) 20:32:20 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:20 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xa00}, 0x0, 0x0) 20:32:20 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r1 = memfd_create(&(0x7f0000000280)='/dev/net/tun\x00', 0x0) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[@ANYRESDEC], 0x14) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f0000000080)='./file0\x00', 0x100000001, 0x3, &(0x7f0000000200)=[{&(0x7f00000000c0)="60f06084d90686da5a945082c875f4e4a89d946f4b5a460cd8644b62bf52caae3ffd3c32430cd64c88", 0x29, 0x401}, {&(0x7f0000000140)="60f653506d90a82652a3", 0xa, 0x8}, {&(0x7f00000002c0)="fb90ab5fa06a179f06f68e1de4fc063f688aaff068b562709e87cc05e6a13c726c2229dd577c8d576fa262423f0854b1b7bd041263e3ce83d91df573692bd4ea324971f0db3e00bd1e55d97c33089869dad8f2c93421fbdedd5af3523558c2e11a1f9375835e341d69558b979f781fb656b3bd301049f41115319a615ca303e93860f7003c38b20a89cbce", 0x8b, 0xffff}], 0x800000, &(0x7f0000000380)={[{@mft_zone_multiplier={'mft_zone_multiplier', 0x3d, 0x4}}], [{@defcontext={'defcontext', 0x3d, 'root'}}, {@func={'func', 0x3d, 'CREDS_CHECK'}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@mask={'mask', 0x3d, 'MAY_READ'}}, {@smackfshat={'smackfshat', 0x3d, '/dev/net/tun\x00'}}, {@obj_type={'obj_type', 0x3d, 'cgroup}\\posix_acl_access\'Ivmnet0%\v]vmnet0usersecurity-('}}, {@measure='measure'}]}) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000000)) 20:32:20 executing program 2: prctl$PR_GET_NO_NEW_PRIVS(0x27) r0 = fcntl$dupfd(0xffffffffffffffff, 0x1045aca46245d7a, 0xffffffffffffffff) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000000)=""/110) r1 = socket(0x1d, 0x0, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000100)) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000080), &(0x7f00000000c0)=0x4) [ 355.268794][ T9973] device bridge_slave_1 left promiscuous mode [ 355.275201][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 355.337672][ T9973] device bridge_slave_0 left promiscuous mode [ 355.344192][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.307525][ T9973] device hsr_slave_0 left promiscuous mode [ 357.347160][ T9973] device hsr_slave_1 left promiscuous mode [ 357.422020][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 357.436105][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 357.450224][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 357.481499][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 357.574281][ T9973] bond0 (unregistering): Released all slaves [ 357.707707][T12907] IPVS: ftp: loaded support on port[0] = 21 [ 357.792369][T12907] chnl_net:caif_netlink_parms(): no params data found [ 357.869425][T12907] bridge0: port 1(bridge_slave_0) entered blocking state [ 357.876603][T12907] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.893109][T12907] device bridge_slave_0 entered promiscuous mode [ 357.903626][T12907] bridge0: port 2(bridge_slave_1) entered blocking state [ 357.916244][T12907] bridge0: port 2(bridge_slave_1) entered disabled state [ 357.926486][T12907] device bridge_slave_1 entered promiscuous mode [ 357.955361][T12907] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 357.975038][T12907] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 358.013003][T12907] team0: Port device team_slave_0 added [ 358.022736][T12907] team0: Port device team_slave_1 added [ 358.095074][T12907] device hsr_slave_0 entered promiscuous mode [ 358.137235][T12907] device hsr_slave_1 entered promiscuous mode [ 358.186949][T12907] debugfs: Directory 'hsr0' with parent '/' already present! [ 358.215888][T12907] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.223082][T12907] bridge0: port 2(bridge_slave_1) entered forwarding state [ 358.230560][T12907] bridge0: port 1(bridge_slave_0) entered blocking state [ 358.237831][T12907] bridge0: port 1(bridge_slave_0) entered forwarding state [ 358.322169][T12907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 358.346574][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 358.363980][ T2920] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.374836][ T2920] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.399248][T12907] 8021q: adding VLAN 0 to HW filter on device team0 [ 358.419792][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 358.436395][ T2920] bridge0: port 1(bridge_slave_0) entered blocking state [ 358.444048][ T2920] bridge0: port 1(bridge_slave_0) entered forwarding state [ 358.474070][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 358.491095][ T8922] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.498246][ T8922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 358.530620][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 358.540168][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 358.549497][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 358.566130][T12907] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 358.579118][T12907] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 358.595089][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 358.605679][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 358.627920][T12907] 8021q: adding VLAN 0 to HW filter on device batadv0 20:32:24 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001280)=[{{0x0, 0x0, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x1}}], 0x1, 0x0, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$KVM_GET_LAPIC(r2, 0x8400ae8e, &(0x7f0000000240)={"bbdcd6a41b25bb9744f1bd7fdf2b84366bea4d7c978064645198d06477c621695a41936413676dd6af0be2cc3177e671edf73295579006c990d9c66c2c325fcf5f62fda36e475ccc499ddbb711dfe2de4a60cc54eb89b8f65008e3650c441380a7c6ecb2e454f185030d33a6a503288a3d72cd28b7dea13f1abf25c917ff6cf53eb798f678e83d2a65ea05397988057faef6ceb6ece5135e5c245bf8aeb699d82b3dd5c78d1437f6306000b93e71051207c6ce4b80435007c2e48110bda0714dfb607139115fd0f8eb620333d83f402c3934ada469c84e36c9df34fe604a955de6e569c116eb4e87f98ee4051b97aa74d8c42ef580fb911a2c9df4d2b4f457f2f682edc8c46fee44e45ee04e8161fd39d479019246fc504a9f7c8a9e9a56e76e36c5b1787f6a56fef35d806fc86155aeaf6fc13d2b4a486f52b14f6b500197dcca660cd6c62cf2e603a37cad94a61ea8fab3905f9a4aaecdf03348bb4ec474d39d7540e73575c4a8f02df03149e067d5356253773f225eaa6ea48af954567234551098044ebf2d92d0dc6ef6251f1903b5b56256f99f26a2a5dd2048b54b4291c4dbe6260857dea1fad2f3e810f6e8b65e06020a9859dc0fca1d821355cbc2ddc047abaf64932e223516644c2dbd4cda344c4d1f88e8a07b9d93a027c0ee735a07773b21b6d74ed61602f20cfc1c76643edc7fc71d8012d451d0847fa6b50e19a9e365ef0aa3a8efab4b8ef8fca61ffd03457c5e07ff9354a7c54dc0fa388c13f3fc4e4ed6480603a75bc5c66473774f0a1c92ebd399b3f0d6c70bae9f4b12cd4d59ce7adc44838aeaea4cb65b6f2cd1c75da3f8f37e3ad0fbb0bd380e8f0ed985d058ab8456e1f2bfaeb328e6d3fae0beeaf2d7689ad91640c09168f76a4ac116c8c767deacf90db65171bb713bc75f2c87a5ef945589bd6b97499b2984ee7865b258d09e556b704080953227972a8cf2912fd1b0c04d2fa9de38ff2c23778f7c4bb8e65e8adfe01dfdc428177e55ff4f8e6f628e05d349e15bdf7c4c9ab38b92cc42c508c6120566a2cc1ab0c56e2150d62e2807ca35aafb71fba0c296f4a1a114a30cdc547642345289c2f0acc815e0782ee6325aaa6bd42c5c4b996df41a5e757e8dbed8f87eb7aaf826ff3b64c548a1a1b717247ecfe3dc5a2610fad15d3474dda9d72121ac7ebbcc27464abfea927c4e4f756d5faf27dfbc01abb2612253b5266867e2c21e2fdbfe3f9a0cc9e25387639ea7d5a0816f4a4c4e7ece4230a56f637242be99cd73c1305aca4d19f930d706f2b1271b4bbf06bcc2bd081792c5385d6c1c873c8d61e744dd41472ce92cf612f31b4c235ca4893be4f69c6ac7023279654674693e5c9a0f81e094f8adf2d0c2f709bc354d84a7f7187f89b3ab10e892be22bb97a4255051049b659d6840f4233c652e68b7e286ea8165f35633"}) 20:32:24 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xf00}, 0x0, 0x0) 20:32:24 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:24 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:24 executing program 3: r0 = socket$inet(0x2, 0xa, 0x0) getsockname(r0, 0x0, &(0x7f0000000080)) syz_mount_image$nfs(&(0x7f0000000000)='nfs\x00', &(0x7f0000000040)='./file0\x00', 0x1, 0x1, &(0x7f0000000180)=[{&(0x7f00000000c0)="9e17619ee121c400b865ed025b8b92c4f06b679fb95e320011a3cf78e4f1d6781a4edec30643360d4b70773cb45467296b671038727228593875f56d4ca88f9f4c323a643aa02bc650c711f9d71e56d0c105a2d771b5d18fda24fe3cd9e53cf52de6a4b4b17775dc1bcdf03e2822d61785ba882f0ffc923a43413990a45ba6353f03f2c54a1dc8bf6b2d77936c4b6c769d2937ef64a249bbf05b7a60bf94a637b07663b5e6bbbf97983ac447d698f655472595e4", 0xb4, 0x8}], 0x2000001, &(0x7f00000001c0)='\x00') 20:32:24 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$KVM_GET_SREGS(r1, 0x8138ae83, &(0x7f0000000080)) setsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000000), 0x4) semctl$IPC_RMID(0x0, 0x0, 0x10) 20:32:24 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x4000}, 0x0, 0x0) 20:32:24 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:24 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x4800}, 0x0, 0x0) 20:32:24 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x10, 0x2, 0x0) bind$netlink(r2, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x100a00}, 0xc) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/netlink\x00') sendfile(r1, r3, 0x0, 0x80000005) 20:32:24 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x4c00}, 0x0, 0x0) 20:32:24 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet6_udp_int(r1, 0x11, 0x1, &(0x7f00000000c0), &(0x7f0000000080)=0x4) ioctl$VIDIOC_G_CROP(r1, 0xc01456b8, &(0x7f0000000180)={0x0, {0x94, 0x20000194}}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="d8608a6667534f47ff0000", @ANYRES16=r2, @ANYBLOB="00052bbd7000fedbdf250e0000000800040000fcffff38000200080007000100000014000100ff010000010000000000000000000001080002004e20010008000d00010000000800080001000000100001000c00070008000000010000001c00010008000900feffffff080004004e2300000800020088000000100001000c0007000200000010000000080005003f0000003800020008000700ffffffff14000100fe8000000000000000000000000000aa0800040004000000080002004e240000080005000100010008410600050000009b13cdcbfa226afdfe7fba4d592956fe0a104aae1da8eb5bca77bdcb90a824b50833"], 0xd8}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) ioctl$VFIO_GET_API_VERSION(r1, 0x3b64) ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x3e) 20:32:24 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x6800}, 0x0, 0x0) 20:32:24 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x6c00}, 0x0, 0x0) [ 360.905395][T12950] IPVS: ftp: loaded support on port[0] = 21 [ 360.975664][T12950] chnl_net:caif_netlink_parms(): no params data found [ 361.007877][T12950] bridge0: port 1(bridge_slave_0) entered blocking state [ 361.015238][T12950] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.023735][T12950] device bridge_slave_0 entered promiscuous mode [ 361.459688][T12950] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.471655][T12950] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.484717][T12950] device bridge_slave_1 entered promiscuous mode [ 361.741250][T12950] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 361.758151][T12950] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 361.758948][T12953] IPVS: ftp: loaded support on port[0] = 21 [ 361.997826][T12950] team0: Port device team_slave_0 added [ 362.007572][T12950] team0: Port device team_slave_1 added [ 362.291258][T12950] device hsr_slave_0 entered promiscuous mode [ 362.347339][T12950] device hsr_slave_1 entered promiscuous mode [ 362.416949][T12950] debugfs: Directory 'hsr0' with parent '/' already present! [ 362.930168][T12953] chnl_net:caif_netlink_parms(): no params data found [ 363.194829][T12953] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.203138][T12953] bridge0: port 1(bridge_slave_0) entered disabled state [ 363.212271][T12953] device bridge_slave_0 entered promiscuous mode [ 363.434318][T12953] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.443053][T12953] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.451328][T12953] device bridge_slave_1 entered promiscuous mode [ 363.477585][T12953] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 363.704543][T12953] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 363.735069][ T9973] device bridge_slave_1 left promiscuous mode [ 363.742495][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.807745][ T9973] device bridge_slave_0 left promiscuous mode [ 363.814304][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 363.879145][ T9973] device bridge_slave_1 left promiscuous mode [ 363.885533][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.948139][ T9973] device bridge_slave_0 left promiscuous mode [ 363.954752][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.008880][ T9973] device bridge_slave_1 left promiscuous mode [ 364.015322][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.048239][ T9973] device bridge_slave_0 left promiscuous mode [ 364.054426][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.927669][ T9973] device hsr_slave_0 left promiscuous mode [ 369.967161][ T9973] device hsr_slave_1 left promiscuous mode [ 370.024663][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 370.039822][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 370.051882][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 370.103828][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 370.196638][ T9973] bond0 (unregistering): Released all slaves [ 370.347740][ T9973] device hsr_slave_0 left promiscuous mode [ 370.397286][ T9973] device hsr_slave_1 left promiscuous mode [ 370.474691][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 370.490618][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 370.501932][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 370.571027][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 370.664521][ T9973] bond0 (unregistering): Released all slaves [ 370.877905][ T9973] device hsr_slave_0 left promiscuous mode [ 370.926985][ T9973] device hsr_slave_1 left promiscuous mode [ 371.014807][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 371.029032][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 371.045565][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 371.091453][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 371.183403][ T9973] bond0 (unregistering): Released all slaves [ 371.292349][T12953] team0: Port device team_slave_0 added [ 371.304632][T12953] team0: Port device team_slave_1 added [ 371.360126][T12953] device hsr_slave_0 entered promiscuous mode [ 371.407488][T12953] device hsr_slave_1 entered promiscuous mode [ 371.453537][T12950] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.481125][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 371.489287][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 371.500649][T12950] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.526473][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 371.535355][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 371.544299][ T2920] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.551663][ T2920] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.560727][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 371.572699][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 371.582477][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 371.591341][ T9002] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.598746][ T9002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.618537][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 371.628222][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 371.636919][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 371.646019][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 371.659340][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 371.679874][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 371.689173][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 371.705417][T12950] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 371.716458][T12950] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 371.731064][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 371.740283][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 371.749381][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 371.759028][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 371.769274][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 371.789018][T12953] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.865932][T12950] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 371.913498][T12953] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.928803][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 371.936723][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 371.964231][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 371.975353][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 371.991095][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.998783][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 372.013529][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 372.022423][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 372.037862][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 372.045040][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 372.059332][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 372.072624][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 372.096973][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 372.105162][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 372.117979][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 372.126668][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 372.136690][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 372.152971][T12953] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 372.164162][T12953] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 372.205064][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 372.217648][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 372.237786][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 372.268586][T12953] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 372.276145][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 20:32:37 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:37 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x7400}, 0x0, 0x0) 20:32:38 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x9, 0x100000001, 0x4, 0x9}, 0x3c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000140)={r0, &(0x7f0000000040), 0x0}, 0x18) 20:32:38 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:38 executing program 2: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) ftruncate(r0, 0x8200) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x2, 0x8, 0x3, 0x2, 0x7ff, 0x6b1}) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x11, r1, 0x0) getresuid(&(0x7f00000004c0), &(0x7f0000003280), 0x0) lseek(r0, 0x0, 0x3) 20:32:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x412, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c\x00'}, 0x58) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0x3) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5b, &(0x7f00000011c0)=ANY=[@ANYBLOB="000fb8e97ead0ce8c8a30000f7d01eea7999068ae2bf4bad19af8e6702ae60d93b64bf9e2522426f1a34b6300ee5c0eb2cc10e739652339e8af7885d7eda6d68a594c39ef2ed89991430f6149dc0eb2d48e7dfbb1c7b393dc9d50199fe0800000000000000f82dc02ab6040300000000000e8827d75a8742a8de6ff002f6da758faf671185940d315e1f81e04df7235ec7a76d816f68bf51e996bd36e1270d4c643b46185ae0c1f15f1ef01ebce924cedb1c330e43571f561e312783148a2d2ded573fa1ac52bbd04f1d387ccd47ae9c4025b3482fc8c748a81c582aede5209098b8ab7399fdc01a84b9d2df2c21079dc660e0f30211393b9ba57c815af23c39c8f352d49b6d4fe5be5a48cad09d6b8166849bbeb51ecf861ae19c9722931ae3fd806b8c2cfac6b14259e2b852584354135704f1f472692329024be00523a1098c30762dfd53fea2d12a9f3c50f1a01ff57d6e5f0150e5b87d1149fabc22dc070000007a298e0000000000dd000000000000000000000000000000006c3fa5147ff19fe0926685fce60a3d686c2e427a59883023ad5ca0b07800c923d4c5bb7dfc0cf3a70fa4b9f5dc84d9afdbde5fc543b8fbebc60e6476649c291a673d48c9275ea2395a912d10d2c69688acce59cba87524d8c034656604dcca7d385ec589b2e6bf89626ba8be7e49925b1b3299d4d1c42a5a984bbdfb7c92515ab7a2c8c708b83e1bd0e73e12adac1df04e0000000000000000000000003d650f73f05fc894249efd42d10e9d43077c799e2945a31a7da423c5d7cc02660aba3026a5a942d8fa0c6bdb91c367f66785d91daf2dea4f412362217c0416c50c5a6f06d4bee591a3d4e42daecaf72a5e50fb59a454cb411c40cd85e997ca986bed8df0427de14de4f482f427bd946f16d2cb1c0908455ec4c35b99d1e059fd426a11a5c941fb2b686d444ecbbdbf782f4283c4e454bdb53645b3d804df1a87ddb58c6d8149f1a1397d929294b3d2fd53fe9182b8e4f7abbc4ce3458ee50083b825ff46bbe89121f8822cf1686377b00d8533cae22716dbbdc57e19ac734bcd5ee07804042f76edf60000000000000000000000000000000000000000000000000000000000000000cc7ecbd2c96889e6f5f192b5f17771c666f29316c4728e54807f3fa56d77b74b160782a5012eb4440000009c82567db57e8f99bbbe1e2a17c75766edd5715c00ebdf7faf0f837a460caafec27b324a9f12b89e36a59ae4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000480)='/dev/rtc0\x00', 0x40000081, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x4000000, &(0x7f0000000700)="02dc1f123c06000000b060d5f5589a646ff44a771315b3dda358bc19a0b30083eafd88a1cc6466f2a7aa4962117259863c0a2bf993de65e0b06f7e2b9e53901bc3e96930c7c85d7d93e0026f1e82f63037ddbb8a26eb84332756cb70ad2eb777a094c595edb60eb3d3a8e9439f3d7eecb7a3fb3097d75f88aa") r6 = socket$inet(0x10, 0x3, 0xc) sendmsg(r6, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000100)="24000000020307031dfffd946ff20c0020200a1009000200021d8568021baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000340)=0x6) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, r2, 0x0) setpriority(0x1, 0x0, 0x0) r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000640)='/dev/full\x00', 0x360001, 0x0) time(&(0x7f0000000400)) ioctl$sock_inet_tcp_SIOCINQ(r4, 0x541b, &(0x7f0000000300)) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/ppp\x00', 0x4000400, 0x0) accept4$alg(r7, 0x0, 0x0, 0x80800) ioctl$sock_inet_tcp_SIOCOUTQNSD(r6, 0x894b, &(0x7f00000003c0)) ioctl$EVIOCGPROP(r8, 0x40047438, &(0x7f0000000180)=""/246) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000080)) epoll_ctl$EPOLL_CTL_MOD(r7, 0x3, r3, &(0x7f00000002c0)={0x2}) ioctl$TIOCGPGRP(r7, 0x540f, &(0x7f0000000280)) fcntl$getownex(r8, 0x10, &(0x7f0000000440)) pread64(r8, &(0x7f0000000580)=""/60, 0x3c, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000540)='/dev/null\x00', 0x200001, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x100000000000000) 20:32:38 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x7a00}, 0x0, 0x0) 20:32:38 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x1000000}, 0x0, 0x0) [ 372.752918][T12981] EXT4-fs warning (device sda1): verify_group_input:104: Cannot add at group 2 (only 16 groups) [ 372.799461][T12981] EXT4-fs warning (device sda1): verify_group_input:104: Cannot add at group 2 (only 16 groups) 20:32:38 executing program 3: sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="5fb88c750196077aa3214bebc13f7d74ad4d9320611cf5a33f2a3f09e1c926359dcfe20001c781cb67f79cb0c6f5f4bf8ed60dce2176c22a20b22b9b24172b5569ec67906e7df93b05b19ba5360f2eab62812070fc181a2483366595113b240804d882a7dcd7ac4ba53e06d02558968b978122716d1823dcc7d40155c1bc1e8433f5ba15f5ee48c0ca941fce872e497d1377e2a5bde956f003caaf58c7520f82d7346c266e8ea70dab3bb7af6d78602a31ab8d232b07f6e3ef524b552ed88a1b1c02bc89f4f671855d40a2c1c173d4bb121bc86270c32d39c4c0d09a29b8983169914d8df86417a802b772bb638f72ccdcbb46267b5751816c77b6739f484292d5ca5e1bc4efee06f4e07e6a795faee2af27a8f212", 0x115, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_submit(0x0, 0x0, &(0x7f0000000600)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c8, &(0x7f0000000100)) 20:32:38 executing program 2: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400000, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x33, @dev={0xac, 0x14, 0x14, 0x23}, 0x4e22, 0x3, 'wlc\x00', 0x8e00cf4acc4cf0b2, 0x80, 0x62}, 0x2c) r1 = socket$alg(0x26, 0x5, 0x0) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f00000000c0)) bind$alg(r1, &(0x7f0000000240)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha1\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) poll(&(0x7f0000000080)=[{r2}], 0x1, 0x26) 20:32:38 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x2000000}, 0x0, 0x0) 20:32:38 executing program 3: poll(&(0x7f0000000140)=[{0xffffffffffffffff, 0x1}, {0xffffffffffffffff, 0x4}, {}, {}, {}, {}, {}], 0x7, 0x408000000000046) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x104, &(0x7f0000000040), &(0x7f0000000080)=0x4) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0x2ec, 0x0, 0x0, 0x800e00549) setsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000100)={0x403d}, 0x10) r1 = dup(r0) shutdown(r1, 0x0) 20:32:38 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:38 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x3000000}, 0x0, 0x0) 20:32:38 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 373.511723][T13011] netlink: 'syz-executor.2': attribute type 9 has an invalid length. [ 374.831156][T13014] IPVS: ftp: loaded support on port[0] = 21 [ 374.903235][T13014] chnl_net:caif_netlink_parms(): no params data found [ 374.933738][T13014] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.941406][T13014] bridge0: port 1(bridge_slave_0) entered disabled state [ 374.949969][T13014] device bridge_slave_0 entered promiscuous mode [ 374.958911][T13014] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.966328][T13014] bridge0: port 2(bridge_slave_1) entered disabled state [ 374.975249][T13014] device bridge_slave_1 entered promiscuous mode [ 374.996143][T13014] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 375.008273][T13014] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 375.028078][T13014] team0: Port device team_slave_0 added [ 375.035089][T13014] team0: Port device team_slave_1 added [ 375.229865][T13014] device hsr_slave_0 entered promiscuous mode [ 375.267373][T13014] device hsr_slave_1 entered promiscuous mode [ 375.307015][T13014] debugfs: Directory 'hsr0' with parent '/' already present! [ 375.391196][T13017] IPVS: ftp: loaded support on port[0] = 21 [ 375.402176][T13014] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.409571][T13014] bridge0: port 2(bridge_slave_1) entered forwarding state [ 375.417556][T13014] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.424956][T13014] bridge0: port 1(bridge_slave_0) entered forwarding state [ 375.668794][T13017] chnl_net:caif_netlink_parms(): no params data found [ 375.776230][T13017] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.785565][T13017] bridge0: port 1(bridge_slave_0) entered disabled state [ 375.793537][T13017] device bridge_slave_0 entered promiscuous mode [ 375.805807][T13014] 8021q: adding VLAN 0 to HW filter on device bond0 [ 375.888478][T13017] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.895554][T13017] bridge0: port 2(bridge_slave_1) entered disabled state [ 375.904157][T13017] device bridge_slave_1 entered promiscuous mode [ 375.999999][ T17] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.008665][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.018565][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 376.036161][T13017] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 376.116669][T13017] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 376.127590][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 376.135851][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 376.228142][T13017] team0: Port device team_slave_0 added [ 376.235523][T13014] 8021q: adding VLAN 0 to HW filter on device team0 [ 376.247444][T13017] team0: Port device team_slave_1 added [ 376.255132][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 376.264019][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 376.273736][ T8919] bridge0: port 1(bridge_slave_0) entered blocking state [ 376.280884][ T8919] bridge0: port 1(bridge_slave_0) entered forwarding state [ 376.305229][ T9973] device bridge_slave_1 left promiscuous mode [ 376.311616][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.358014][ T9973] device bridge_slave_0 left promiscuous mode [ 376.364394][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 378.337588][ T9973] device hsr_slave_0 left promiscuous mode [ 378.377991][ T9973] device hsr_slave_1 left promiscuous mode [ 378.427427][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 378.440120][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 378.453162][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 378.514404][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 378.620227][ T9973] bond0 (unregistering): Released all slaves [ 378.722281][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 378.731301][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 378.739912][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 378.747488][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 378.790499][T13017] device hsr_slave_0 entered promiscuous mode [ 378.847374][T13017] device hsr_slave_1 entered promiscuous mode [ 378.887001][T13017] debugfs: Directory 'hsr0' with parent '/' already present! [ 378.899248][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 378.917925][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 378.942546][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 378.943261][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 378.960289][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 378.970331][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 378.979053][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 378.988382][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 379.006883][T13014] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 379.019310][T13014] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 379.029528][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 379.039938][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 379.055347][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 379.093860][T13014] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 379.196579][T13017] 8021q: adding VLAN 0 to HW filter on device bond0 [ 379.219675][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 379.236000][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 379.250330][T13017] 8021q: adding VLAN 0 to HW filter on device team0 [ 379.270803][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 379.306392][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 379.347442][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 379.354777][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 379.372764][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 379.400077][T13025] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 379.416247][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 379.437934][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 379.447103][ T8919] bridge0: port 2(bridge_slave_1) entered blocking state [ 379.454476][ T8919] bridge0: port 2(bridge_slave_1) entered forwarding state [ 379.462273][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 379.471185][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 379.480297][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 379.491771][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 379.500719][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 379.509722][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 379.518571][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 379.527328][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 379.540778][T13017] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 379.553624][T13017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 379.562773][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 379.571550][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 379.580441][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 379.595245][T13026] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 379.619331][T13017] 8021q: adding VLAN 0 to HW filter on device batadv0 20:32:45 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:45 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) chdir(&(0x7f00000000c0)='./file0/file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000100)={0x5, 0x2, [0x6, 0x6, 0x80, 0x81, 0x1000]}) writev(r0, &(0x7f0000000700)=[{&(0x7f0000000500)="c5", 0x1}, {&(0x7f0000000080)='8', 0x100000}], 0x2) ioctl$TIOCLINUX4(0xffffffffffffffff, 0x541c, 0x0) 20:32:45 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:32:45 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x4000000}, 0x0, 0x0) 20:32:45 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:45 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x4000000002, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x50000}]}) accept4$unix(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0) [ 379.960921][T13038] netlink: 'syz-executor.2': attribute type 9 has an invalid length. 20:32:45 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x5000000}, 0x0, 0x0) 20:32:45 executing program 0: 20:32:45 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:32:45 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x6000000}, 0x0, 0x0) 20:32:45 executing program 0: 20:32:45 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x7000000}, 0x0, 0x0) 20:32:46 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:46 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) chdir(&(0x7f00000000c0)='./file0/file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000100)={0x5, 0x2, [0x6, 0x6, 0x80, 0x81, 0x1000]}) writev(r0, &(0x7f0000000700)=[{&(0x7f0000000500)="c5", 0x1}, {&(0x7f0000000080)='8', 0x100000}], 0x2) ioctl$TIOCLINUX4(0xffffffffffffffff, 0x541c, 0x0) 20:32:46 executing program 0: 20:32:46 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xa000000}, 0x0, 0x0) [ 380.904034][T13050] netlink: 'syz-executor.2': attribute type 9 has an invalid length. [ 382.258381][T13072] IPVS: ftp: loaded support on port[0] = 21 [ 382.397897][T13072] chnl_net:caif_netlink_parms(): no params data found [ 382.503832][T13072] bridge0: port 1(bridge_slave_0) entered blocking state [ 382.511579][T13072] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.519629][T13072] device bridge_slave_0 entered promiscuous mode [ 382.598945][T13072] bridge0: port 2(bridge_slave_1) entered blocking state [ 382.606323][T13072] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.615899][T13072] device bridge_slave_1 entered promiscuous mode [ 382.705491][T13072] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 382.723336][T13072] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 382.815518][T13072] team0: Port device team_slave_0 added [ 382.823818][T13072] team0: Port device team_slave_1 added [ 382.880070][T13072] device hsr_slave_0 entered promiscuous mode [ 382.917638][T13072] device hsr_slave_1 entered promiscuous mode [ 382.956998][T13072] debugfs: Directory 'hsr0' with parent '/' already present! [ 383.045983][T13072] bridge0: port 2(bridge_slave_1) entered blocking state [ 383.053775][T13072] bridge0: port 2(bridge_slave_1) entered forwarding state [ 383.061758][T13072] bridge0: port 1(bridge_slave_0) entered blocking state [ 383.069423][T13072] bridge0: port 1(bridge_slave_0) entered forwarding state [ 383.184590][T13072] 8021q: adding VLAN 0 to HW filter on device bond0 [ 383.198031][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 383.207939][ T8919] bridge0: port 1(bridge_slave_0) entered disabled state [ 383.216854][ T8919] bridge0: port 2(bridge_slave_1) entered disabled state [ 383.226232][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 383.311071][T13072] 8021q: adding VLAN 0 to HW filter on device team0 [ 383.322866][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 383.332138][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 383.339277][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 383.359462][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 383.368687][ T8919] bridge0: port 2(bridge_slave_1) entered blocking state [ 383.376318][ T8919] bridge0: port 2(bridge_slave_1) entered forwarding state [ 383.385542][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 383.399417][ T9973] device bridge_slave_1 left promiscuous mode [ 383.406199][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 383.458132][ T9973] device bridge_slave_0 left promiscuous mode [ 383.464540][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.447729][ T9973] device hsr_slave_0 left promiscuous mode [ 385.497743][ T9973] device hsr_slave_1 left promiscuous mode [ 385.567166][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 385.581194][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 385.593802][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 385.651810][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 385.744269][ T9973] bond0 (unregistering): Released all slaves [ 385.830523][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 385.848991][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 385.858701][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 385.868810][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 385.878562][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 385.887513][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 385.896126][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 385.906928][T13072] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 385.930872][T13072] 8021q: adding VLAN 0 to HW filter on device batadv0 20:32:51 executing program 0: 20:32:51 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:32:51 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xf000000}, 0x0, 0x0) 20:32:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:51 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:51 executing program 3: 20:32:51 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x40000000}, 0x0, 0x0) 20:32:51 executing program 3: [ 386.220916][T13082] netlink: 'syz-executor.2': attribute type 9 has an invalid length. 20:32:51 executing program 2: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:32:51 executing program 0: 20:32:51 executing program 3: 20:32:51 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x48000000}, 0x0, 0x0) 20:32:51 executing program 0: 20:32:51 executing program 3: 20:32:52 executing program 2: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 388.394949][T13112] IPVS: ftp: loaded support on port[0] = 21 [ 388.597660][T13112] chnl_net:caif_netlink_parms(): no params data found [ 388.699107][T13112] bridge0: port 1(bridge_slave_0) entered blocking state [ 388.707018][T13112] bridge0: port 1(bridge_slave_0) entered disabled state [ 388.715527][T13112] device bridge_slave_0 entered promiscuous mode [ 388.724802][T13112] bridge0: port 2(bridge_slave_1) entered blocking state [ 388.732505][T13112] bridge0: port 2(bridge_slave_1) entered disabled state [ 388.740608][T13112] device bridge_slave_1 entered promiscuous mode [ 388.830760][T13112] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 388.847161][T13112] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 388.938984][T13112] team0: Port device team_slave_0 added [ 388.945774][T13112] team0: Port device team_slave_1 added [ 388.989045][T13112] device hsr_slave_0 entered promiscuous mode [ 389.047265][T13112] device hsr_slave_1 entered promiscuous mode [ 389.106933][T13112] debugfs: Directory 'hsr0' with parent '/' already present! [ 389.195979][T13112] bridge0: port 2(bridge_slave_1) entered blocking state [ 389.203506][T13112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 389.211379][T13112] bridge0: port 1(bridge_slave_0) entered blocking state [ 389.218629][T13112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 389.333280][T13112] 8021q: adding VLAN 0 to HW filter on device bond0 [ 389.348504][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 389.362408][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 389.373561][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 389.382396][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 389.467317][T13112] 8021q: adding VLAN 0 to HW filter on device team0 [ 389.478354][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 389.487685][ T8925] bridge0: port 1(bridge_slave_0) entered blocking state [ 389.495208][ T8925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 389.588879][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 389.597690][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 389.605079][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 389.697876][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 389.708797][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 389.718200][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 389.728425][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 389.737735][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 389.746212][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 389.755289][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 389.764180][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 389.774065][T13112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 389.783380][ T9973] device bridge_slave_1 left promiscuous mode [ 389.790126][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 389.828058][ T9973] device bridge_slave_0 left promiscuous mode [ 389.834335][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 391.807310][ T9973] device hsr_slave_0 left promiscuous mode [ 391.857229][ T9973] device hsr_slave_1 left promiscuous mode [ 391.908992][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 391.923647][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 391.936415][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 392.004078][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 392.096145][ T9973] bond0 (unregistering): Released all slaves [ 392.240254][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 392.266431][T13112] 8021q: adding VLAN 0 to HW filter on device batadv0 20:32:57 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:57 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x4c000000}, 0x0, 0x0) 20:32:57 executing program 0: 20:32:57 executing program 3: 20:32:57 executing program 2: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:32:57 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:57 executing program 0: 20:32:57 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x68000000}, 0x0, 0x0) 20:32:57 executing program 2: socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:32:57 executing program 3: 20:32:58 executing program 3: 20:32:58 executing program 0: 20:32:58 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:32:58 executing program 2: socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:32:58 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x6c000000}, 0x0, 0x0) 20:32:58 executing program 3: 20:32:58 executing program 0: [ 394.534865][T13155] IPVS: ftp: loaded support on port[0] = 21 [ 394.606950][T13155] chnl_net:caif_netlink_parms(): no params data found [ 394.642416][T13155] bridge0: port 1(bridge_slave_0) entered blocking state [ 394.650802][T13155] bridge0: port 1(bridge_slave_0) entered disabled state [ 394.661339][T13155] device bridge_slave_0 entered promiscuous mode [ 394.670121][T13155] bridge0: port 2(bridge_slave_1) entered blocking state [ 394.678467][T13155] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.686901][T13155] device bridge_slave_1 entered promiscuous mode [ 394.708120][T13155] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 394.719918][T13155] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 394.737966][T13155] team0: Port device team_slave_0 added [ 394.745443][T13155] team0: Port device team_slave_1 added [ 394.809160][T13155] device hsr_slave_0 entered promiscuous mode [ 394.847228][T13155] device hsr_slave_1 entered promiscuous mode [ 394.907011][T13155] debugfs: Directory 'hsr0' with parent '/' already present! [ 395.213846][T13155] bridge0: port 2(bridge_slave_1) entered blocking state [ 395.221381][T13155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 395.229277][T13155] bridge0: port 1(bridge_slave_0) entered blocking state [ 395.236459][T13155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 395.416925][T13155] 8021q: adding VLAN 0 to HW filter on device bond0 [ 395.567283][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 395.576525][ T2920] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.584700][ T2920] bridge0: port 2(bridge_slave_1) entered disabled state [ 395.593379][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 395.607732][T13155] 8021q: adding VLAN 0 to HW filter on device team0 [ 395.770046][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 395.778863][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 395.787810][ T9002] bridge0: port 1(bridge_slave_0) entered blocking state [ 395.794873][ T9002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 395.802786][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 395.812070][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 395.821694][ T9002] bridge0: port 2(bridge_slave_1) entered blocking state [ 395.829020][ T9002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 395.838572][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 395.854912][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 395.863709][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 395.872952][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 395.882714][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 396.040813][T13155] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 396.052903][T13155] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 396.065307][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 396.075501][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 396.085352][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 396.094267][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 396.103057][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 396.112155][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 396.121159][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 396.285391][T13155] 8021q: adding VLAN 0 to HW filter on device batadv0 20:33:01 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:01 executing program 3: 20:33:01 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x74000000}, 0x0, 0x0) 20:33:01 executing program 0: 20:33:01 executing program 2: socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:33:01 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:02 executing program 3: 20:33:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 20:33:02 executing program 0: 20:33:02 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x7a000000}, 0x0, 0x0) 20:33:02 executing program 0: 20:33:02 executing program 3: 20:33:03 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 20:33:03 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xfeffffff}, 0x0, 0x0) 20:33:03 executing program 3: 20:33:03 executing program 0: [ 397.719202][ T9973] device bridge_slave_1 left promiscuous mode [ 397.733460][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 397.834907][ T9973] device bridge_slave_0 left promiscuous mode [ 397.857048][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 397.888995][ T9973] device bridge_slave_1 left promiscuous mode [ 397.896134][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 397.939154][ T9973] device bridge_slave_0 left promiscuous mode [ 397.945692][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.798882][ T9973] device hsr_slave_0 left promiscuous mode [ 401.867166][ T9973] device hsr_slave_1 left promiscuous mode [ 401.916475][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 401.946126][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 401.979079][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 402.056893][ T9973] bond0 (unregistering): Released all slaves [ 402.207977][ T9973] device hsr_slave_0 left promiscuous mode [ 402.267228][ T9973] device hsr_slave_1 left promiscuous mode [ 402.336374][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 402.350884][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 402.363164][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 402.414072][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 402.505963][ T9973] bond0 (unregistering): Released all slaves [ 402.601242][T13196] IPVS: ftp: loaded support on port[0] = 21 [ 402.683583][T13196] chnl_net:caif_netlink_parms(): no params data found [ 402.721733][T13196] bridge0: port 1(bridge_slave_0) entered blocking state [ 402.729393][T13196] bridge0: port 1(bridge_slave_0) entered disabled state [ 402.738709][T13196] device bridge_slave_0 entered promiscuous mode [ 402.746580][T13196] bridge0: port 2(bridge_slave_1) entered blocking state [ 402.753919][T13196] bridge0: port 2(bridge_slave_1) entered disabled state [ 402.762039][T13196] device bridge_slave_1 entered promiscuous mode [ 402.781693][T13196] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 402.792929][T13196] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 402.813631][T13196] team0: Port device team_slave_0 added [ 402.821241][T13196] team0: Port device team_slave_1 added [ 402.880341][T13196] device hsr_slave_0 entered promiscuous mode [ 402.918467][T13196] device hsr_slave_1 entered promiscuous mode [ 402.977246][T13196] debugfs: Directory 'hsr0' with parent '/' already present! [ 403.002263][T13196] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.013363][T13196] bridge0: port 2(bridge_slave_1) entered forwarding state [ 403.020961][T13196] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.028560][T13196] bridge0: port 1(bridge_slave_0) entered forwarding state [ 403.143572][T13196] 8021q: adding VLAN 0 to HW filter on device bond0 [ 403.175536][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 403.186616][ T3504] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.203698][ T3504] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.227072][T13196] 8021q: adding VLAN 0 to HW filter on device team0 [ 403.247468][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 403.264255][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.271408][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 403.306446][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 403.315473][ T9002] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.322770][ T9002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 403.354383][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 403.365900][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 403.389857][T13196] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 403.401310][T13196] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 403.415431][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 403.424536][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 403.434070][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 403.458042][T13196] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 403.466039][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 20:33:09 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 20:33:09 executing program 3: 20:33:09 executing program 0: 20:33:09 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:09 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xfffffffe}, 0x0, 0x0) 20:33:09 executing program 3: 20:33:09 executing program 0: 20:33:09 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x100000000000000}, 0x0, 0x0) 20:33:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) 20:33:09 executing program 3: 20:33:09 executing program 0: 20:33:10 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:10 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) 20:33:10 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x200000000000000}, 0x0, 0x0) 20:33:10 executing program 3: [ 406.000270][T13237] IPVS: ftp: loaded support on port[0] = 21 [ 406.081944][T13237] chnl_net:caif_netlink_parms(): no params data found [ 406.391883][T13237] bridge0: port 1(bridge_slave_0) entered blocking state [ 406.399581][T13237] bridge0: port 1(bridge_slave_0) entered disabled state [ 406.408406][T13237] device bridge_slave_0 entered promiscuous mode [ 406.418241][T13237] bridge0: port 2(bridge_slave_1) entered blocking state [ 406.425404][T13237] bridge0: port 2(bridge_slave_1) entered disabled state [ 406.433507][T13237] device bridge_slave_1 entered promiscuous mode [ 406.595351][T13237] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 406.608161][T13237] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 406.767732][T13237] team0: Port device team_slave_0 added [ 406.775296][T13237] team0: Port device team_slave_1 added [ 406.830127][T13237] device hsr_slave_0 entered promiscuous mode [ 406.867517][T13237] device hsr_slave_1 entered promiscuous mode [ 406.936935][T13237] debugfs: Directory 'hsr0' with parent '/' already present! [ 407.130090][T13237] 8021q: adding VLAN 0 to HW filter on device bond0 [ 407.286518][T13237] 8021q: adding VLAN 0 to HW filter on device team0 [ 407.295821][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 407.304367][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 407.317610][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 407.328706][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 407.337848][ T2920] bridge0: port 1(bridge_slave_0) entered blocking state [ 407.345352][ T2920] bridge0: port 1(bridge_slave_0) entered forwarding state [ 407.353453][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 407.362426][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 407.371173][ T2920] bridge0: port 2(bridge_slave_1) entered blocking state [ 407.378728][ T2920] bridge0: port 2(bridge_slave_1) entered forwarding state [ 407.532478][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 407.548279][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 407.557801][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 407.567396][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 407.576230][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 407.586128][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 407.746411][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 407.755959][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 407.764885][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 407.773804][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 407.786182][T13237] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 407.799151][T13237] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 407.808025][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 407.816544][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 407.983265][T13237] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 408.203729][ T9973] device bridge_slave_1 left promiscuous mode [ 408.219911][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state 20:33:13 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:13 executing program 0: 20:33:13 executing program 3: 20:33:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) 20:33:13 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x300000000000000}, 0x0, 0x0) 20:33:13 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 408.258032][ T9973] device bridge_slave_0 left promiscuous mode [ 408.264411][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.348852][ T9973] device bridge_slave_1 left promiscuous mode [ 408.355220][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state 20:33:13 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x400000000000000}, 0x0, 0x0) 20:33:13 executing program 0: 20:33:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) 20:33:13 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x80000000000002, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x50000}]}) accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000000280), 0x80800) [ 408.497351][ T9973] device bridge_slave_0 left promiscuous mode [ 408.503592][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state 20:33:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) 20:33:14 executing program 0: ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x1}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x40000000032, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) ioctl$int_out(0xffffffffffffffff, 0x0, 0x0) [ 412.907383][ T9973] device hsr_slave_0 left promiscuous mode [ 412.967139][ T9973] device hsr_slave_1 left promiscuous mode [ 413.040816][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 413.053172][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 413.067856][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 413.121676][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 413.225833][ T9973] bond0 (unregistering): Released all slaves [ 413.397835][ T9973] device hsr_slave_0 left promiscuous mode [ 413.437085][ T9973] device hsr_slave_1 left promiscuous mode [ 413.490977][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 413.505811][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 413.519319][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 413.564616][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 413.655156][ T9973] bond0 (unregistering): Released all slaves 20:33:19 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:19 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x500000000000000}, 0x0, 0x0) 20:33:19 executing program 3: socket$inet(0x2, 0x3, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2, 0x2, 0x73) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @broadcast}, 0x10) 20:33:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) 20:33:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x802, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000280)) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) write$uinput_user_dev(r1, &(0x7f00000005c0)={'syz1\x00', {}, 0x0, [], [], [0x8]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) write$uinput_user_dev(r1, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00'}, 0x45c) [ 413.942542][T13275] IPVS: ftp: loaded support on port[0] = 21 [ 414.098518][T13285] input: syz1 as /devices/virtual/input/input13 [ 414.329029][T13275] chnl_net:caif_netlink_parms(): no params data found [ 414.371333][T13275] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.379124][T13275] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.387602][T13275] device bridge_slave_0 entered promiscuous mode [ 414.395980][T13275] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.403693][T13275] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.412004][T13275] device bridge_slave_1 entered promiscuous mode [ 414.434407][T13275] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 414.446316][T13275] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.470445][T13275] team0: Port device team_slave_0 added [ 414.478136][T13275] team0: Port device team_slave_1 added [ 414.549891][T13275] device hsr_slave_0 entered promiscuous mode [ 414.627223][T13275] device hsr_slave_1 entered promiscuous mode [ 414.716985][T13275] debugfs: Directory 'hsr0' with parent '/' already present! [ 414.745103][T13275] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.752254][T13275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 414.759692][T13275] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.766811][T13275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 414.863331][T13275] 8021q: adding VLAN 0 to HW filter on device bond0 [ 414.905141][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 414.923233][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.935172][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.958441][T13275] 8021q: adding VLAN 0 to HW filter on device team0 [ 414.980179][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 415.004118][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 415.014697][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.021870][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 415.049026][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 415.058340][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 415.072585][ T9002] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.079794][ T9002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 415.098209][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 415.114415][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 415.141246][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 415.153342][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 415.162736][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 415.171999][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 415.180946][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 415.193972][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 415.203285][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 415.212363][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 415.221847][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 415.233246][T13275] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 415.268036][T13275] 8021q: adding VLAN 0 to HW filter on device batadv0 20:33:20 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:20 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x600000000000000}, 0x0, 0x0) 20:33:20 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x0, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:33:20 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:20 executing program 3: migrate_pages(0x0, 0x20, &(0x7f00000000c0)=0xd6, &(0x7f0000000100)=0x3) 20:33:20 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:20 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x700000000000000}, 0x0, 0x0) 20:33:20 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x0, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:33:21 executing program 3: openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0xa) socket$inet6_tcp(0xa, 0x1, 0x0) ioperm(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9e, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x2102001fee, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() exit_group(0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) 20:33:21 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x0, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:33:21 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xa00000000000000}, 0x0, 0x0) 20:33:21 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:22 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:22 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x20, 0x10, 0xc09}, 0x20}}, 0x0) 20:33:22 executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00004da000), 0x4) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f000007affc), 0x4) close(r0) [ 417.444620][T13338] IPVS: ftp: loaded support on port[0] = 21 [ 417.519885][T13338] chnl_net:caif_netlink_parms(): no params data found [ 417.553684][T13338] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.562810][T13338] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.574659][T13338] device bridge_slave_0 entered promiscuous mode [ 418.007102][T13338] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.014959][T13338] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.023807][T13338] device bridge_slave_1 entered promiscuous mode [ 418.044953][T13338] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 418.262185][T13338] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 418.284868][T13338] team0: Port device team_slave_0 added [ 418.293044][T13338] team0: Port device team_slave_1 added [ 418.338760][T13338] device hsr_slave_0 entered promiscuous mode [ 418.381747][T13338] device hsr_slave_1 entered promiscuous mode [ 418.437331][T13338] debugfs: Directory 'hsr0' with parent '/' already present! [ 418.907646][T13338] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.921147][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 418.932089][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 418.941291][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 418.952155][T13338] 8021q: adding VLAN 0 to HW filter on device team0 [ 419.176539][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 419.186128][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 419.195871][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 419.203441][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 419.211710][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 419.221206][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 419.230290][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 419.237738][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 419.245858][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 419.473652][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 419.485498][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 419.499414][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 419.509126][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 419.519946][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 419.774558][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 419.783974][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 419.793148][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 419.802554][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 419.815638][T13338] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 419.829132][T13338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 419.837974][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 419.848054][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 420.077798][T13338] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 420.378481][ T9973] device bridge_slave_1 left promiscuous mode [ 420.389939][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state 20:33:25 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:25 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xf00000000000000}, 0x0, 0x0) 20:33:25 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x20, 0x10, 0xc09}, 0x20}}, 0x0) 20:33:25 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:25 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:25 executing program 3: delete_module(&(0x7f0000000080)='keyring&(cpusetmd5sum\x00', 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x8924, &(0x7f0000000080)={'bridge_slave_1\x00', @ifru_mtu=0x1}) [ 420.438486][ T9973] device bridge_slave_0 left promiscuous mode [ 420.444982][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state 20:33:25 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x4000000000000000}, 0x0, 0x0) [ 420.520968][ T9973] device bridge_slave_1 left promiscuous mode [ 420.529779][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.578019][ T9973] device bridge_slave_0 left promiscuous mode [ 420.587432][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state 20:33:26 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x4800000000000000}, 0x0, 0x0) [ 420.638773][ T9973] device bridge_slave_1 left promiscuous mode [ 420.645125][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state 20:33:26 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x4c00000000000000}, 0x0, 0x0) [ 420.708154][ T9973] device bridge_slave_0 left promiscuous mode [ 420.718261][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state 20:33:26 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x6800000000000000}, 0x0, 0x0) 20:33:26 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x6c00000000000000}, 0x0, 0x0) 20:33:26 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x7400000000000000}, 0x0, 0x0) [ 427.177387][ T9973] device hsr_slave_0 left promiscuous mode [ 427.227046][ T9973] device hsr_slave_1 left promiscuous mode [ 427.289048][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 427.303090][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 427.315893][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 427.351468][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 427.447508][ T9973] bond0 (unregistering): Released all slaves [ 427.607584][ T9973] device hsr_slave_0 left promiscuous mode [ 427.667053][ T9973] device hsr_slave_1 left promiscuous mode [ 427.714776][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 427.729237][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 427.740638][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 427.804604][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 427.886308][ T9973] bond0 (unregistering): Released all slaves [ 428.057801][ T9973] device hsr_slave_0 left promiscuous mode [ 428.097195][ T9973] device hsr_slave_1 left promiscuous mode [ 428.150141][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 428.164034][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 428.188422][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 428.243701][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 428.315723][ T9973] bond0 (unregistering): Released all slaves 20:33:34 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:34 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0x7a00000000000000}, 0x0, 0x0) 20:33:34 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x20, 0x10, 0xc09}, 0x20}}, 0x0) [ 428.661782][T13370] IPVS: ftp: loaded support on port[0] = 21 [ 428.662683][T13368] IPVS: ftp: loaded support on port[0] = 21 [ 428.893055][T13370] chnl_net:caif_netlink_parms(): no params data found [ 428.971770][T13368] chnl_net:caif_netlink_parms(): no params data found [ 428.999433][T13370] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.006612][T13370] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.015002][T13370] device bridge_slave_0 entered promiscuous mode [ 429.024079][T13370] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.031671][T13370] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.040337][T13370] device bridge_slave_1 entered promiscuous mode [ 429.143430][T13368] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.151146][T13368] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.159624][T13368] device bridge_slave_0 entered promiscuous mode [ 429.279322][T13370] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 429.299662][T13370] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 429.315743][T13368] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.323650][T13368] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.331844][T13368] device bridge_slave_1 entered promiscuous mode [ 429.360400][T13368] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 429.384750][T13368] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 429.405990][T13370] team0: Port device team_slave_0 added [ 429.419728][T13368] team0: Port device team_slave_0 added [ 429.426663][T13370] team0: Port device team_slave_1 added [ 429.434173][T13368] team0: Port device team_slave_1 added [ 429.519803][T13368] device hsr_slave_0 entered promiscuous mode [ 429.557462][T13368] device hsr_slave_1 entered promiscuous mode [ 429.616893][T13368] debugfs: Directory 'hsr0' with parent '/' already present! [ 429.659920][T13370] device hsr_slave_0 entered promiscuous mode [ 429.727358][T13370] device hsr_slave_1 entered promiscuous mode [ 429.766921][T13370] debugfs: Directory 'hsr0' with parent '/' already present! [ 429.889348][T13368] 8021q: adding VLAN 0 to HW filter on device bond0 [ 429.909367][T13370] 8021q: adding VLAN 0 to HW filter on device bond0 [ 429.934049][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 429.943173][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 429.960984][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 429.970567][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 429.982038][T13370] 8021q: adding VLAN 0 to HW filter on device team0 [ 429.996942][T13368] 8021q: adding VLAN 0 to HW filter on device team0 [ 430.018684][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 430.028215][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 430.046787][ T9002] bridge0: port 1(bridge_slave_0) entered blocking state [ 430.053879][ T9002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 430.069334][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 430.083587][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 430.094942][ T9002] bridge0: port 2(bridge_slave_1) entered blocking state [ 430.102423][ T9002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 430.117154][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 430.126246][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 430.171180][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 430.180516][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 430.189868][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 430.198918][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 430.206183][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 430.214578][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 430.223517][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 430.232352][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 430.241433][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 430.250768][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 430.259633][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 430.268816][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 430.278634][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 430.287601][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 430.296521][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 430.305118][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 430.312518][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 430.322895][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 430.332601][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 430.344124][T13370] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 430.359076][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 430.368087][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 430.376302][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 430.386115][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 430.396325][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 430.418276][T13368] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 430.429921][T13368] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 430.453113][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 430.462923][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 430.472577][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 430.481237][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 430.490546][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 430.499266][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 430.509060][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 430.538855][T13368] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 430.549966][T13370] 8021q: adding VLAN 0 to HW filter on device batadv0 20:33:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x34, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0x4}}}]}, 0x34}}, 0x0) 20:33:36 executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = dup2(r0, r0) unshare(0x8000400) bind$ax25(r1, &(0x7f0000000000)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) 20:33:36 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001f40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) utime(&(0x7f0000000000)='./file0\x00', 0x0) read$FUSE(r0, &(0x7f0000005000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) read$FUSE(r0, &(0x7f0000004000), 0x1000) chmod(&(0x7f0000000040)='./file0\x00', 0x0) write$FUSE_ATTR(r0, &(0x7f0000000580)={0x78, 0x0, 0x2}, 0x78) 20:33:36 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2, 0xfeffffff00000000}, 0x0, 0x0) 20:33:36 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:36 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 430.960456][T13395] fuse: Bad value for 'subtype' 20:33:36 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x4000, 0x0) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f00000000c0)=""/164) 20:33:36 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x200000) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00'}, &(0x7f0000000140)=0x44) getpid() 20:33:36 executing program 3: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = dup2(r0, r0) unshare(0x8000400) bind$ax25(r1, 0x0, 0x0) [ 431.021472][T13400] fuse: Bad value for 'subtype' 20:33:36 executing program 5: setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64EXEC\x00', &(0x7f0000000080)='-@\x00', 0x3, 0x26d0e70af7083919) r0 = add_key(&(0x7f00000001c0)='cifs.idmap\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000240)="bb6249bbf4efdc9095063c524682251794deffa277f6e60b8839", 0x1a, 0x0) request_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000280)={'syz', 0x2}, 0x0, r0) 20:33:36 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r1, 0x89b0, &(0x7f0000000080)={'bridge0\x00', @ifru_mtu}) 20:33:36 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) arch_prctl$ARCH_GET_CPUID(0x1011) 20:33:37 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x34, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0x4}}}]}, 0x34}}, 0x0) 20:33:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dc900d5e0bcfe47bf070") syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x7, 0x0) 20:33:37 executing program 5: r0 = open(&(0x7f0000000040)='./file0\x00', 0x80000, 0x4) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f00000000c0)={0x0, {0x1ff, 0x9}}) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:33:37 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 432.892972][T13432] IPVS: ftp: loaded support on port[0] = 21 [ 432.974927][T13432] chnl_net:caif_netlink_parms(): no params data found [ 433.430495][T13432] bridge0: port 1(bridge_slave_0) entered blocking state [ 433.438930][T13432] bridge0: port 1(bridge_slave_0) entered disabled state [ 433.448623][T13432] device bridge_slave_0 entered promiscuous mode [ 433.669493][T13432] bridge0: port 2(bridge_slave_1) entered blocking state [ 433.677491][T13432] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.685426][T13432] device bridge_slave_1 entered promiscuous mode [ 433.708936][T13432] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 433.933942][T13432] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 433.955611][T13432] team0: Port device team_slave_0 added [ 433.964531][T13432] team0: Port device team_slave_1 added [ 434.249405][T13432] device hsr_slave_0 entered promiscuous mode [ 434.281499][T13432] device hsr_slave_1 entered promiscuous mode [ 434.346968][T13432] debugfs: Directory 'hsr0' with parent '/' already present! [ 434.600520][T13432] 8021q: adding VLAN 0 to HW filter on device bond0 [ 434.828562][T13432] 8021q: adding VLAN 0 to HW filter on device team0 [ 434.837436][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 434.845447][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 434.855293][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 434.865284][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 434.874390][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.881750][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 434.889866][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 435.117256][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 435.126348][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 435.135242][T13198] bridge0: port 2(bridge_slave_1) entered blocking state [ 435.142711][T13198] bridge0: port 2(bridge_slave_1) entered forwarding state [ 435.152713][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 435.377688][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 435.386421][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 435.395430][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 435.404012][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 435.412735][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 435.422115][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 435.435809][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 435.445957][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 435.460756][T13432] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 435.473411][T13432] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 435.686058][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 435.695819][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 435.720299][T13432] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 435.728529][ T9973] device bridge_slave_1 left promiscuous mode [ 435.734761][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.788224][ T9973] device bridge_slave_0 left promiscuous mode [ 435.794608][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.848316][ T9973] device bridge_slave_1 left promiscuous mode [ 435.865377][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.918121][ T9973] device bridge_slave_0 left promiscuous mode [ 435.924631][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.980189][ T9973] device bridge_slave_1 left promiscuous mode [ 435.987250][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.038236][ T9973] device bridge_slave_0 left promiscuous mode [ 436.044456][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.757556][ T9973] device hsr_slave_0 left promiscuous mode [ 441.798766][ T9973] device hsr_slave_1 left promiscuous mode [ 441.860260][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 441.874152][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 441.885933][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 441.941451][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 442.017676][ T9973] bond0 (unregistering): Released all slaves [ 442.187640][ T9973] device hsr_slave_0 left promiscuous mode [ 442.237173][ T9973] device hsr_slave_1 left promiscuous mode [ 442.310536][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 442.325240][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 442.337822][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 442.403661][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 442.494881][ T9973] bond0 (unregistering): Released all slaves [ 442.657633][ T9973] device hsr_slave_0 left promiscuous mode [ 442.707157][ T9973] device hsr_slave_1 left promiscuous mode [ 442.778856][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 442.792970][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 442.805451][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 442.903351][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 442.994377][ T9973] bond0 (unregistering): Released all slaves 20:33:48 executing program 3: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x30002000000010, 0x2, 0x0) write(r0, &(0x7f0000000240)="fc00000048000703ab092500090017000aab07ff02000000000a769321000100ff0100000005d0000000000009039815fa2c1ec28656aaa79bb94b59fe100000bc000200000d6c6c256f1a272f2e11a4a6f9607668bf0478aa2a7c8b911ea7cc3f8a2fcb5d7bd5afaa8934d0730700000020d7d5bbc91a3e2e80772c05defd5a32e280fc83ab1afad60ce9c0bfb8fe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f44660da80b76b6825bbd5b95dbcc037816460e63941591cf190201ded815b2ccd243f295ed94e0ad91743f2e87abd43cd16b17e583df150c3b880f411f46a6b567b4d500"/252, 0xfc) 20:33:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x34, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0x4}}}]}, 0x34}}, 0x0) 20:33:48 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:48 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:48 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = accept4$llc(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x80800) accept(r0, &(0x7f00000000c0)=@ax25={{}, [@bcast, @rose, @remote, @remote, @remote, @null, @null]}, &(0x7f0000000140)=0x80) 20:33:48 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x88d82) write(r1, &(0x7f0000000380)="e313ed3d4b4aea617c1c4122a833ce3ce4877c10995c0738ea7a2a007085692e9defa90aeb7cabf14ae79b84e2a9", 0x2e) 20:33:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x34, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0x4, 0x2, [@tunl_policy]}}}]}, 0x34}}, 0x0) 20:33:48 executing program 5: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0x60000, 0x0) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0xfff, 0x1) 20:33:48 executing program 3: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x30002000000010, 0x2, 0x0) write(r0, &(0x7f0000000240)="fc00000048000703ab092500090017000aab07ff02000000000a769321000100ff0100000005d0000000000009039815fa2c1ec28656aaa79bb94b59fe100000bc000200000d6c6c256f1a272f2e11a4a6f9607668bf0478aa2a7c8b911ea7cc3f8a2fcb5d7bd5afaa8934d0730700000020d7d5bbc91a3e2e80772c05defd5a32e280fc83ab1afad60ce9c0bfb8fe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f44660da80b76b6825bbd5b95dbcc037816460e63941591cf190201ded815b2ccd243f295ed94e0ad91743f2e87abd43cd16b17e583df150c3b880f411f46a6b567b4d500"/252, 0xfc) 20:33:48 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) keyctl$set_reqkey_keyring(0xe, 0x4) 20:33:49 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x2000, 0x0) bind$pptp(r0, &(0x7f0000000200)={0x18, 0x2, {0x1, @multicast1}}, 0x37d) ioctl$VIDIOC_STREAMOFF(r0, 0x40045613, &(0x7f00000000c0)=0x8) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000440)={0xe958, 0x2, 0x7fffffff, 0x0, 0x2, 0x46b1}) socket$pptp(0x18, 0x1, 0x2) ioctl$sock_netdev_private(r0, 0x89fc, &(0x7f0000000100)="bd1a388e009339e718f0caa87fee55ee444e98dcee3df0fe2127e1a9ca4fb97c9cc7bbf2c7f0706c93d593a969314e2ff2f0572a2e4d7aaf7e9bdf3e8d246470eca3182414f11b2f6c084e32ee7f9416352beb45d5cd4df1a982ba9fa37cb6a832938949392a4b54fe312d590a98492d3f33a843f04cb53c5c44423ff417c0d91eaf1828e6c22da4117a4a2ade23a368ddc72a4908b5d9390bf3f964b2ee393b48c0cce4245157fa7a8386b98cf0065932a8d3401a8c35469d70462d2201508ffe16e20fa68f8690844b2452b13c08d902f091236b29ebe80011d444cabd2012a3cb73d5a816644d8cd19315069e92599e5853925dd04566a980747fa62780") getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000240)=@sack_info={0x0, 0x0, 0x83d}, &(0x7f0000000280)=0xc) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r0, 0x110, 0x4, &(0x7f0000000400), 0x4) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f00000002c0)={r1, 0xb98}, &(0x7f0000000300)=0x8) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f00000003c0)={0xa, 0x4, 0xfa00, {r2}}, 0xc) 20:33:49 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = accept4$ax25(0xffffffffffffffff, &(0x7f00000000c0)={{0x3, @rose}, [@bcast, @netrom, @bcast, @null, @null, @default, @remote, @bcast]}, &(0x7f0000000040)=0x48, 0xd24941c3310a46cd) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000140)=@bpq0='bpq0\x00', 0x10) 20:33:49 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000100)=0x1c, 0x800) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x100, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r2, 0x7fff, 0x66, &(0x7f0000000180)="d079261ff51fa5dd855f35e6b2bd7469644d59957d534384624534e39afd5cf76560300e5dc3e1320a542ceb2dcecb204adcd54a72d8bc43396cfc55d1cf4bd14b9afcabc0dfd054a4765aba23e0d58b241dec5c4caafd4c4094ba92ad11e53267abacc25e9f", 0x2, 0x0, 0x8, 0x441c, 0xc8, 0x2, 0xd8, 'syz1\x00'}) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r2, 0x80045301, &(0x7f00000002c0)) 20:33:49 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 445.339249][T13472] IPVS: ftp: loaded support on port[0] = 21 [ 445.437538][T13472] chnl_net:caif_netlink_parms(): no params data found [ 445.474181][T13472] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.481666][T13472] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.489875][T13472] device bridge_slave_0 entered promiscuous mode [ 445.498280][T13472] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.505601][T13472] bridge0: port 2(bridge_slave_1) entered disabled state [ 445.513895][T13472] device bridge_slave_1 entered promiscuous mode [ 445.535680][T13472] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 445.548526][T13472] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 445.578227][T13472] team0: Port device team_slave_0 added [ 445.586548][T13472] team0: Port device team_slave_1 added [ 445.669762][T13472] device hsr_slave_0 entered promiscuous mode [ 445.732691][T13472] device hsr_slave_1 entered promiscuous mode [ 445.807138][T13472] debugfs: Directory 'hsr0' with parent '/' already present! [ 445.824359][T13475] IPVS: ftp: loaded support on port[0] = 21 [ 445.828244][T13472] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.838304][T13472] bridge0: port 2(bridge_slave_1) entered forwarding state [ 445.845723][T13472] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.853711][T13472] bridge0: port 1(bridge_slave_0) entered forwarding state [ 445.966134][T13472] 8021q: adding VLAN 0 to HW filter on device bond0 [ 445.976371][T13475] chnl_net:caif_netlink_parms(): no params data found [ 446.024627][T13472] 8021q: adding VLAN 0 to HW filter on device team0 [ 446.045617][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 446.054195][ T22] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.063230][ T22] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.072180][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 446.095607][T13475] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.103363][T13475] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.116247][T13475] device bridge_slave_0 entered promiscuous mode [ 446.125167][T13475] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.133232][T13475] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.141504][T13475] device bridge_slave_1 entered promiscuous mode [ 446.161201][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 446.170778][ T8919] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.177987][ T8919] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.185846][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 446.195845][ T8919] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.202979][ T8919] bridge0: port 2(bridge_slave_1) entered forwarding state [ 446.226017][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 446.235728][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 446.245893][T13475] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 446.264037][T13475] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 446.291454][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 446.302327][T13475] team0: Port device team_slave_0 added [ 446.310436][T13475] team0: Port device team_slave_1 added [ 446.474467][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 446.483737][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 446.493949][T13472] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 446.540158][T13475] device hsr_slave_0 entered promiscuous mode [ 446.577369][T13475] device hsr_slave_1 entered promiscuous mode [ 446.617202][T13475] debugfs: Directory 'hsr0' with parent '/' already present! [ 446.704296][T13472] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 446.843815][T13475] 8021q: adding VLAN 0 to HW filter on device bond0 [ 446.931053][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 446.940049][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 446.951342][T13475] 8021q: adding VLAN 0 to HW filter on device team0 [ 446.962278][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 446.972248][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 446.981867][T13198] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.989463][T13198] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.990933][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 447.120237][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 447.130558][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 447.139579][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 447.147620][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 447.156562][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 447.169003][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 447.188323][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 447.198689][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 447.209829][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 447.219903][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 447.229043][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 447.238476][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 447.247768][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 447.348132][T13475] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 447.368842][T13475] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 447.382578][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 447.391434][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 447.497391][T13475] 8021q: adding VLAN 0 to HW filter on device batadv0 20:33:53 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x34, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0x4, 0x2, [@tunl_policy]}}}]}, 0x34}}, 0x0) 20:33:53 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.controllers\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xe, 0x9, "170f9e8ff06e01e636148f9bf4580312603bacc0cc150d681097005b51547621c7945e01689e2068a3f2e18c8cdfd4103035d227c0484e4bc970d256ab9b3646", "19b22d7699333e8e077e6becebee1cac9616c0167a4a447dd0760c88b1da7ace", [0x2, 0x7]}) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x200200, 0x0) prctl$PR_SVE_SET_VL(0x32, 0x3ff) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x2, 0x0) accept$alg(r2, 0x0, 0x0) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000140)={0x7, 0x6, 0x126, 0x4}) 20:33:53 executing program 3: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x30002000000010, 0x2, 0x0) write(r0, &(0x7f0000000240)="fc00000048000703ab092500090017000aab07ff02000000000a769321000100ff0100000005d0000000000009039815fa2c1ec28656aaa79bb94b59fe100000bc000200000d6c6c256f1a272f2e11a4a6f9607668bf0478aa2a7c8b911ea7cc3f8a2fcb5d7bd5afaa8934d0730700000020d7d5bbc91a3e2e80772c05defd5a32e280fc83ab1afad60ce9c0bfb8fe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f44660da80b76b6825bbd5b95dbcc037816460e63941591cf190201ded815b2ccd243f295ed94e0ad91743f2e87abd43cd16b17e583df150c3b880f411f46a6b567b4d500"/252, 0xfc) 20:33:53 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000800)=[{&(0x7f0000000100)=""/72}, {&(0x7f0000000240)=""/79}, {&(0x7f00000002c0)=""/254}, {&(0x7f00000003c0)=""/72}, {&(0x7f00000004c0)=""/156}, {&(0x7f00000008c0)=""/4}, {&(0x7f0000000900)=""/70, 0xffe7}, {&(0x7f0000000640)=""/204}, {&(0x7f0000000740)=""/184}], 0x1000000000000027) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xccf3, 0x0, 0x0, 0x800e0053d) shutdown(r0, 0x0) recvmsg(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)=""/216, 0xd8}], 0x1}, 0x0) shutdown(r2, 0x0) shutdown(r1, 0x0) 20:33:53 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0) 20:33:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x34, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0x4, 0x2, [@tunl_policy]}}}]}, 0x34}}, 0x0) 20:33:53 executing program 3: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x30002000000010, 0x2, 0x0) write(r0, &(0x7f0000000240)="fc00000048000703ab092500090017000aab07ff02000000000a769321000100ff0100000005d0000000000009039815fa2c1ec28656aaa79bb94b59fe100000bc000200000d6c6c256f1a272f2e11a4a6f9607668bf0478aa2a7c8b911ea7cc3f8a2fcb5d7bd5afaa8934d0730700000020d7d5bbc91a3e2e80772c05defd5a32e280fc83ab1afad60ce9c0bfb8fe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f44660da80b76b6825bbd5b95dbcc037816460e63941591cf190201ded815b2ccd243f295ed94e0ad91743f2e87abd43cd16b17e583df150c3b880f411f46a6b567b4d500"/252, 0xfc) [ 447.917924][ T9973] device bridge_slave_1 left promiscuous mode [ 447.929033][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.995182][ T9973] device bridge_slave_0 left promiscuous mode [ 448.012885][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state 20:33:53 executing program 0: poll(&(0x7f0000000180)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x408000000000046) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0x2ec, 0x0, 0x0, 0x800e00549) readv(r0, &(0x7f00000015c0)=[{&(0x7f00000001c0)=""/151, 0x97}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8) r1 = dup(r0) shutdown(r1, 0x0) 20:33:53 executing program 5: r0 = request_key(&(0x7f0000000040)='.dead\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000140)='keyring\x00\x9ax\xb2\x9d\xad+\x8b!\xcc@\x90t\x1dL6\xc3\xd3m\x02\x99\xf6{6\xe9=\xaf\x1a\x17|\xba\x99P\xc37\xfc+\x8a\bZ\b\x03\f\x7f\xf2\xed\xcb\t\xaf{\x11BP\x1aW\x9b?C\x11Ch\xf8!O##Ty\x96\xf1\xc8\xbf\xe6\x90:\x17\xfao_h\xf0\xeaU\xc2\xfc\xf3\xfc\x1e0x0}) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x2, &(0x7f0000000300)=[r1, r2]) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, r0) 20:33:53 executing program 3: get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000219000/0x2000)=nil, 0x3) [ 450.517468][ T9973] device hsr_slave_0 left promiscuous mode [ 450.556961][ T9973] device hsr_slave_1 left promiscuous mode [ 450.608979][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 450.624331][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 450.636136][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 450.671965][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 450.772976][ T9973] bond0 (unregistering): Released all slaves 20:33:56 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:56 executing program 5: socket$packet(0x11, 0x3, 0x300) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:33:56 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) lstat(0x0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) chown(0x0, r0, 0x0) 20:33:56 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) sendmmsg$inet(r0, &(0x7f000000cf40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000d00)=[@ip_tos_u8={{0x11}}], 0x18}}], 0x1, 0x0) [ 451.064290][T13530] IPVS: ftp: loaded support on port[0] = 21 [ 451.413795][T13530] chnl_net:caif_netlink_parms(): no params data found [ 451.458486][T13530] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.465745][T13530] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.476018][T13530] device bridge_slave_0 entered promiscuous mode [ 451.489252][T13530] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.502447][T13530] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.513109][T13530] device bridge_slave_1 entered promiscuous mode [ 451.549941][T13530] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 451.561669][T13530] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 451.590530][T13530] team0: Port device team_slave_0 added [ 451.605315][T13530] team0: Port device team_slave_1 added [ 451.679867][T13530] device hsr_slave_0 entered promiscuous mode [ 451.717625][T13530] device hsr_slave_1 entered promiscuous mode [ 451.776911][T13530] debugfs: Directory 'hsr0' with parent '/' already present! [ 451.815112][T13530] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.822468][T13530] bridge0: port 2(bridge_slave_1) entered forwarding state [ 451.829901][T13530] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.837166][T13530] bridge0: port 1(bridge_slave_0) entered forwarding state [ 451.891635][T13530] 8021q: adding VLAN 0 to HW filter on device bond0 [ 451.908730][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 451.917988][ T17] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.926227][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.951719][T13530] 8021q: adding VLAN 0 to HW filter on device team0 [ 451.971914][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 451.988763][T13198] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.995944][T13198] bridge0: port 1(bridge_slave_0) entered forwarding state [ 452.024253][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 452.042070][ T8919] bridge0: port 2(bridge_slave_1) entered blocking state [ 452.049324][ T8919] bridge0: port 2(bridge_slave_1) entered forwarding state [ 452.089456][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 452.108100][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 452.127537][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 452.144707][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 452.166372][T13530] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 452.187444][T13530] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 452.207045][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 452.217765][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 452.252223][T13530] 8021q: adding VLAN 0 to HW filter on device batadv0 20:33:57 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9}]]}}}]}, 0x3c}}, 0x0) 20:33:57 executing program 5: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x101001, 0x0) ioctl$PPPIOCCONNECT(r0, 0x4004743a, &(0x7f0000000100)=0x4) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='overlay\x00', 0x21280be, &(0x7f0000000180)={[{@nfs_export_off='nfs_export=off'}, {@workdir={'workdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file0'}}, {@xino_auto='xino=auto'}, {@xino_on='xino=on'}], [{@subj_user={'subj_user', 0x3d, '/proc/capi/capi20ncci\x00'}}]}) inotify_add_watch(r0, &(0x7f0000000200)='./file0\x00', 0x40000400) request_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:33:57 executing program 3: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = dup2(r0, r0) unshare(0x8000400) shutdown(r1, 0x0) 20:33:57 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000280)=0x6) read(r0, &(0x7f00003fefff)=""/1, 0x1) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = gettid() readv(0xffffffffffffffff, &(0x7f00000002c0), 0x0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x12) poll(0x0, 0x0, 0xffffffffffbffff8) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000080)) dup2(0xffffffffffffffff, 0xffffffffffffffff) fcntl$setown(0xffffffffffffffff, 0x8, r1) tkill(r1, 0x16) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) write$P9_RATTACH(0xffffffffffffffff, &(0x7f00000001c0)={0x14}, 0xffffffde) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 20:33:57 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 452.462767][T13557] netlink: 'syz-executor.2': attribute type 9 has an invalid length. 20:33:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9}]]}}}]}, 0x3c}}, 0x0) 20:33:57 executing program 5: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f00000000c0)) request_key(&(0x7f0000000040)='.@e\x00es\x8a\xec\x03\x00\x00\x00\x00\x00\x00h\x95\xa3\xb2\x9a', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)=0x0) ioprio_get$pid(0x3, r2) mmap$xdp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x8, 0x13, r1, 0x100000000) 20:33:58 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setflags(r0, 0x2, 0x0) [ 452.720497][T13573] netlink: 'syz-executor.2': attribute type 9 has an invalid length. 20:33:58 executing program 5: r0 = request_key(&(0x7f0000000040)='rxrpc\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100)='kemg\x00', 0xfffffffffffffffd) request_key(&(0x7f0000000000)='kemg\x00\x00\x00\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, r0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000180), &(0x7f00000001c0)=0x4) socket$nl_netfilter(0x10, 0x3, 0xc) 20:33:58 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:58 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9}]]}}}]}, 0x3c}}, 0x0) 20:33:58 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:58 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ashmem\x00', 0x2001, 0x0) fcntl$getflags(r0, 0xb) [ 453.071130][T13591] netlink: 'syz-executor.2': attribute type 9 has an invalid length. 20:33:58 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:33:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 454.749538][T13607] IPVS: ftp: loaded support on port[0] = 21 [ 455.106527][T13607] chnl_net:caif_netlink_parms(): no params data found [ 455.138921][T13607] bridge0: port 1(bridge_slave_0) entered blocking state [ 455.146216][T13607] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.154887][T13607] device bridge_slave_0 entered promiscuous mode [ 455.310023][T13607] bridge0: port 2(bridge_slave_1) entered blocking state [ 455.319118][T13607] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.327385][T13607] device bridge_slave_1 entered promiscuous mode 20:34:00 executing program 0 (fault-call:1 fault-nth:0): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 455.505202][T13607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 455.516584][T13607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 455.539295][T13607] team0: Port device team_slave_0 added [ 455.624869][T13611] FAULT_INJECTION: forcing a failure. [ 455.624869][T13611] name failslab, interval 1, probability 0, space 0, times 1 [ 455.638402][T13611] CPU: 1 PID: 13611 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190827 #74 [ 455.647940][T13611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 455.658356][T13611] Call Trace: [ 455.661811][T13611] dump_stack+0x172/0x1f0 [ 455.666156][T13611] should_fail.cold+0xa/0x15 [ 455.670852][T13611] ? fault_create_debugfs_attr+0x180/0x180 [ 455.676680][T13611] ? ___might_sleep+0x163/0x280 [ 455.681552][T13611] __should_failslab+0x121/0x190 [ 455.686512][T13611] should_failslab+0x9/0x14 [ 455.691021][T13611] kmem_cache_alloc_node+0x268/0x740 [ 455.696410][T13611] __alloc_skb+0xd5/0x5e0 [ 455.700963][T13611] ? netdev_alloc_frag+0x1b0/0x1b0 [ 455.706085][T13611] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 455.712499][T13611] ? netlink_autobind.isra.0+0x228/0x310 [ 455.718236][T13611] netlink_sendmsg+0x972/0xd60 [ 455.723015][T13611] ? netlink_unicast+0x710/0x710 [ 455.728044][T13611] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 455.733597][T13611] ? apparmor_socket_sendmsg+0x2a/0x30 [ 455.739057][T13611] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 455.745402][T13611] ? security_socket_sendmsg+0x8d/0xc0 [ 455.750858][T13611] ? netlink_unicast+0x710/0x710 [ 455.755800][T13611] sock_sendmsg+0xd7/0x130 [ 455.760244][T13611] ___sys_sendmsg+0x803/0x920 [ 455.764924][T13611] ? copy_msghdr_from_user+0x440/0x440 [ 455.770630][T13611] ? __kasan_check_read+0x11/0x20 [ 455.775832][T13611] ? __fget+0x384/0x560 [ 455.780003][T13611] ? ksys_dup3+0x3e0/0x3e0 [ 455.784427][T13611] ? __fget_light+0x1a9/0x230 [ 455.789295][T13611] ? __fdget+0x1b/0x20 [ 455.793376][T13611] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 455.800684][T13611] __sys_sendmsg+0x105/0x1d0 [ 455.805883][T13611] ? __sys_sendmsg_sock+0xd0/0xd0 [ 455.811004][T13611] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 455.816677][T13611] ? do_syscall_64+0x26/0x760 [ 455.821408][T13611] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 455.827480][T13611] ? do_syscall_64+0x26/0x760 [ 455.832254][T13611] __x64_sys_sendmsg+0x78/0xb0 [ 455.837121][T13611] do_syscall_64+0xfa/0x760 [ 455.841852][T13611] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 455.847894][T13611] RIP: 0033:0x459879 [ 455.851779][T13611] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 455.871456][T13611] RSP: 002b:00007fbd480bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 455.880232][T13611] RAX: ffffffffffffffda RBX: 00007fbd480bfc90 RCX: 0000000000459879 [ 455.888210][T13611] RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000003 [ 455.896195][T13611] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 455.904178][T13611] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbd480c06d4 [ 455.912454][T13611] R13: 00000000004c77b1 R14: 00000000004dd000 R15: 0000000000000004 [ 455.940962][T13607] team0: Port device team_slave_1 added [ 456.001836][T13607] device hsr_slave_0 entered promiscuous mode [ 456.057399][T13607] device hsr_slave_1 entered promiscuous mode [ 456.096983][T13607] debugfs: Directory 'hsr0' with parent '/' already present! [ 456.277801][T13607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 456.289837][ T9973] device bridge_slave_1 left promiscuous mode [ 456.296050][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.339415][ T9973] device bridge_slave_0 left promiscuous mode [ 456.346095][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 456.398361][ T9973] device bridge_slave_1 left promiscuous mode [ 456.404747][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.439017][ T9973] device bridge_slave_0 left promiscuous mode [ 456.446680][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.287440][ T9973] device hsr_slave_0 left promiscuous mode [ 460.347064][ T9973] device hsr_slave_1 left promiscuous mode [ 460.398193][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 460.411584][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 460.423137][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 460.481463][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 460.565513][ T9973] bond0 (unregistering): Released all slaves [ 460.697752][ T9973] device hsr_slave_0 left promiscuous mode [ 460.737059][ T9973] device hsr_slave_1 left promiscuous mode [ 460.785884][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 460.800808][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 460.814092][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 460.855022][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 460.926086][ T9973] bond0 (unregistering): Released all slaves [ 461.025071][T13607] 8021q: adding VLAN 0 to HW filter on device team0 [ 461.035026][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 461.046139][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 461.054356][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 461.072328][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 461.082004][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 461.091077][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 461.098918][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 461.118830][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 461.127381][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 461.136560][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 461.146349][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.159410][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 461.170510][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 461.179884][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 461.188968][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 461.197933][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 461.206481][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 461.215540][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 461.232036][T13607] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 461.244657][T13607] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 461.257672][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 461.265701][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 461.274365][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 461.284130][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 461.293066][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 461.302031][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 461.327932][T13607] 8021q: adding VLAN 0 to HW filter on device batadv0 20:34:06 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:06 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:06 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x800, 0x100) ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f00000000c0)={0x1, 0xff, 0x1}) ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f0000000100)={0x6f, 0x7ff, 0x3f}) 20:34:06 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:07 executing program 0 (fault-call:1 fault-nth:1): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:07 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 461.664117][T13623] FAULT_INJECTION: forcing a failure. [ 461.664117][T13623] name failslab, interval 1, probability 0, space 0, times 0 [ 461.777742][T13623] CPU: 1 PID: 13623 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190827 #74 [ 461.786985][T13623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 461.797056][T13623] Call Trace: [ 461.800382][T13623] dump_stack+0x172/0x1f0 [ 461.804738][T13623] should_fail.cold+0xa/0x15 [ 461.809356][T13623] ? fault_create_debugfs_attr+0x180/0x180 [ 461.815390][T13623] ? ___might_sleep+0x163/0x280 [ 461.820446][T13623] __should_failslab+0x121/0x190 [ 461.825416][T13623] should_failslab+0x9/0x14 [ 461.830023][T13623] kmem_cache_alloc_node_trace+0x274/0x750 [ 461.835851][T13623] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 461.841998][T13623] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 461.848097][T13623] __kmalloc_node_track_caller+0x3d/0x70 [ 461.853761][T13623] __kmalloc_reserve.isra.0+0x40/0xf0 [ 461.859256][T13623] __alloc_skb+0x10b/0x5e0 [ 461.863823][T13623] ? netdev_alloc_frag+0x1b0/0x1b0 [ 461.869144][T13623] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 461.875518][T13623] ? netlink_autobind.isra.0+0x228/0x310 [ 461.881188][T13623] netlink_sendmsg+0x972/0xd60 [ 461.886068][T13623] ? netlink_unicast+0x710/0x710 [ 461.891034][T13623] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 461.896695][T13623] ? apparmor_socket_sendmsg+0x2a/0x30 [ 461.902177][T13623] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 461.908588][T13623] ? security_socket_sendmsg+0x8d/0xc0 [ 461.914250][T13623] ? netlink_unicast+0x710/0x710 [ 461.919226][T13623] sock_sendmsg+0xd7/0x130 [ 461.923699][T13623] ___sys_sendmsg+0x803/0x920 [ 461.928500][T13623] ? copy_msghdr_from_user+0x440/0x440 [ 461.934000][T13623] ? __kasan_check_read+0x11/0x20 [ 461.939132][T13623] ? __fget+0x384/0x560 [ 461.943493][T13623] ? ksys_dup3+0x3e0/0x3e0 [ 461.948113][T13623] ? __fget_light+0x1a9/0x230 [ 461.953004][T13623] ? __fdget+0x1b/0x20 [ 461.957197][T13623] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 461.963671][T13623] __sys_sendmsg+0x105/0x1d0 [ 461.968512][T13623] ? __sys_sendmsg_sock+0xd0/0xd0 [ 461.973665][T13623] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 461.979156][T13623] ? do_syscall_64+0x26/0x760 [ 461.983865][T13623] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 461.990957][T13623] ? do_syscall_64+0x26/0x760 [ 461.995790][T13623] __x64_sys_sendmsg+0x78/0xb0 [ 462.000584][T13623] do_syscall_64+0xfa/0x760 [ 462.005127][T13623] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 462.011039][T13623] RIP: 0033:0x459879 [ 462.014944][T13623] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 462.035174][T13623] RSP: 002b:00007fbd480bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 462.043628][T13623] RAX: ffffffffffffffda RBX: 00007fbd480bfc90 RCX: 0000000000459879 [ 462.051617][T13623] RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000003 [ 462.059691][T13623] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 462.068131][T13623] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbd480c06d4 20:34:07 executing program 5: r0 = request_key(&(0x7f00000000c0)='pkcs7_test\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='selinux!\x00', 0xfffffffffffffffb) request_key(&(0x7f0000000040)='\xa1\xe69>\xaa\xa9m\x8e', &(0x7f0000000080)={'syz', 0x2}, 0x0, r0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) [ 462.076562][T13623] R13: 00000000004c77b1 R14: 00000000004dd000 R15: 0000000000000004 20:34:07 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:07 executing program 0 (fault-call:1 fault-nth:2): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:07 executing program 5: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x141000, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x42, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 462.309248][T13633] FAULT_INJECTION: forcing a failure. [ 462.309248][T13633] name failslab, interval 1, probability 0, space 0, times 0 [ 462.396919][T13633] CPU: 0 PID: 13633 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190827 #74 [ 462.406082][T13633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 462.416382][T13633] Call Trace: [ 462.419804][T13633] dump_stack+0x172/0x1f0 [ 462.424173][T13633] should_fail.cold+0xa/0x15 [ 462.428792][T13633] ? fault_create_debugfs_attr+0x180/0x180 [ 462.434707][T13633] __should_failslab+0x121/0x190 [ 462.439747][T13633] should_failslab+0x9/0x14 [ 462.444245][T13633] kmem_cache_alloc+0x47/0x710 [ 462.449029][T13633] ? lock_acquire+0x190/0x410 [ 462.453735][T13633] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 462.459995][T13633] skb_clone+0x154/0x3d0 [ 462.464270][T13633] netlink_deliver_tap+0x94d/0xbf0 [ 462.469412][T13633] netlink_unicast+0x5a2/0x710 [ 462.474209][T13633] ? netlink_attachskb+0x7c0/0x7c0 [ 462.479510][T13633] ? _copy_from_iter_full+0x25d/0x8c0 [ 462.484897][T13633] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 462.490626][T13633] ? __check_object_size+0x3d/0x437 [ 462.495838][T13633] netlink_sendmsg+0x8a5/0xd60 [ 462.500627][T13633] ? netlink_unicast+0x710/0x710 [ 462.505572][T13633] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 462.511132][T13633] ? apparmor_socket_sendmsg+0x2a/0x30 [ 462.516646][T13633] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 462.522898][T13633] ? security_socket_sendmsg+0x8d/0xc0 [ 462.528459][T13633] ? netlink_unicast+0x710/0x710 [ 462.533489][T13633] sock_sendmsg+0xd7/0x130 [ 462.538022][T13633] ___sys_sendmsg+0x803/0x920 [ 462.542816][T13633] ? copy_msghdr_from_user+0x440/0x440 [ 462.548396][T13633] ? __kasan_check_read+0x11/0x20 [ 462.553434][T13633] ? __fget+0x384/0x560 [ 462.557615][T13633] ? ksys_dup3+0x3e0/0x3e0 [ 462.562041][T13633] ? __fget_light+0x1a9/0x230 [ 462.567010][T13633] ? __fdget+0x1b/0x20 [ 462.571099][T13633] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 462.577445][T13633] __sys_sendmsg+0x105/0x1d0 [ 462.582170][T13633] ? __sys_sendmsg_sock+0xd0/0xd0 [ 462.587229][T13633] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 462.592823][T13633] ? do_syscall_64+0x26/0x760 [ 462.597604][T13633] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 462.603772][T13633] ? do_syscall_64+0x26/0x760 [ 462.608566][T13633] __x64_sys_sendmsg+0x78/0xb0 [ 462.613345][T13633] do_syscall_64+0xfa/0x760 [ 462.617955][T13633] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 462.624047][T13633] RIP: 0033:0x459879 [ 462.628056][T13633] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 20:34:08 executing program 5: request_key(&(0x7f0000000040)='keyri~g\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0xfffffffffffffff8) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x12080, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={0x0, @local, @remote}, &(0x7f0000000100)=0xc) [ 462.648196][T13633] RSP: 002b:00007fbd480bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 462.656914][T13633] RAX: ffffffffffffffda RBX: 00007fbd480bfc90 RCX: 0000000000459879 [ 462.665175][T13633] RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000003 [ 462.673305][T13633] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 462.681565][T13633] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbd480c06d4 [ 462.689727][T13633] R13: 00000000004c77b1 R14: 00000000004dd000 R15: 0000000000000004 20:34:08 executing program 5: r0 = add_key(&(0x7f00000000c0)='trusted\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)="8e10b59a1832df9c8e5cc3991930189e1158951b3b206dd1b7ad22b35d7d0cd7f1a014e0298bedf641c98b878d27ba189b958f2e8cdb22a082fe1c80fbc15c072adba2a20121d1f702aa0dc96d23fbaf068db190f09a3bc6f99b019669c9a7b5e258eb17be4c534c7121ca0a80faa0bcdd532648f1b9948fe6f4916263fc03c789f89d518f5907655be5233add34c011037995a80ab171bde9ee795747912f873044ebf09adcc746a053a41db12c4efd3c24617f9ad1adfed70ab9ecef178bacdd30a47ae9c81634df52d784ee1f31dafea988679bf01365b2", 0xd9, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, r0) [ 463.123201][T13633] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:08 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:08 executing program 5: r0 = request_key(&(0x7f0000000040)='rxrpc_s\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100)='syz', 0xfffffffffffffffa) keyctl$clear(0x7, r0) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:34:08 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 463.545724][T13647] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 463.783528][T13651] IPVS: ftp: loaded support on port[0] = 21 [ 463.915689][T13651] chnl_net:caif_netlink_parms(): no params data found [ 463.986650][T13651] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.002735][T13651] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.013747][T13651] device bridge_slave_0 entered promiscuous mode [ 464.030423][T13651] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.043485][T13651] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.054657][T13651] device bridge_slave_1 entered promiscuous mode [ 464.102254][T13651] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 464.115439][T13651] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 464.136720][T13651] team0: Port device team_slave_0 added [ 464.145597][T13651] team0: Port device team_slave_1 added [ 464.199810][T13651] device hsr_slave_0 entered promiscuous mode [ 464.237315][T13651] device hsr_slave_1 entered promiscuous mode [ 464.297032][T13651] debugfs: Directory 'hsr0' with parent '/' already present! [ 464.390843][T13651] 8021q: adding VLAN 0 to HW filter on device bond0 [ 464.404542][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 464.412991][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 464.424216][T13651] 8021q: adding VLAN 0 to HW filter on device team0 [ 464.435727][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 464.445557][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 464.459588][ T9002] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.466677][ T9002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 464.487589][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 464.512493][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 464.525455][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 464.541480][T12956] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.548752][T12956] bridge0: port 2(bridge_slave_1) entered forwarding state [ 464.564887][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 464.584010][T13651] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 464.595355][T13651] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 464.608943][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 464.617828][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 464.630479][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 464.639606][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 464.650040][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 464.658897][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 464.668015][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 464.676580][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 464.685610][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 464.694216][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 464.702655][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 465.128991][T13655] IPVS: ftp: loaded support on port[0] = 21 [ 465.132121][T13651] 8021q: adding VLAN 0 to HW filter on device batadv0 20:34:10 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:10 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 465.758330][T13655] chnl_net:caif_netlink_parms(): no params data found [ 465.770904][T13665] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 466.239807][T13655] bridge0: port 1(bridge_slave_0) entered blocking state [ 466.254478][T13655] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.263786][T13655] device bridge_slave_0 entered promiscuous mode [ 466.278807][T13655] bridge0: port 2(bridge_slave_1) entered blocking state [ 466.286275][T13655] bridge0: port 2(bridge_slave_1) entered disabled state [ 466.294330][T13655] device bridge_slave_1 entered promiscuous mode [ 466.531350][T13655] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 466.542253][T13655] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 466.773969][T13655] team0: Port device team_slave_0 added [ 466.780996][T13655] team0: Port device team_slave_1 added [ 466.851099][T13655] device hsr_slave_0 entered promiscuous mode [ 466.907450][T13655] device hsr_slave_1 entered promiscuous mode [ 466.947053][T13655] debugfs: Directory 'hsr0' with parent '/' already present! [ 467.419589][T13655] 8021q: adding VLAN 0 to HW filter on device bond0 [ 467.433800][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 467.443162][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 467.453457][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 467.465870][T13655] 8021q: adding VLAN 0 to HW filter on device team0 [ 467.689213][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 467.698915][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 467.707758][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 467.715177][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 467.723655][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 467.732665][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 467.741347][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 467.748913][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 467.756542][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 467.765785][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 467.777006][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 467.787523][ T9973] device bridge_slave_1 left promiscuous mode [ 467.794005][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.848715][ T9973] device bridge_slave_0 left promiscuous mode [ 467.854912][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.909048][ T9973] device bridge_slave_1 left promiscuous mode [ 467.915244][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.967991][ T9973] device bridge_slave_0 left promiscuous mode [ 467.974431][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.008553][ T9973] device bridge_slave_1 left promiscuous mode [ 468.015122][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.058153][ T9973] device bridge_slave_0 left promiscuous mode [ 468.064446][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.677542][ T9973] device hsr_slave_0 left promiscuous mode [ 473.717167][ T9973] device hsr_slave_1 left promiscuous mode [ 473.769594][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 473.781290][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 473.795368][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 473.834569][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 473.945528][ T9973] bond0 (unregistering): Released all slaves [ 474.107572][ T9973] device hsr_slave_0 left promiscuous mode [ 474.157115][ T9973] device hsr_slave_1 left promiscuous mode [ 474.248740][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 474.262897][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 474.275927][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 474.342168][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 474.436224][ T9973] bond0 (unregistering): Released all slaves [ 474.607703][ T9973] device hsr_slave_0 left promiscuous mode [ 474.657226][ T9973] device hsr_slave_1 left promiscuous mode [ 474.716251][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 474.730723][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 474.746379][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 474.783902][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 474.853783][ T9973] bond0 (unregistering): Released all slaves [ 474.951377][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 474.964450][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 474.975003][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 474.984201][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 474.993108][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 475.007112][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 475.017542][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 475.025414][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 475.033729][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 475.045829][T13655] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 475.067587][T13655] 8021q: adding VLAN 0 to HW filter on device batadv0 20:34:20 executing program 2: creat(0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0xee68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x2000, 0x0, &(0x7f0000199000/0x2000)=nil) syz_open_dev$vcsn(0x0, 0x0, 0x8000) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) pread64(r0, 0x0, 0x0, 0x0) lgetxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='trusted.overlay.opaque\x00', 0x0, 0x0) write$P9_RWALK(r1, 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) mlockall(0x1) ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000500)=""/134) fcntl$dupfd(r0, 0x406, 0xffffffffffffffff) ioctl$void(r1, 0xc0045c78) setsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000000480), 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) chdir(&(0x7f0000000300)='./file0\x00') 20:34:20 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x3, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:20 executing program 5: request_key(&(0x7f0000000140)='keyring\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x40000, 0x0) 20:34:20 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:20 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:20 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x20001, 0x0) ioctl$KVM_S390_UCAS_MAP(r0, 0x4018ae50, &(0x7f00000000c0)={0x20, 0xff, 0x7}) ioctl$KVM_RUN(r0, 0xae80, 0x0) [ 475.327581][T13677] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x4, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:20 executing program 5: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x105000, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r0, 0x4068aea3, &(0x7f00000000c0)={0x7b, 0x0, [0x4, 0xffffffff, 0x1000, 0xcac]}) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:34:20 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$usbmon(0xffffffffffffff9c, &(0x7f0000000040)='/dev/usbmon0\x00', 0x1, 0x0) writev(r0, &(0x7f0000000240)=[{&(0x7f00000000c0)="3b827aa25446c1f1357cbf36e26fb806a1b33dae53cb7d7b362f2183e9b9c4404bd420a72ef52f0823090bdd78e95a8e7036f066a18b4aaaab109608bcd1656f5ead4077f96ae3ad5e34df2081492312e8c8b82700daab722fa21db0cb2bd2ae63bda21cf877afeab0fefe21bb2c23fc5c68c541cf6dbda20e8d4c14a844f1cb2981a7550c63edaa7dbfeee5bc4bc481f7ddde04c527c7491a87cbdcec58e9ce94e5663e06591bca17409cc910ab381d185256c4884ede06a5edf0fcc1afac77b4eeee8634f633f0b94fd8fed73fdfba9aea1f96661d09303df80144954c0ae4", 0xe0}, {&(0x7f00000001c0)="80cbfe6a94fcaccef50b619a796d9e2c9328f3fa91dc3b1215ca31c65754d468a6aef34305c71cb7e096aa231e282c3c0f313a3a53549978c3fd6b675558310c4514aeb0a1b61363e295ec3359e95586916417e4a85f6a9b3b65a92d467e0b13b7ac41deeec75d3ce406f8f6c6eff87eee76d0749c994e4b6acc5e79c88d", 0x7e}], 0x2) 20:34:21 executing program 5: r0 = request_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)='/dev/dmmidi#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000000)='r8rp\xa9 ', &(0x7f0000000080)={'syz', 0x0}, 0x0, r0) r1 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x10001, 0x80000) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r1, 0xc008551b, &(0x7f00000000c0)={0xb6000000, 0xc, [0x3f, 0x8000000080000000, 0x9]}) 20:34:21 executing program 5: getitimer(0x973b2cf76fe5aa0c, &(0x7f0000000180)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='attr/keycreate\x00') inotify_add_watch(r0, &(0x7f0000000140)='./file0\x00', 0x1000000) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x7fff, 0x4) request_key(&(0x7f0000000000)='~eyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x40800) 20:34:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x41, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) readv(r0, &(0x7f0000000680)=[{&(0x7f0000000300)=""/220, 0xdc}], 0x1) [ 476.090626][T13683] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 477.200168][T13699] IPVS: ftp: loaded support on port[0] = 21 [ 477.333443][T13699] chnl_net:caif_netlink_parms(): no params data found [ 477.385041][T13699] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.393562][T13699] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.402335][T13699] device bridge_slave_0 entered promiscuous mode [ 477.413305][T13699] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.421006][T13699] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.429436][T13699] device bridge_slave_1 entered promiscuous mode [ 477.453526][T13699] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 477.465422][T13699] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 477.499595][T13699] team0: Port device team_slave_0 added [ 477.507497][T13699] team0: Port device team_slave_1 added [ 477.579805][T13699] device hsr_slave_0 entered promiscuous mode [ 477.657149][T13699] device hsr_slave_1 entered promiscuous mode [ 477.717715][T13699] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.724831][T13699] bridge0: port 2(bridge_slave_1) entered forwarding state [ 477.732287][T13699] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.739843][T13699] bridge0: port 1(bridge_slave_0) entered forwarding state [ 477.772459][T13703] IPVS: ftp: loaded support on port[0] = 21 [ 477.793463][T13704] IPVS: ftp: loaded support on port[0] = 21 [ 477.897587][T13699] 8021q: adding VLAN 0 to HW filter on device bond0 [ 477.951666][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 477.960658][ T9002] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.970526][ T9002] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.987474][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 478.004434][T13699] 8021q: adding VLAN 0 to HW filter on device team0 [ 478.025999][T13703] chnl_net:caif_netlink_parms(): no params data found [ 478.053674][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 478.063886][T12956] bridge0: port 1(bridge_slave_0) entered blocking state [ 478.071237][T12956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 478.121382][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 478.134896][T12956] bridge0: port 2(bridge_slave_1) entered blocking state [ 478.142429][T12956] bridge0: port 2(bridge_slave_1) entered forwarding state [ 478.180721][T13703] bridge0: port 1(bridge_slave_0) entered blocking state [ 478.189433][T13703] bridge0: port 1(bridge_slave_0) entered disabled state [ 478.199381][T13703] device bridge_slave_0 entered promiscuous mode [ 478.208345][T13704] chnl_net:caif_netlink_parms(): no params data found [ 478.220439][T13703] bridge0: port 2(bridge_slave_1) entered blocking state [ 478.230531][T13703] bridge0: port 2(bridge_slave_1) entered disabled state [ 478.249159][T13703] device bridge_slave_1 entered promiscuous mode [ 478.264302][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 478.275026][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 478.578324][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 478.588716][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 478.612268][T13703] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 478.625539][T13703] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 478.781990][T13704] bridge0: port 1(bridge_slave_0) entered blocking state [ 478.789565][T13704] bridge0: port 1(bridge_slave_0) entered disabled state [ 478.802461][T13704] device bridge_slave_0 entered promiscuous mode [ 478.811295][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 478.820048][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 478.841464][T13703] team0: Port device team_slave_0 added [ 478.848899][T13703] team0: Port device team_slave_1 added [ 478.856027][T13704] bridge0: port 2(bridge_slave_1) entered blocking state [ 478.863961][T13704] bridge0: port 2(bridge_slave_1) entered disabled state [ 478.873129][T13704] device bridge_slave_1 entered promiscuous mode [ 479.035631][T13699] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 479.049850][T13699] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 479.059556][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 479.069555][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 479.130133][T13703] device hsr_slave_0 entered promiscuous mode [ 479.167368][T13703] device hsr_slave_1 entered promiscuous mode [ 479.207035][T13703] debugfs: Directory 'hsr0' with parent '/' already present! [ 479.359182][T13704] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 479.379787][T13704] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 479.545109][T13699] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 479.575914][T13704] team0: Port device team_slave_0 added [ 479.736914][T13704] team0: Port device team_slave_1 added [ 479.800493][T13704] device hsr_slave_0 entered promiscuous mode [ 479.857282][T13704] device hsr_slave_1 entered promiscuous mode [ 479.896939][T13704] debugfs: Directory 'hsr0' with parent '/' already present! [ 480.380022][T13703] 8021q: adding VLAN 0 to HW filter on device bond0 [ 480.554080][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 480.563007][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 480.575120][T13703] 8021q: adding VLAN 0 to HW filter on device team0 [ 480.593413][T13704] 8021q: adding VLAN 0 to HW filter on device bond0 [ 480.603170][ T9973] device bridge_slave_1 left promiscuous mode [ 480.609880][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 480.638109][ T9973] device bridge_slave_0 left promiscuous mode [ 480.645286][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 480.718293][ T9973] device bridge_slave_1 left promiscuous mode [ 480.724909][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 480.767947][ T9973] device bridge_slave_0 left promiscuous mode [ 480.774777][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 484.627588][ T9973] device hsr_slave_0 left promiscuous mode [ 484.667061][ T9973] device hsr_slave_1 left promiscuous mode [ 484.719086][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 484.732572][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 484.745770][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 484.784551][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 484.893388][ T9973] bond0 (unregistering): Released all slaves [ 485.067627][ T9973] device hsr_slave_0 left promiscuous mode [ 485.106990][ T9973] device hsr_slave_1 left promiscuous mode [ 485.194851][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 485.208640][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 485.220389][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 485.265034][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 485.344612][ T9973] bond0 (unregistering): Released all slaves [ 485.463058][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 485.471944][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 485.480440][ T9002] bridge0: port 1(bridge_slave_0) entered blocking state [ 485.487662][ T9002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 485.495200][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 485.504631][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 485.513058][ T9002] bridge0: port 2(bridge_slave_1) entered blocking state [ 485.520310][ T9002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 485.529612][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 485.552256][T13704] 8021q: adding VLAN 0 to HW filter on device team0 [ 485.573792][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 485.581728][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 485.590885][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 485.600357][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 485.610443][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 485.619982][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 485.629915][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 485.653018][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 485.662506][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 485.672149][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 485.681425][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 485.690509][ T3504] bridge0: port 1(bridge_slave_0) entered blocking state [ 485.697818][ T3504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 485.705525][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 485.714028][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 485.725243][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 485.734488][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 485.743309][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 485.750452][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 485.758457][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 485.771517][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 485.782578][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 485.790859][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 485.801872][T13703] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 485.831418][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 485.842746][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 485.851810][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 485.862152][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 485.871728][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 485.881274][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 485.889897][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 485.898627][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 485.907389][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 485.916370][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 485.926461][T13704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 486.072877][T13703] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 486.085853][T13704] 8021q: adding VLAN 0 to HW filter on device batadv0 20:34:31 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x80002, 0x4000000088) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x10010000004e20}, 0x1c) syz_emit_ethernet(0x83, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaa2aaaaaaa86dd601bfc97004d8800fe800000000000000000000000000000ff02000000000000000000000000000100004e2000149378d33e1db1c73936878ceb7eda2d3d1e31bebaf0c77aa3f7fac33b0403f7f07a8da550af2bd3682368e206000000000000018000009e7429a53d9c09dba94acb114205c1058889d6ca25e2bb709e672b96475330001f21ff95bae25d1f57ec413d82000000000000000000000000008451cb5c8546a6b58b5b36701589ee4e83ac611cb944915546097a99009a7da385eeef1866bf6b8d9ea26524577f4a5999cd9076386b25f7270ea84d9d579ea8ee86f14e032fb67f40f5dc29c59e0ccc8644528528351c5e34c62436372460b79daa76e75c44750fdaa25b4302f5319831414b3e8ad04f243e365fff0d98d02c78617e69590113a9e53911fff45fb1aa9477d767abd9e3755589435da51e45bca8f1a5635376b452b84ef08f2037582e914d06c5c9135300000000000000094752a7381d28604d1bc502f36dcf39cfeb4073c904a2d7cf3ced1f3d64325e1c57a7c076451b545f4f36bc2468397a0000000000000000000000000011bbd3be0807e5f9b199bb4bb181d0003d230a9778ecc86dd16d9cd1e4287a59880000000000003b15d1bd57965d476e1a51123b5cbd3fc5ffa429fbc56ae502dffa2f928d1157d2433fd5292bcc9caaebef94cf629d7c9a2e32a69539b21dad4aef3cd0c5776043fdfd4c6242b2f99135ec3e20daf9a9e387f3aaaed3a243726d361ec76222e73c2ce7c7b65f99c8cb1c9b9105074cad887354f4c470faa26fcbe406c65cac2b0d27940bf64f654955daca1fe35c1530843aad6bbef37b2e8084c0cec54c12b117d5c26625cd448b580554fdff39e780084be36a60cdab2ec88f38c05a204f9d3bac81bd923177617846e3093f2d53512a78847ab46d3cb594360611000000000000000004c9"], 0x0) recvmmsg(r1, &(0x7f00000021c0), 0x6b7, 0x6, 0x0) 20:34:31 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x547483b0688d0ddc, 0xffff, 0x80000001, 0x8, 0x10, 0x1, 0x3ff, [], 0x0, 0xffffffffffffffff, 0x5}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000240)={r0, &(0x7f00000000c0)="e39ad95b62b219a1ab094f0b203036a6dcaab0b22b046920cd6fe4471de77fba56bf9c39a3400603e03dcde0139363d1b936333f6b22a2d468082eec74fe2e989f5b034587d5f74ea9a364249c5679912ff441dcd3807f34c4109e40d7bd59bd64f82cf8999260b996d4a82c26738ac237b3c93f8b8d1a5f2d363b2a7e52d1a4", &(0x7f0000000140)="e849d22841f823057cdbbc7fbea7a35b9c93d09d772e140eaf77030688dd12a2128a77f5c7e780cda6ba7aa87448154304de558f09b29c097bb16c833357f42475342f9481bce6fd230ad53188d0076f30de9c1ba67a208ad7387e18d5e173ec8739f104e44b1b70293a18ca771c881decc79863e7cdb4d71d005d8579cc0c6e8b1743911c819842dabd4c880f95924a7b117616fb37983ca9f576b6c80bf48f5912969fa485769c2ac528fb3666989e8b00007dea09d83494cf0b1151478aabd0d9b96d0da0c782f779468ffcf47f88873ca59846d97478bf3a9b042e13dafd3c3b15d505be7dbd", 0x3}, 0x20) r1 = syz_open_dev$usbmon(&(0x7f0000000280)='/dev/usbmon#\x00', 0x7f, 0x2000) ioctl$TCGETX(r1, 0x5432, &(0x7f00000002c0)) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000300)) 20:34:31 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x5, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:31 executing program 2: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000cc0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet_mreqsrc(r0, 0x0, 0x0, 0x0, 0x0) 20:34:31 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:31 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:31 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x202102) setsockopt$MISDN_TIME_STAMP(r0, 0x0, 0x1, &(0x7f0000000040)=0x1, 0x4) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f00000002c0)={0x0, 0xa7, "249e762659d20f1473933ee11f182c3b14c31e8491dd9068e36c76b2f3976f8ba4fe021c14904d24cbdac6bb66c0244097e1c550dd30265b029408cea54e12c14684f4992ab804a65e7eb70a8ead3b8e688c791c12ae47263d133fa967ab3dddf34e27ad6881d56b971376f15b2197c3969af7076f35cba2f8a720a461f04f168818c58f011521e39adad10204b34573624aeb20c28d12cd51374e55e73dd5dad4bb8b181156e5"}, &(0x7f0000000380)=0xaf) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000400)={r1, 0xa1, "11c31daefa506172ba77c7bbeefa32076dcf7daf9e325d160a206cb7c6ba92607ee46853ad4398177b4672da614a5b380236565ee079006d296ef2811d2179e0ffe509955d4b7a9efaa133f35e993e631551c80f0b4db71d9e8593a91fba13fe0b2d6ede8c2cb86b6244bf4efa5d27ecedccf2f616a71db380d94516b64e8898d6b2e4b846371056950de8b23049dbc4d456b90a25d1df6eccd268c5a2c2067d23"}, &(0x7f00000004c0)=0xa9) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0x1}, 0x8) fsetxattr(0xffffffffffffffff, &(0x7f0000000000)=@random={'os2.', '/%(wlan0GPL\x00'}, &(0x7f0000000080)=',\x00', 0x2, 0x1) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000100)={r0, &(0x7f00000000c0)="9da7262e65857e477dc08827a5f850dc22113059c67a7f5c227f6d5189a354f7246fd2993b609e6b2cd43b8a767bc8a2840030"}, 0x10) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000000180)={{0x1, 0x4007, 0x3, 0x8, 0x0, 0x9, 0x3ff, 0x8000, 0xffff, 0x8, 0x6e, 0x15}, {0x2000, 0x58ee615607d78fea, 0x10, 0x3, 0x2, 0x4, 0x2, 0x1f, 0x0, 0xee7, 0x0, 0x200}, {0x7ce5a60afafafb68, 0x4, 0xa, 0xef6, 0x9, 0xa15d, 0x645, 0x1f, 0x400000000000000, 0x4000400000000, 0x3, 0xfff}, {0x1000, 0x4000, 0x8, 0x7, 0x1, 0x0, 0x7, 0x7, 0x4, 0x40, 0x101, 0x10000}, {0x6000, 0x3000, 0x3, 0x5, 0x4, 0x5, 0x3, 0x100000001, 0x0, 0x3, 0x1ee1, 0xfffffffffffffff7}, {0x100000, 0x3000, 0xb, 0x9, 0x0, 0x0, 0x1, 0x7fff, 0xffffffff80000000, 0x0, 0xffffffff, 0x9}, {0x1, 0x3000, 0x1e, 0x7ff, 0x100000001, 0x100000000, 0x3f, 0x3, 0x4, 0x1f, 0x3, 0xa7d}, {0x0, 0xf000, 0x4, 0x4, 0xd4, 0x6, 0x8, 0xffffffffffffffff, 0x400, 0x6, 0xdc91, 0x3}, {0x3000, 0x1000}, {0x5000}, 0x10000, 0x0, 0x1, 0x400200, 0xd, 0x2800, 0x101000, [0x5, 0x6, 0x8]}) 20:34:32 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:32 executing program 5: add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) r0 = request_key(&(0x7f00000002c0)='ceph\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000380)='*$#-keyring\x00', 0x0) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000280)={'syz', 0x1}, 0x0, r0) r1 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000540)={0x1, 0x6}, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc8, 0xc8, 0x9, [@union={0x1, 0x2, 0x0, 0x5, 0xf64, 0x80000000, [{0xa, 0x2, 0xd980}, {0x8, 0x4, 0x2}]}, @enum={0x7, 0x2, 0x0, 0x6, 0x4, [{0x7, 0xfff}, {0x3, 0x2}]}, @enum={0x0, 0x1, 0x0, 0x6, 0x4, [{0xb, 0x4}]}, @ptr={0x6, 0x0, 0x0, 0x2, 0x5}, @enum={0xe, 0x7, 0x0, 0x6, 0x4, [{0x1, 0x1f}, {0x8, 0x5}, {0xfff, 0x54ea}, {0x3, 0xd2d}, {0x7, 0x9}, {0xb, 0x5}, {0x8, 0x2}]}, @struct={0x8, 0x1, 0x0, 0x4, 0x5, 0x7, [{0x8, 0x3, 0x7ff}]}, @restrict={0x2, 0x0, 0x0, 0xb, 0x5}]}, {0x0, [0x61, 0x0, 0x61, 0x5f, 0x30, 0x5f, 0x0]}}, &(0x7f0000000300)=""/77, 0xe9, 0x4d, 0x9}, 0x20) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f00000004c0)={{0x7c2d, 0x401}, 0x0, 0xe01, 0x3f, {0x6, 0x80000001}, 0x8, 0x2d1a}) 20:34:32 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:32 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x402, 0x0) ioctl$IOC_PR_PREEMPT(r0, 0x401870cb, &(0x7f00000000c0)={0x80000001, 0x0, 0x101, 0x3ff80000000000}) 20:34:32 executing program 5: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x101000, 0x0) ioctl$KVM_GET_NESTED_STATE(r0, 0xc080aebe, &(0x7f00000000c0)={0x0, 0x0, 0x2080}) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000002140), &(0x7f0000002180)=0x4) [ 487.257096][T13736] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:33 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f000007affc), 0x4) close(r1) 20:34:33 executing program 5: r0 = request_key(&(0x7f0000000140)='cifs.idmap\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)='syz', 0xfffffffffffffffa) request_key(&(0x7f0000000240)='big_key\x00', &(0x7f0000000280)={'syz', 0x2}, 0x0, r0) 20:34:33 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x6, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 487.922324][T13774] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 488.712456][T13777] IPVS: ftp: loaded support on port[0] = 21 [ 488.811916][T13777] chnl_net:caif_netlink_parms(): no params data found [ 488.862016][T13777] bridge0: port 1(bridge_slave_0) entered blocking state [ 488.869543][T13777] bridge0: port 1(bridge_slave_0) entered disabled state [ 488.877967][T13777] device bridge_slave_0 entered promiscuous mode [ 488.885936][T13777] bridge0: port 2(bridge_slave_1) entered blocking state [ 488.893432][T13777] bridge0: port 2(bridge_slave_1) entered disabled state [ 488.901381][T13777] device bridge_slave_1 entered promiscuous mode [ 488.921460][T13777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 488.933186][T13777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 488.954342][T13777] team0: Port device team_slave_0 added [ 488.961855][T13777] team0: Port device team_slave_1 added [ 489.030069][T13777] device hsr_slave_0 entered promiscuous mode [ 489.067311][T13777] device hsr_slave_1 entered promiscuous mode [ 489.107050][T13777] debugfs: Directory 'hsr0' with parent '/' already present! [ 489.395014][T13777] bridge0: port 2(bridge_slave_1) entered blocking state [ 489.402441][T13777] bridge0: port 2(bridge_slave_1) entered forwarding state [ 489.410109][T13777] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.417480][T13777] bridge0: port 1(bridge_slave_0) entered forwarding state [ 489.590327][T13777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 489.603034][ T8925] bridge0: port 1(bridge_slave_0) entered disabled state [ 489.612467][ T8925] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.621620][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 489.631236][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 489.640550][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 489.790248][T13777] 8021q: adding VLAN 0 to HW filter on device team0 [ 489.803036][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 489.812137][ T9002] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.819258][ T9002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 489.978261][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 489.991134][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 489.998525][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 490.014003][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 490.022791][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 490.031892][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 490.041266][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 490.051055][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 490.198786][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 490.208132][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 490.216814][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 490.225598][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 490.236961][T13777] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 490.399635][T13777] 8021q: adding VLAN 0 to HW filter on device batadv0 20:34:36 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000780)={"54abec7338595f275a2292c45ff078f1cbbf04241d1c3421ec9bf61b2221bc18246e74f0001e36735c2ad340bf94ad2a35cfc5d0953a3b2bfd41e2e051c6765447395415a9b05dffbe957e300168dc46f8377130fd28e50a805a6005ab6167da65430e3fcc214d7893c6d91026b5f5192f346a367dbc8ae5df0fd099b4e7a6dadd7f555b203f504eda86e0e8d8c5f319604db5a686750d03bf3a67210063e9a17ca0a1ccd80a7d57cb034b828b784b14c9e5dd70ca358c6819c3df7f4443dced6d9a56bb54eac6538cc61c5e9ef3bda9feeb62cbe4f0e1d1c7f6cbbcada85dbb247b0551773f0734e6f4733db49c22e497557c2f74bfa0e4af9b6228643f180d9f9e1e2bcdf0c35a5b8c388e728b574a066e190800db7b42573f534b8f60e8f756dc4d8dec7ad58b0474fc002851b265cc72099d43115828ac723e73009150fcf7196b4133e2988d4b0fc459e57293afef8837fa0d5d24b984a95cb4bdc48fc9c6e73ebee6b1a3239b2c0eef7c751ccb9f2dcdc3c69173db48df6b5d6e59e6465283de675a8d053e7f3abf86f43006a5a0c6225a589c12583e767b9d817f17bf690444a18e6f8a35b2cb4b60c191efbb16393560b568ee6c82bed918aa4a34b575ac9966b395aafa7fc3b7f467b484eb7d2617e0a240e8acbc2a7e02b650f7d1be52f462be20faa32dd88eb041e2c46b24ed7ab79c10f05296f5461f4ebda25dd7b9908da4be62b0871b169016fab8aae31c7ba45e5b30b7556a062999f43d2dbb9995d2d5de72ffe885bf6bce45caa470933c0906807da75cd38533d8f16d875452c543b259e78215011d2be638eab023513cfe0693d3107e17cfc87e038fc7d1db232d15307fe1d2a818d0a4bde2c53d221111ffa646514dd1fbd3c011b058f79c6fb0a31857ea309018bf72180a434611195c975cf5e285777231b6f158ecaf212183600379fe9762277cf2cb6cde9cc0178b883fd1f210180e599f8eb33d33a9ff0f70db1de485b2f2434f2707bf9a54bb6aff687c515c430d5087f4d53a57adf7c97a06dcc61d7733a93dc505d57d8d5c83bf83e345a979307d708756c3f0f1c53a28883b665fda239019f32fc6f07d700d05023e9ef5b66d4b6be57ffd6fe39703fd4eed61535568f47ee51eff8290618e8387d0ba0d00c5bc4585d2d85688af46bb1da08bf42901634cb10e6b03ee276c16980090b59f3c57b428ae0a7ede758c781e2a5a8585e903adde0a0a281a7779a59067d82985655d9138b75042970e11aee4b95b8bcf232473767cca0139b2c2fb40045c6e031950c314015db2524c3f2fe941f249d158a44aa14774e61b2ee185bdfea8f317e440a39533c6db7ffd3c2b626c1e1e088bcebc59526b016cc6a0e4b766c3f00f619d366e5a4378bc15f805a6fb8c9400"}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_RUN(r2, 0xae80, 0x0) 20:34:36 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:36 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:36 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x7, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:36 executing program 5: r0 = request_key(&(0x7f0000000040)='blacklist\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000100)=']trusted\x00', 0xffffffffffffffff) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, r0) 20:34:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f0000006380)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000021c0)=[{0x10}, {0x10, 0x1, 0xffffffff00000001}], 0x20}}], 0x2, 0x0) 20:34:36 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000080}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@ipv4_newroute={0x2c, 0x18, 0x400, 0x70bd2a, 0x25dfdbfd, {0x2, 0x0, 0x30, 0x7, 0x0, 0x4, 0xfe, 0xe8351566edbee514, 0x800}, [@RTA_MARK={0x8}, @RTA_GATEWAY={0x8, 0x5, @multicast1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000200)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r1, 0x10, 0x70bd26, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) socket$nl_generic(0x10, 0x3, 0x10) 20:34:36 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:36 executing program 5: sched_yield() request_key(&(0x7f0000000040)='\xf1?\x00\x00\x00\xe5\x83\x85', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) [ 491.247067][T13788] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:36 executing program 2: 20:34:36 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xa, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:36 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200000, 0x69) write$char_usb(r0, &(0x7f00000000c0)="0889b525941b91113640916830d4718733295fe75cfbd09cfd7d873250039eac31f61738c769fed82349aa9e66468638f2430b43b971ae9eb03e82ac35add8d917866ba037cedc9d8370cb5d73708f774ac25403b1bb5a2be26ee51eda001519bbb03c282f53c5e565f8eae24757ca19655b6cda0cb1e212cbe9bf2ae5fc1e9776d8ab21e7dd4b512963929a6dd3c6aa8653103b9f2eb027b8c9799676f4d35bfec2ec8e8ec35943bd8aee77b26d7e2fb502bee7336fb73dac7a7ba1a52036a410a910cf064d5ac206d44a1ac30f6ed7fe9fce318eef079c", 0xd8) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:34:36 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:36 executing program 5: r0 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x2}, 0x0, r0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000000c0)={{{@in=@initdev, @in6=@local}}, {{@in6=@empty}, 0x0, @in=@dev}}, &(0x7f0000000040)=0xe8) [ 492.031621][T13815] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 492.070027][ T9973] device bridge_slave_1 left promiscuous mode [ 492.086507][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.127870][ T9973] device bridge_slave_0 left promiscuous mode [ 492.134143][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.178623][ T9973] device bridge_slave_1 left promiscuous mode [ 492.186983][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.228073][ T9973] device bridge_slave_0 left promiscuous mode [ 492.234680][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 496.217295][ T9973] device hsr_slave_0 left promiscuous mode [ 496.287182][ T9973] device hsr_slave_1 left promiscuous mode [ 496.365222][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 496.383322][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 496.395040][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 496.471597][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 496.545950][ T9973] bond0 (unregistering): Released all slaves [ 496.737727][ T9973] device hsr_slave_0 left promiscuous mode [ 496.787027][ T9973] device hsr_slave_1 left promiscuous mode [ 496.838300][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 496.851405][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 496.869185][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 496.933840][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 497.025170][ T9973] bond0 (unregistering): Released all slaves [ 497.124909][T13836] IPVS: ftp: loaded support on port[0] = 21 [ 497.125622][T13834] IPVS: ftp: loaded support on port[0] = 21 [ 497.243154][T13834] chnl_net:caif_netlink_parms(): no params data found [ 497.324876][T13834] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.332655][T13834] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.344391][T13834] device bridge_slave_0 entered promiscuous mode [ 497.355005][T13834] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.362354][T13834] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.370914][T13834] device bridge_slave_1 entered promiscuous mode [ 497.392551][T13836] chnl_net:caif_netlink_parms(): no params data found [ 497.405955][T13834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 497.417684][T13834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 497.464111][T13834] team0: Port device team_slave_0 added [ 497.518492][T13836] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.526172][T13836] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.535107][T13836] device bridge_slave_0 entered promiscuous mode [ 497.544154][T13834] team0: Port device team_slave_1 added [ 497.607178][T13836] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.614647][T13836] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.630323][T13836] device bridge_slave_1 entered promiscuous mode [ 497.689804][T13834] device hsr_slave_0 entered promiscuous mode [ 497.727268][T13834] device hsr_slave_1 entered promiscuous mode [ 497.766922][T13834] debugfs: Directory 'hsr0' with parent '/' already present! [ 497.795698][T13836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 497.810461][T13836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 497.842476][T13836] team0: Port device team_slave_0 added [ 497.851040][T13836] team0: Port device team_slave_1 added [ 497.919773][T13836] device hsr_slave_0 entered promiscuous mode [ 497.964392][T13836] device hsr_slave_1 entered promiscuous mode [ 498.006870][T13836] debugfs: Directory 'hsr0' with parent '/' already present! [ 498.016552][T13834] bridge0: port 2(bridge_slave_1) entered blocking state [ 498.023932][T13834] bridge0: port 2(bridge_slave_1) entered forwarding state [ 498.031602][T13834] bridge0: port 1(bridge_slave_0) entered blocking state [ 498.038898][T13834] bridge0: port 1(bridge_slave_0) entered forwarding state [ 498.083772][T13836] bridge0: port 2(bridge_slave_1) entered blocking state [ 498.091028][T13836] bridge0: port 2(bridge_slave_1) entered forwarding state [ 498.098811][T13836] bridge0: port 1(bridge_slave_0) entered blocking state [ 498.106232][T13836] bridge0: port 1(bridge_slave_0) entered forwarding state [ 498.135060][ T9002] bridge0: port 1(bridge_slave_0) entered disabled state [ 498.148065][ T9002] bridge0: port 2(bridge_slave_1) entered disabled state [ 498.163197][ T9002] bridge0: port 1(bridge_slave_0) entered disabled state [ 498.171333][ T9002] bridge0: port 2(bridge_slave_1) entered disabled state [ 498.253124][T13836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 498.269188][T13834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 498.284156][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 498.300847][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 498.312590][T13836] 8021q: adding VLAN 0 to HW filter on device team0 [ 498.327418][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 498.335397][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 498.360124][T13834] 8021q: adding VLAN 0 to HW filter on device team0 [ 498.369616][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 498.386527][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 498.396345][ T8922] bridge0: port 1(bridge_slave_0) entered blocking state [ 498.403866][ T8922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 498.421640][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 498.434382][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 498.452558][ T8922] bridge0: port 2(bridge_slave_1) entered blocking state [ 498.460057][ T8922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 498.476906][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 498.485801][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 498.507126][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 498.515856][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 498.525130][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 498.534803][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 498.543773][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 498.552442][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 498.571120][T13836] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 498.583455][T13836] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 498.593626][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 498.611279][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 498.624356][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 498.635999][ T3504] bridge0: port 1(bridge_slave_0) entered blocking state [ 498.643933][ T3504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 498.652457][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 498.662572][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 498.671290][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 498.678421][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 498.686325][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 498.695542][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 498.706184][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 498.738864][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 498.749078][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 498.758702][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 498.767952][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 498.777612][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 498.787399][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 498.802073][T13836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 498.824347][T13834] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 498.844755][T13834] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 498.877353][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 498.886051][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 498.914803][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 498.934820][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 498.952030][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 498.987165][T13834] 8021q: adding VLAN 0 to HW filter on device batadv0 20:34:44 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:44 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f000000b780)=[{{&(0x7f00000000c0)=@nl=@proc, 0x80, &(0x7f0000001440)=[{&(0x7f0000000040)=""/20, 0x14}, {&(0x7f0000000140)=""/182, 0xb6}, {&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000001200)=""/196, 0xc4}, {&(0x7f0000001300)=""/51, 0x33}, {&(0x7f0000001340)=""/250, 0xfa}], 0x6, &(0x7f00000014c0)=""/4096, 0x1000}, 0x7f}, {{&(0x7f00000024c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000003700)=[{&(0x7f0000002540)=""/39, 0x27}, {&(0x7f0000002580)=""/33, 0x21}, {&(0x7f00000025c0)=""/235, 0xeb}, {&(0x7f00000026c0)=""/55, 0x37}, {&(0x7f0000002700)=""/4096, 0x1000}], 0x5, &(0x7f0000003780)=""/6, 0x6}}, {{&(0x7f00000037c0)=@xdp, 0x80, &(0x7f00000039c0)=[{&(0x7f0000003840)=""/209, 0xd1}, {&(0x7f0000003940)=""/108, 0x6c}], 0x2}, 0x9}, {{&(0x7f0000003a00)=@ipx, 0x80, &(0x7f0000004cc0)=[{&(0x7f0000003a80)=""/121, 0x79}, {&(0x7f0000003b00)=""/46, 0x2e}, {&(0x7f0000003b40)=""/4096, 0x1000}, {&(0x7f0000004b40)=""/183, 0xb7}, {&(0x7f0000004c00)=""/30, 0x1e}, {&(0x7f0000004c40)=""/93, 0x5d}], 0x6, &(0x7f0000004d40)=""/4096, 0x1000}, 0x400}, {{&(0x7f0000005d40)=@xdp, 0x80, &(0x7f0000007100)=[{&(0x7f0000005dc0)=""/230, 0xe6}, {&(0x7f0000005ec0)=""/254, 0xfe}, {&(0x7f0000005fc0)=""/4096, 0x1000}, {&(0x7f0000006fc0)=""/59, 0x3b}, {&(0x7f0000007000)=""/219, 0xdb}], 0x5, &(0x7f0000007180)}, 0xf75}, {{0x0, 0x0, &(0x7f0000008380)=[{&(0x7f00000071c0)}, {&(0x7f0000007200)=""/72, 0x48}, {&(0x7f0000007280)=""/237, 0xed}, {&(0x7f0000007380)=""/4096, 0x1000}], 0x4}, 0x100000000}, {{&(0x7f00000083c0)=@rc, 0x80, &(0x7f00000099c0)=[{&(0x7f0000008440)=""/206, 0xce}, {&(0x7f0000008540)=""/163, 0xa3}, {&(0x7f0000008600)}, {&(0x7f0000008640)=""/13, 0xd}, {&(0x7f0000008680)=""/127, 0x7f}, {&(0x7f0000008700)=""/232, 0xe8}, {&(0x7f0000008800)=""/137, 0x89}, {&(0x7f00000088c0)=""/4096, 0x1000}, {&(0x7f00000098c0)=""/169, 0xa9}, {&(0x7f0000009980)=""/62, 0x3e}], 0xa, &(0x7f0000009a80)=""/173, 0xad}, 0x7}, {{&(0x7f0000009b40)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f000000b080)=[{&(0x7f0000009bc0)=""/251, 0xfb}, {&(0x7f0000009cc0)=""/50, 0x32}, {&(0x7f0000009d00)=""/231, 0xe7}, {&(0x7f0000009e00)=""/4096, 0x1000}, {&(0x7f000000ae00)=""/64, 0x40}, {&(0x7f000000ae40)=""/16, 0x10}, {&(0x7f000000ae80)=""/141, 0x8d}, {&(0x7f000000af40)=""/206, 0xce}, {&(0x7f000000b040)=""/46, 0x2e}], 0x9, &(0x7f000000b140)=""/27, 0x1b}, 0x81}, {{&(0x7f000000b180)=@nfc, 0x80, &(0x7f000000b600)=[{&(0x7f000000b200)=""/178, 0xb2}, {&(0x7f000000b2c0)=""/75, 0x4b}, {&(0x7f000000b340)=""/97, 0x61}, {&(0x7f000000b3c0)=""/155, 0x9b}, {&(0x7f000000b480)=""/29, 0x1d}, {&(0x7f000000b4c0)=""/208, 0xd0}, {&(0x7f000000b5c0)=""/39, 0x27}], 0x7, &(0x7f000000b680)=""/251, 0xfb}, 0x211d}], 0x9, 0x40, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f000000b9c0)={0x0, 0x5}, &(0x7f000000ba00)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f000000ba40)={r1, 0x6}, &(0x7f000000ba80)=0x8) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:34:44 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:44 executing program 3: set_mempolicy(0x2, &(0x7f0000000340)=0x7f, 0x6) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x5, 0x209e1e, 0x8, 0x1}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000340)}, 0x20) 20:34:44 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:44 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:44 executing program 5: request_key(&(0x7f0000000080)='.request_key_auth\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0) r0 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000000)={{0x3, @netrom}, [@bcast, @null, @remote, @rose, @default, @default, @remote, @default]}, &(0x7f0000000100)=0x48, 0x80000) getsockopt$sock_buf(r0, 0x1, 0x1a, &(0x7f0000000140)=""/236, &(0x7f0000000240)=0xec) 20:34:44 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 499.349157][T13860] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:44 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xe, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:44 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl(r0, 0xfffffbfffff3ffa7, &(0x7f0000000140)) 20:34:45 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:45 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x308, 0x101001) write$vnet(r0, &(0x7f00000001c0)={0x1, {&(0x7f00000000c0)=""/3, 0x3, &(0x7f0000000100)=""/170, 0x1, 0x2}}, 0x68) [ 500.026298][T13881] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:45 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:45 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:45 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25, 0x2}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:45 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x400, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000100)={'ip6_vti0\x00', {0x2, 0x4e22, @loopback}}) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f00000000c0)) connect$ax25(r0, &(0x7f0000000140)={{0x3, @default, 0x1}, [@bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @bcast]}, 0x48) 20:34:45 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:45 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xf, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 500.197787][T13907] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:45 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/dlm-monitor\x00', 0x40325bb806d1dbb4, 0x0) ioctl$TCSETXW(r0, 0x5435, &(0x7f0000000040)={0x1, 0x1, [0x0, 0x1, 0x3, 0xa5a7, 0x9]}) r1 = add_key(&(0x7f0000000100)='cifs.idmap\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)="fdbc94e85679976451bc82da2a9afe24c9d864736cdf297d9ddf072ead98af584f3886d0e66160dbd4f38884d438815a657ce5c6725784dfe75266c04b0ec66d618feced41609b82a12ee7894b5ecdb00776d5d1e2da5be814cef98e4e6a22c58dfe9a6d0190e80b9e628aae5a3ddc2065ed887c89bf6f8ead386539fecfb319202e17c0007d4cdc921304f741a91c35e3f22f141a7e6170930f13c16c75f3bad2e008a9f7ac3df2897030161a47a66417e88f7463fa2c46c60c11734bc02f09a80039c0fd332a3fc5f456a6a8628e1780a5b4", 0xd3, 0xfffffffffffffffa) request_key(&(0x7f0000000280)='rxrpc\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, r1) 20:34:45 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:45 executing program 3: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x2000000000002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20000005001}) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f0000000280)={'nat\x00', 0x0, 0x0, 0x5c, [], 0x0, 0x0, &(0x7f0000000200)=""/92}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) write$P9_RLERRORu(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="1401200007000007002565"], 0xb) write$binfmt_elf64(r1, &(0x7f0000000280)=ANY=[], 0x3ce) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x308, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 20:34:45 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x10, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:45 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:45 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:45 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x40001, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x4010, r0, 0x8000000) 20:34:45 executing program 2: bpf$PROG_LOAD(0x5, 0x0, 0x0) 20:34:46 executing program 5: request_key(&(0x7f00000000c0)='\xcc\xaf\x87\xa3\x9c\x11I\xd9\xa3(\xd5\xa9\xcd\xb3\xa0\xae4\xa8u\b\'a\xf9\xe1\x16\xb5\xef\x83\xdb\xb4\xe6K\x1fX~=\x16C\f\xb6\xe0\x97v\x9f\xfb\xe1\xae\xb2\xeaQ$y\xa3<\xe8I\x04\x92\x15\xb9\xde6.\x9c\x11\xd7\xf9D\x98\xc24', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0) 20:34:46 executing program 2: bpf$PROG_LOAD(0x5, 0x0, 0x0) 20:34:46 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:46 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) sendmsg$nfc_llcp(r0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x27, 0x1, 0x0, 0x4, 0x8832, 0x1401abea, "8ba4a4bfab2a291b21313553b1d32df42668e97103889f75a9b5a3864844f75560cb6ecd7a15a98ab7c7ba5f02e5e7e2e7ccea35f57b6e2d70450c644756c6", 0xa}, 0x60, &(0x7f00000002c0)=[{&(0x7f0000000140)="302e26189e6a4139dbec79012acc43601987981bae15a6fbc61f6ba74a81ad722d7b816e3322db76f5042cfe361b04c3574afc9b29fa9376260f9d36cac3f111", 0x40}, {&(0x7f0000000180)="ae75998a7b44ca15dd79b87080813e5d6cebaee71fd57b0af1f68fd73d48e87613ebe820d792c36aff0a040f6196704932935380167a7bb463788cdea40adb9553b983c8ee82f3828258e196647a893140a237e745a5450e81d0562073fff0d23634cd00357b2a43d63f5631029385bac70fefadc5563b47fac48c94ee95d8fba442c6bed3ebf882aad9960b8e22d917b5f863ce1c0ba41f7b6f70828696f34af9e9bc2571dcab0bd849", 0xaa}, {&(0x7f0000000240)="94f3fa9c5060a33d9ad1bd232e39037186ec994285721e5e808754c1b35f51f837914c2d82c857011b108a995ad4b6b6d5365305b438606cbb2d54deda3e0f34ad285f75e7183a14afdc8b03f5e4c3174e2b37661514815fdf1cd63198e2768158e8076757ff1c27bcbf24fbbf79f5", 0x6f}], 0x3, &(0x7f0000000300)={0xa8, 0x116, 0x4, "fe1947e4dc6b6c505a4ee09b70c374a30d44a232d9b82f4a10f8673cc9893edc75967a2e7c627fbfc2e07312010504c6ff3963ef57365f5cc685eae5ecfd620ebf14989e105bb1aea2bc875947a3716374476954101039c122cc9e093445878ba0ba5b0625dc74d5d011f73c8fdf7665a76c93001d0b4f3264345597a4fb42fc0013a0b62aac4dbbb4cc38ef2ea8b3792a64d622947b"}, 0xa8}, 0x800) r1 = request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) keyctl$get_security(0x11, r1, &(0x7f0000000400)=""/131, 0x83) 20:34:46 executing program 2: bpf$PROG_LOAD(0x5, 0x0, 0x0) 20:34:46 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0xc7465e64d883fa19, 0x0) write$P9_RFSYNC(r0, &(0x7f0000000180)={0x7, 0x33, 0x2}, 0x7) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f00000000c0)={0x7, 0x20, "3c1e7a4a5a1504cf3a3642fd699106c993b00e4758cee425", {0x9, 0x3}, 0x1}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000100)={{0x6, 0x100000000}, 0x1, 0xfffffffffffeffff, 0x7b, {0x1, 0x7}, 0x80000001, 0xffff}) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0) [ 501.271593][T13925] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 501.318925][T13925] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 501.396910][T13925] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 501.416553][T13924] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 501.429064][T13927] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 501.477165][T13927] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 20:34:46 executing program 3: 20:34:46 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 502.535294][T13976] IPVS: ftp: loaded support on port[0] = 21 [ 502.581507][ T9973] device bridge_slave_1 left promiscuous mode [ 502.588633][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 502.618379][ T9973] device bridge_slave_0 left promiscuous mode [ 502.624769][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 504.557440][ T9973] device hsr_slave_0 left promiscuous mode [ 504.617055][ T9973] device hsr_slave_1 left promiscuous mode [ 504.685892][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 504.701055][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 504.713186][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 504.754191][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 504.825161][ T9973] bond0 (unregistering): Released all slaves [ 504.934862][T13976] chnl_net:caif_netlink_parms(): no params data found [ 504.973821][T13976] bridge0: port 1(bridge_slave_0) entered blocking state [ 504.981424][T13976] bridge0: port 1(bridge_slave_0) entered disabled state [ 504.989551][T13976] device bridge_slave_0 entered promiscuous mode [ 504.999574][T13976] bridge0: port 2(bridge_slave_1) entered blocking state [ 505.007001][T13976] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.014927][T13976] device bridge_slave_1 entered promiscuous mode [ 505.036991][T13976] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 505.079339][T13976] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 505.117428][T13976] team0: Port device team_slave_0 added [ 505.124953][T13976] team0: Port device team_slave_1 added [ 505.199812][T13976] device hsr_slave_0 entered promiscuous mode [ 505.247232][T13976] device hsr_slave_1 entered promiscuous mode [ 505.286930][T13976] debugfs: Directory 'hsr0' with parent '/' already present! [ 505.314689][T13976] bridge0: port 2(bridge_slave_1) entered blocking state [ 505.322122][T13976] bridge0: port 2(bridge_slave_1) entered forwarding state [ 505.329941][T13976] bridge0: port 1(bridge_slave_0) entered blocking state [ 505.337073][T13976] bridge0: port 1(bridge_slave_0) entered forwarding state [ 505.389857][T13976] 8021q: adding VLAN 0 to HW filter on device bond0 [ 505.404707][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 505.414537][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.431098][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.445835][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 505.467616][T13976] 8021q: adding VLAN 0 to HW filter on device team0 [ 505.484294][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 505.495638][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 505.502828][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 505.522381][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 505.531293][T13198] bridge0: port 2(bridge_slave_1) entered blocking state [ 505.538420][T13198] bridge0: port 2(bridge_slave_1) entered forwarding state [ 505.578970][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 505.596318][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 505.614799][T13976] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 505.634450][T13976] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 505.657610][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 505.666221][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 505.682759][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 505.711436][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 505.729763][T13976] 8021q: adding VLAN 0 to HW filter on device batadv0 20:34:51 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:51 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:51 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x682000, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000180)=0x2, 0x4) 20:34:51 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x1e, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:51 executing program 3: 20:34:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:51 executing program 3: 20:34:51 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 506.026963][T13991] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:51 executing program 5: getresuid(&(0x7f0000000100), &(0x7f0000000140)=0x0, &(0x7f0000000180)) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x8, &(0x7f00000001c0)={[{@index_on='index=on'}, {@index_off='index=off'}], [{@smackfstransmute={'smackfstransmute', 0x3d, '&GPL'}}, {@obj_type={'obj_type', 0x3d, 'keyring\x00'}}, {@fscontext={'fscontext', 0x3d, 'root'}}, {@permit_directio='permit_directio'}, {@permit_directio='permit_directio'}, {@euid_lt={'euid<', r0}}]}) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:34:51 executing program 3: 20:34:51 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x48, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:51 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x400, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000000c0), r1, 0x0, 0x1, 0x4}}, 0x20) 20:34:52 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:52 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:52 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:52 executing program 3: 20:34:52 executing program 5: r0 = request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) keyctl$instantiate(0xc, r0, &(0x7f0000000040)=@encrypted_load={'load ', 'ecryptfs', 0x20, 'user:', 'keyring\x00', 0x20, 0x3, 0x20, [0x38, 0x66, 0x38, 0x34, 0x63, 0x37, 0x35, 0x39, 0x31, 0x63]}, 0x3c, r0) 20:34:52 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x4c, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 506.678784][T14015] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:52 executing program 3: 20:34:52 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 506.809758][T14029] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:52 executing program 5: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, r0) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, r0) r1 = syz_open_dev$dspn(&(0x7f0000000200)='/dev/dsp#\x00', 0xa8a8, 0x101) getsockopt$inet6_dccp_buf(r1, 0x21, 0xd, &(0x7f0000000300)=""/58, &(0x7f0000000380)=0x3a) r2 = open(&(0x7f0000000180)='./file0\x00', 0x10000, 0x1) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000340)='fou\x00') sendmsg$FOU_CMD_GET(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r3, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0xff}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}]}, 0x30}, 0x1, 0x0, 0x0, 0xce52082f3d7ecc32}, 0x4000000) 20:34:52 executing program 1: getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:52 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x60, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:52 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'eql\x00', 0x10000803}) ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000200)={'eql\x00`\x00\xa9[,\x00^\x01\x03\x03\xf0\n', @ifru_mtu=0x1}) 20:34:52 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 507.178205][T14046] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:52 executing program 5: r0 = fanotify_init(0x10155, 0x80000) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x40000, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000200)={0x0, r1, 0x100000001, 0x5, 0x3, 0x8001}) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) socket$inet6(0xa, 0x4, 0x5) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f0000000140)={'bridge_slave_0\x00', {0x2, 0x4e20, @remote}}) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/attr/current\x00', 0x2, 0x0) syslog(0x9, &(0x7f00000000c0)=""/104, 0x68) 20:34:52 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x68, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:52 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:34:52 executing program 1: getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:52 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0x7) recvmmsg(r0, &(0x7f0000000200), 0x2ab, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040), 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000000c0)=0x351, 0x4) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:34:53 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:53 executing program 1: getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:53 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:53 executing program 1: mkdir(0x0, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 508.294996][T14067] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 509.432987][T14108] IPVS: ftp: loaded support on port[0] = 21 [ 509.571176][T14108] chnl_net:caif_netlink_parms(): no params data found [ 509.674465][T14108] bridge0: port 1(bridge_slave_0) entered blocking state [ 509.681914][T14108] bridge0: port 1(bridge_slave_0) entered disabled state [ 509.689912][T14108] device bridge_slave_0 entered promiscuous mode [ 509.698356][T14108] bridge0: port 2(bridge_slave_1) entered blocking state [ 509.705487][T14108] bridge0: port 2(bridge_slave_1) entered disabled state [ 509.713630][T14108] device bridge_slave_1 entered promiscuous mode [ 509.802619][T14108] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 509.814023][T14108] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 509.905118][T14108] team0: Port device team_slave_0 added [ 509.913054][T14108] team0: Port device team_slave_1 added [ 509.980084][T14108] device hsr_slave_0 entered promiscuous mode [ 510.047621][T14108] device hsr_slave_1 entered promiscuous mode [ 510.127632][T14108] debugfs: Directory 'hsr0' with parent '/' already present! [ 510.136847][ T9973] device bridge_slave_1 left promiscuous mode [ 510.143119][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 510.197666][ T9973] device bridge_slave_0 left promiscuous mode [ 510.203894][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 512.187448][ T9973] device hsr_slave_0 left promiscuous mode [ 512.227257][ T9973] device hsr_slave_1 left promiscuous mode [ 512.279370][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 512.295024][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 512.310055][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 512.354256][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 512.446568][ T9973] bond0 (unregistering): Released all slaves [ 512.620454][T14108] 8021q: adding VLAN 0 to HW filter on device bond0 [ 512.633833][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 512.642396][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 512.689179][T14108] 8021q: adding VLAN 0 to HW filter on device team0 [ 512.700529][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 512.709969][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 512.719096][T12956] bridge0: port 1(bridge_slave_0) entered blocking state [ 512.726167][T12956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 512.748485][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 512.766254][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 512.775509][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 512.794556][ T8925] bridge0: port 2(bridge_slave_1) entered blocking state [ 512.801906][ T8925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 512.810766][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 512.820010][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 512.835572][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 512.854847][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 512.881634][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 512.897963][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 512.915035][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 512.925258][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 512.942269][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 512.956486][T14108] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 512.984627][T14108] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 513.002559][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 513.020446][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 513.056358][T14108] 8021q: adding VLAN 0 to HW filter on device batadv0 20:34:58 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:58 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:58 executing program 1: mkdir(0x0, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:58 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x6c, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:58 executing program 5: timer_create(0x5, &(0x7f0000001180)={0x0, 0x15, 0x0, @thr={&(0x7f0000000140)="3a2ef11ab2ab59b609864bd26002", &(0x7f0000000180)="2073ba447270c58b32767199e0dddbdb8a95139b0f70532770db1ebf352512eedc2cb91c5451625a94f0cb8a3457cc0430d1cd2c59b8b60efde8f0dbf7cdebed8978dffa31ab1065edd3faa2266b86ffc8313ef4103b860b8905edcb6b57047cecfc89964880f3dfa961b46a81e2fa54bef3dd4e9f0eaa6470a8ce277ee4234f9e8234616e61dc50e6ab29314c029f36b88009c8212f1f810ad502b04fb1e5a9a3b0c8569b97aaf1c1559fae98c2c0178af7c499d74fe1685b207b3d9e1904432912933c49e4af48cd67f5bc099a0dd29231febc86ecb6e1a56becb470a3d219e1b239e2b2464899fdc01e5399e422e9fcbe73e38a5ddf3c0c17f56ab2df602488a204732932a0508a61947bff783ff8988c1937b9937677b2645c632a5c3acec333f39ed2e2d99beb0d050e391fc1ad85a25b91ee879d51fef5b5bfe73bb3b85d6a10262bbfce25881ac2c91ad4462ece660eec427065cf2f0631e3c7e2d6fc64a204c02ef172b6f99130ea53c57506233557f2f955eb7f129e149a2f19d6efd6aafc1834444a692aaf80a92ad1357785c6bd8e0719478a2386e2c94c1b36847e126a6a24648e6d471df934f0b533fd307e5872be6557a8f3ca73e34b0e90eeb7f404383ba12d0015341748fde73800970f3be68c5ba559d64125aafc9756815d634c6655d4c2b4349aa5c593a92ef9648202ec633384ccdd745c3590414680598cf7f3a9ce3a460804b94a89a6f1859bb7d6910aea54de421424cae32c5f9f3513bf60577314231e0a996d3af6c991759b762d3b490fad2202a4586beb855ad76338a40e39acbeb17bca367cf576e2aa771cbb7fe2c955715b7bc565e85767a189ab815d08fb9846a19f12c1a2be6192773e14308219e3911750651065b35232dc51ab435baf8070de2949f1fb1d06c0a4d655d0ea5347521a8b787616bebeef65c1ee39177e355d1d290834d31bffb6bc067ba5ab70187235e8648cf5321ff9ba15a1f2b144010aa835f4c546634fe19542a347e6059ea9e35b962d2037d783cb71aa4868ab8b04007371ad9bcd0e02672b6d967555cc89364af5777852d2aa2cd99e830e2445227d23f5f75158d1771e25cf438b369567834158648eea1b982ff31f76b932214538d02d64f0fef1d134d0464c0d54ba8f0abe0a110d10ab44ae7e287384e20d6e41553d3d8ed481184b46c302ee75b9d6a6e67d16dd19ff84afeb46ee203354b605d77a3da4e1eff3bac16514d37fadfca204c96efc718195851510f70a1d04f097268a85d11339f48e6e4033e1adae75259e1084a5b47a70d0ca02159f10dc6114e3a54cbc448d25fe52035e9fe7ae3b8e01f1eb0bd080a2ba7c356c186269a9a3203c2901fb555550ad0ff6de31579f1e42640d9c353af9ddad76e791502f4e298d85676298bc9e405a78c38ff3ce12e6c9bf8de4204b216dd150d225e29dea826b3babaa758351039e9703dbb7171095606f04873f10c57b576070708b4cc97fcb3e3f9c8e822bd3157f7b1b1209636ae3cdc4bb725c541d9a261a0fc1885435d051b34007742d469ae25bf851c081cb76e67e840e2e0e0f3fef913c347ebd8ff16f230762b5b65b40f53043fe7568dbcfbaa69c441603b21b18d829f79eb7960f3fc0378ee61d0bb3515a07b83f0695f092760a2cea9c2c327c79df9f5e29405c1a05fa885ef28d8c4ae4dff48137dcda488ea424e516d17faf0b5a372d50dba0c393a96d62f7e0cfadb886fbf481fa0830a1dd532e32a7fcf06ba65ea135c867335f2aa2f6decf337e613bd9a249d9a1049c262188215f2f938f41c550ec3ceffe93a9e3d60827e877fb433d55d2d3e6f830ddca6f3e67a4914947dcc1c0458a26b567d721a6081f9e46750f35302515f95f7674114d9c7e5de826a71709d6dc906892c974c3808b309b70dc4abf9f2a47ca0612b1a107e51ef0803e743da5c16d38d755864c33de827bc8d19c01fee756fd0e23fbe4a97bb6af626544ad380834aaa58e154ad3f967252de386a876a1214cd0e2d2949b3426d63c1427805cd22d204b8c4436e2ef346bef9875050fbd72f71ef90c0dded37b6b1733ab860e5718ed709417a0d73694838a0734cf55a50ebf052b02e80df0c6b7d58aec8ba7858e01b41748bca0e730d21854d3c6d3d9ecd913a513c7a9d1491d72173ab72c7feec1e0b3468774638e3377f001dfed2dda0963298591845d558f5dace7f9f20f10fa2c3220c0eb769b6f7b9e7cdf02aa97c2eba1d0ff547e063096a55d5ebeab7d5bf7331252a71441eddbf5b9fdd3966a7489deebe195d05e557e0dc6cc2bdad6f23f8964b5409fe8faa7984e0a9e14c5f577e81b01a3944ef307159b1ccd3d27f38c904ecefa29f6d2c26cc8ae9005ccef1d01e333e5fa1477e7b638bb79c85461534410192f7d8f1f27fd96f2f64351b12e799a5475d28170a06d5605f77fe17a5ad4b0684ed303bf6a8c9c8656c8feb4318697cabbef0fbd7a28bfcbdf9465464deb480e9b5f4bcd701591817b39fb982e9fb375ee1d600f71777e1423eedee6617298a054f4b52912f34e1791750d92e5c6c91706236ee86aa440dc80b1c18477c52165603115db8a512ee20123b0ee4e5a64c7bcdce142ce1cd445473609c265e1809f33d2e0410939ee3600c247a37c805572813ba483b22ce1f6ecd129135860e613ca0ccba193d3e099b3230bb3bdaec8cb5ad2e830d768589494c5c92dcc998e232042dbc4023c46c031c69c9e679edeea4d58121c79d9759f8b216e5fb991c563be159584533176d7e6c1925a7305e617fe4e6d105d9c3b3bb4647b2907b4c6cd33f84e4a423c6e55ed4d7def9d55b959e305836624ae3ad48e8b73a34347d16bc323143ca101d1356c00e135291f80e442c23587e29795ed54a859462472d69665238850a8e77c8ed195e5fde06e807674d05fcc5cbd7a5d6fa9627e27fc66a04e9aa7f9f09f7495818f71c6b079ae2f5627e9ea6677dcd56890246505961605aeecaef996a2e3a71e330f1d6878a929707cf0525944f01bb5ef832756c307c9d5106e1b74b30ccf23c7db8d3ddef16a70209b284e7bccd3a8c41e37e6dd6fb441f64264cf53485a3e2c87b5cf9c98e2a227727269609b046bae2294d179f085fe8f45ed1233d74936f596f83da4735b331d6b13921afea1b2bcb3d2e4d8bb27b6e64815a9aba6d94f7959f31123b66a6182eb5560dd583b9214410a80eb24b483d9d845d3ed5dcbda5b7b90a5267bb665d89afbf3d9bd4bfec061347a3a38af61d2e15d85788a8c30a65a88c0bec74c69e69328bdffec730db20f40d191d6ce49778fc959f844d1266d5e9404bec6228f5d582122b06a5429e6d5beb2f988498ea1f55900f7f8570f63285305b90b05220ffc207014b60695fc1a718f0018fd1d26a50346a85c8190c38268ee20da0eed44f9d9c0b48f8c80e54c52535f44529b86fb26797c5ecef659b26c914ba52b9022381080a398909148efec964f3ccbb582697bab58969bc7b2529f1526ec72c1a212f81af32ac41a6009ee5823b73e67febeffe773b4b2c5bd707081aca315f99f171f7e01403b9e19a6268c9f46d7ac3d46ee91a79d8a022fb2a8a85ed5710c95f6521f488de8ec49bb35226b8939ccfa5cee2d69b1a40c901bd53a615237fdcfe23ef9c0b33ef1accf623d868cfa44b731d6652c54d9c18ba2ad968bebb9d4cddeb37793cdd35c9911a1dbd6298a46a49af923f4e5d7550a1cffde32ddca0bc329d7f095e44d0069aa4dc5db4f7028ab60a507eda2879c7bf9fbdf0f768ccd7df202c1c005cb2bf341a96554c028a9943de979344a111bf1acfccc018e9a7a8571629d5652c65e1bbfb702a85053183f1cceb2644bb7c4a06557643f79ac48a6d4c2bf9b734c8b4bdaa8621cf0c18330bd87ac26c34d8bf5ed46cd4a8e285e03270c7bb4465d76e3f4564ef060e50b3b03e773c75c7e6726ce75c32482e9ff1eafb04e2cac093924c4832299e4d40152830885f792c3de8242f8da95c6bd57380eef092b0a6460bf63ffaef588081e46e58ceaa09a03b84b9fe085f4f0ee7d300c92b3be68e7ed02952298bb3f6e93ad13b1a1d45ea82fd829b6c8568d8e62e1a08dd3e03fe498b73f963917e23f9ced20ae4f7b2215f35af26b0c8d27b957bcd41da4f361b03aacbccb8cb6dec0045c464cfb05922b39898746672c77508601b6609ae38973f8f1b05ef5544b1d3c6fde715996ad612a876ec4700ead7363155f8de3686be0b3de12f4587d3d97d3eea91a6a1b1d04100db4c8c83c2add057c0a7e3b3cb34432d84840a6119c2aae5a2aa188da823db6284f86a2f31cf108434c848a0c57edc7571365c5fff0386b689a5a08e5c873bb8bc3daaa0e0ca577134a9efcafbbac23e7719a1c91d32ebb1538f562bdddd021d030e4ac510b81a83566638e2bdb391d5e712b80cbcb9d2bc31e9e3951496a17a0ab3d806e2c4c0389ff32fa2ebd4bf2ea0d4c2252905a89bfcfcdf785844b74b38d7af78b4edf0e7f2b1a6f03b913c1c2bc2ff198886c7189923a49f9cd223bdc5952567870b38de310bedfc8d8efc54a2b631d91b7bdf421fbd9547fbade7e14f08f91d21f56e16646cf073ee3aecad5d534a0c07fd61fc3bb677b86f0075caddaf204ce0a0a14c6f06bdb70e748f852b6191d8965d371436683b3854dce36dfd4144135ac16af1fbcc7f7daa0e15876e0522ef34735302412fee8d6c31b8e2cae78a53eac38df402b5af67c3253bf953426f69acf8fd6359bf7c4bffd47a1102e3ee4abba3231e322b4a9a91b54b316277fd50d3716bdac1cda2aeaaa4360ebd4345003b4cbbcda746ccae55a828fdb24cdd665432d9e879285298cf19bcd34e3e7e2e80fe89297afd9f902e9e50bd7b33b6f80946c26f30c16ba0a06715e61a34123e287059c7e1b46f8b2e0bb25d0fff20d96e60360a195b1923e7107c7ef01f4baaa20199e95afcfba94635296beab2aa67311bc440215964a2953d708bc40e1c1c87ad792f3e15f5adc362ab3187867a8e28f0f675b12ec706e9c20d27f991e4694daecd527a300673cf945bfe63dc9698d52e9868d90155ea43cca69c63a5161dc66ab4a90b2f66754b777faa12007f5e2d57f27895b967613804260735dfd632178d50be1b3d6337804301fe951d44f81d5698c5b84ab8e2ce6d27d039dc972f1fe3f5a0930a7e682d8719a73519934403c203456357c529259160d53b5cfdce20bba41e9258f35e53915833fceff79b616cbfdcb8c1297d7d20bb63cbc5f8d7b013da28c579a41954323d0d08d240def7fb2c8bb1c5498411cf75bd10e80603ae2ea8d5fd490e0508963f2d53b23464b04aad96e62a6543fdfd8062338a3b6f552203c6f1c8599043d1599c5ec317a4934eb60252d2b5828ff72070d6bcfdf19951df27819f2b4495d616bfee3b6b0fd52cf0dd001f880221b785ab076ce9c88e3334fcc5d9753415307a03efbdb11e0b3866e06f72d7c575b1324d59324d500edea4517f437075d5c7895178d7a86c8f5ea187164665c81463a0ff3fe9309fc98858848237b862e0e3f485d55ccbcba262f636d07197daa9d679d49ebf6d7e0791b615fb12bf884e618ac4179ac69ac71e1efdde0ea4f322cdb26b17db3ab33e848ae1f7f36bbb22b8522debb916dc492bee9bf668185ebd8a30fa405dd27c2ba3b8d3d27e73af2c3acd37f9ee4e5a368807220e4fe1cd1eb5797d5bc1d0c5533974188485ba83e25eab0b95ea8234b6279134886d68fa0769c773d070f13024f"}}, &(0x7f00000011c0)=0x0) clock_gettime(0x0, &(0x7f0000001200)={0x0, 0x0}) timer_settime(r0, 0x1, &(0x7f0000001240)={{r1, r2+10000000}, {0x77359400}}, &(0x7f0000001280)) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r3 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x1, 0x101000) chmod(&(0x7f00000000c0)='./file0\x00', 0x80) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r3, 0xc008551c, &(0x7f0000000100)={0x8, 0x4, [0x0]}) ioctl$UI_SET_LEDBIT(r3, 0x40045569, 0xb) 20:34:58 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x80000000000002, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x50000}]}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, 0x0) 20:34:58 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = timerfd_create(0x0, 0x0) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000000000)=""/14, 0x34c}], 0x1) timerfd_settime(r1, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x8031, 0xffffffffffffffff, 0x0) clone(0x40100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) prctl$PR_SET_MM(0x23, 0x2, &(0x7f0000898000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x0, &(0x7f00004f1000/0x2000)=nil) [ 513.372307][T14127] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:58 executing program 5: r0 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) request_key(&(0x7f0000000080)=' \xbc\xa3\x8c\xb8EyPeR\n\xb3\x82\x0f,\x9c<<\ad\x0fUEX\x04e\xa5\xa3~/\xf8.6', &(0x7f0000000180)={'syz', 0x2}, 0x0, r0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x440000, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 20:34:58 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:34:58 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x74, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:58 executing program 1: mkdir(0x0, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:59 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:34:59 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:34:59 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) socketpair(0x10, 0x2, 0x7fff, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='bbr\x00', 0x4) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000100), &(0x7f0000000140)=0x4) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/autofs\x00', 0x400042, 0x0) syz_open_dev$usbmon(&(0x7f0000000240)='/dev/usbmon#\x00', 0x101, 0x202000) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f0000000280)=""/56, &(0x7f00000002c0)=0x38) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000200)={0x2, &(0x7f00000001c0)=[{0x2, 0x5, 0x2, 0x1}, {0xc2b, 0xe1c, 0x48, 0x417}]}) 20:34:59 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:34:59 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 514.244638][T14146] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f000039a000)=[{0x6, 0x0, 0x0, 0x8}]}, 0x10) sendmmsg(r1, &(0x7f00000016c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000040)="549b8012", 0x9b54}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) 20:34:59 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x7a, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:34:59 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x540, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f00000000c0)={{0x1, 0x0, 0x100}, 0x1c1, 0x1, 'id1\x00', 'timer0\x00', 0x0, 0x5a5, 0x1, 0x4, 0x9}) 20:34:59 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x0, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:34:59 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 514.483210][T14177] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:34:59 executing program 3: syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @icmp=@address_reply={0x44, 0x10}}}}}, 0x0) 20:34:59 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x0, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xf0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:00 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x3, 0x400400) sendto$unix(r0, &(0x7f00000000c0)="40c30a8fc9cd0525bcc7ad513c70e1cc06de8b64e7aa9b675ad034e4f7a1c6f9bc0257151a9780444e43eeb1ff60abb5127836b82839d14d874a81fe5d10300d2015197f6abc6bcf51e20456915e006cb9e2ff86b0b6e373c46cec68b34576d4ec72e189d7bace4255b46e0af62ba604be9536", 0x73, 0x4000080, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) getsockname$packet(r0, &(0x7f0000001680)={0x11, 0x0, 0x0}, &(0x7f00000016c0)=0x14) sendmsg$can_bcm(r0, &(0x7f0000001800)={&(0x7f0000001700)={0x1d, r1}, 0x10, &(0x7f00000017c0)={&(0x7f0000001740)={0x1, 0x800, 0x0, {0x0, 0x7530}, {0x0, 0x7530}, {0x3, 0x400, 0x3, 0x3f}, 0x1, @canfd={{0x0, 0x3e0a, 0xb9, 0x1}, 0x35, 0x2, 0x0, 0x0, "134dace6964b616a0838513ebfb8536d366866da3553289c24ba187cc319931de9d2a1000636674222e2e75962aa32d9b25be22fcaad93df4374ce24c7f2d6b5"}}, 0x80}}, 0x80) ioctl$TCSETX(r0, 0x5433, &(0x7f00000001c0)={0x100000000, 0x8, [0x100, 0x3, 0x5, 0xfffffffffffffdbb, 0x1c2], 0x24}) io_setup(0x1, &(0x7f00000002c0)=0x0) io_getevents(r2, 0x4, 0x2, &(0x7f0000000300)=[{}, {}], 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000280)='/dev/urandom\x00', 0x40000, 0x0) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) [ 514.852607][T14204] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:00 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x0, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x300, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:00 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RWALK(r0, &(0x7f00000000c0)={0x30, 0x6f, 0x1, {0x3, [{0x0, 0x2, 0x2}, {0x1, 0x0, 0x2}, {0x40, 0x0, 0x5}]}}, 0x30) 20:35:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:35:00 executing program 5: r0 = request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) request_key(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100)='\x00', r0) [ 515.218257][T14220] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 517.013978][T14239] IPVS: ftp: loaded support on port[0] = 21 [ 517.220058][T14239] chnl_net:caif_netlink_parms(): no params data found [ 517.387149][T14239] bridge0: port 1(bridge_slave_0) entered blocking state [ 517.394259][T14239] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.403247][T14239] device bridge_slave_0 entered promiscuous mode [ 517.412385][T14239] bridge0: port 2(bridge_slave_1) entered blocking state [ 517.421240][T14239] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.429663][T14239] device bridge_slave_1 entered promiscuous mode [ 517.585788][T14239] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 517.598512][T14239] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 517.621753][T14239] team0: Port device team_slave_0 added [ 517.772372][T14239] team0: Port device team_slave_1 added [ 517.818872][T14239] device hsr_slave_0 entered promiscuous mode [ 517.867484][T14239] device hsr_slave_1 entered promiscuous mode [ 517.916962][T14239] debugfs: Directory 'hsr0' with parent '/' already present! [ 518.075698][T14239] bridge0: port 2(bridge_slave_1) entered blocking state [ 518.083148][T14239] bridge0: port 2(bridge_slave_1) entered forwarding state [ 518.090559][T14239] bridge0: port 1(bridge_slave_0) entered blocking state [ 518.103325][T14239] bridge0: port 1(bridge_slave_0) entered forwarding state [ 518.117623][ T8922] bridge0: port 1(bridge_slave_0) entered disabled state [ 518.125840][ T8922] bridge0: port 2(bridge_slave_1) entered disabled state [ 518.309096][T14239] 8021q: adding VLAN 0 to HW filter on device bond0 [ 518.323495][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 518.332763][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 518.344755][T14239] 8021q: adding VLAN 0 to HW filter on device team0 [ 518.497788][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 518.506521][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 518.515776][ T3504] bridge0: port 1(bridge_slave_0) entered blocking state [ 518.523348][ T3504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 518.532769][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 518.541805][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 518.550532][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 518.557744][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 518.567682][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 518.578634][ T9973] device bridge_slave_1 left promiscuous mode [ 518.584961][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 518.628396][ T9973] device bridge_slave_0 left promiscuous mode [ 518.634759][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 518.688933][ T9973] device bridge_slave_1 left promiscuous mode [ 518.695300][ T9973] bridge0: port 2(bridge_slave_1) entered disabled state [ 518.729632][ T9973] device bridge_slave_0 left promiscuous mode [ 518.736144][ T9973] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.577713][ T9973] device hsr_slave_0 left promiscuous mode [ 522.637204][ T9973] device hsr_slave_1 left promiscuous mode [ 522.714882][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 522.730148][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 522.741608][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 522.803920][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 522.906650][ T9973] bond0 (unregistering): Released all slaves [ 523.017662][ T9973] device hsr_slave_0 left promiscuous mode [ 523.057023][ T9973] device hsr_slave_1 left promiscuous mode [ 523.105262][ T9973] team0 (unregistering): Port device team_slave_1 removed [ 523.120388][ T9973] team0 (unregistering): Port device team_slave_0 removed [ 523.134929][ T9973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 523.174141][ T9973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 523.278967][ T9973] bond0 (unregistering): Released all slaves [ 523.417551][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 523.430124][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 523.439075][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 523.449377][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 523.467350][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 523.476079][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 523.485250][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 523.493954][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 523.502967][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 523.511524][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 523.521963][T14239] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 523.546470][T14239] 8021q: adding VLAN 0 to HW filter on device batadv0 20:35:09 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x500, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:09 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x3, 0x204040) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f00000001c0)={0xfffffffffffff000, 'syz1\x00'}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@empty, @in6=@ipv4={[], [], @dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@empty}}, &(0x7f00000000c0)=0xe1) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000200)={0x0, 0x2, 0x0, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f00000002c0)=0x1, 0x4) ioctl$TUNSETOWNER(r0, 0x400454cc, r2) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000240), &(0x7f0000000280)=0x40) syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xfffffffd, 0x80000) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-control\x00', 0x8900, 0x0) 20:35:09 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:35:09 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:09 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 523.868816][T14260] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:09 executing program 5: r0 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x3, 0x2) setsockopt$inet6_dccp_int(r0, 0x21, 0x4, &(0x7f00000000c0), 0x4) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:35:09 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:35:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x600, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:09 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:09 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x8040, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000240)=0x2) ioctl$KVM_SET_TSS_ADDR(r0, 0xae47, 0xd000) ioctl$VIDIOC_S_EDID(r0, 0xc0285629, &(0x7f00000001c0)={0x0, 0x0, 0x7d2, [], &(0x7f0000000180)=0xc86}) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x1f, 0xa0800) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f00000000c0)={0x100000001}) 20:35:09 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:09 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 524.233405][T14280] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x700, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:09 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x1ff, 0x440) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) 20:35:09 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 524.538372][T14298] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 526.059665][T14312] IPVS: ftp: loaded support on port[0] = 21 [ 526.127647][T14312] chnl_net:caif_netlink_parms(): no params data found [ 526.156251][T14312] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.164043][T14312] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.172599][T14312] device bridge_slave_0 entered promiscuous mode [ 526.180549][T14312] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.187953][T14312] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.196072][T14312] device bridge_slave_1 entered promiscuous mode [ 526.213606][T14312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 526.225683][T14312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 526.246706][T14312] team0: Port device team_slave_0 added [ 526.254442][T14312] team0: Port device team_slave_1 added [ 526.320042][T14312] device hsr_slave_0 entered promiscuous mode [ 526.367336][T14312] device hsr_slave_1 entered promiscuous mode [ 526.407003][T14312] debugfs: Directory 'hsr0' with parent '/' already present! [ 526.424079][T14312] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.431639][T14312] bridge0: port 2(bridge_slave_1) entered forwarding state [ 526.444190][T14312] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.451540][T14312] bridge0: port 1(bridge_slave_0) entered forwarding state [ 526.489024][T14312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 526.502190][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 526.511802][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.520476][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.530804][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 526.543754][T14312] 8021q: adding VLAN 0 to HW filter on device team0 [ 526.555806][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 526.565107][ T2920] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.572522][ T2920] bridge0: port 1(bridge_slave_0) entered forwarding state [ 526.584300][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 526.593038][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.600432][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 526.620737][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 526.635617][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 526.645100][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 526.657633][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 526.669962][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 526.683939][T14312] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 526.705310][T14312] 8021q: adding VLAN 0 to HW filter on device batadv0 20:35:12 executing program 4: mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:12 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:12 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xa00, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:12 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:12 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x9, 0x101000) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000140)=0x441, 0x4) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f00000000c0)) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:35:12 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:35:12 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0}, 0x70) [ 526.946461][T14328] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:12 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xc00, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:12 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) 20:35:12 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:12 executing program 4: mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:12 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x2000, 0x0) sendmsg$inet6(r0, &(0x7f0000001740)={&(0x7f00000000c0)={0xa, 0x4e21, 0x200, @mcast1, 0x7}, 0x1c, &(0x7f0000001480)=[{&(0x7f0000000100)="61b40a81a8929bac6d38f1f94aa4e6d58e2f48eada64cf0210c01cf3a92981f3be3b43434ac16baf5d220755d256c66cf577fdbe39943c0c20002cee84029cfa", 0x40}, {&(0x7f0000000140)="81f61ba789fa840d2ce321b8e0a381ed14854f01b2c217291624e1b72a7518ed8827ae0fd34a9f147f0fdff8f285d7e8236e9cd0fa504e44dcba0449c2f513d0ca7fd64f91f9a6acd3ad501769910e16636cc60ce274f1cc94816c108165f48611c6920c8eb5c4e30ec19c303e881ee9385b164e9d71a91393f95e31ada9c490fd468a75b62aadd43f364fb88da4b788c2738d57b6c3327ec8d15997b37d3bfad9facf324790e514d4337d6dcca56d3acdc2d8559f237fadac96257b02352c420bdeb4521301e950e2ab63cf691b0a495bec29bab4743f5cd7951bbda6e45e8ee8a5432ebd", 0xe5}, {&(0x7f0000000240)="30640ca157545d803653928974f4f5ee0ed039399ae0d55e7f9a9c2a05988ab940f3b0cb7542a69ffb03c77266f45e0cc73b48de872e600098f303dfe2ecffd72e3542c304243107d4675323b233b11e0fc78e7283ec43fc05d2dfba932786536436b975ae99", 0x66}, {&(0x7f00000002c0)="7456c0b91b7f8beaf3945fb7d081305347fedf81f03e99cc06e88e7caaf0d719e0e5a9065a4936604568f8c24d71ea8c0c1c084d860de8f23b57305c6d09f9f0a727c19e31a914b23b8fab795e30e1fc89cf43916d20953e1bc5d996a28653f1a9b147a1d6590ca954cc533d794fe3b738a52aa3ab970b04bec64edcd2723f0b84a990ba9e5787e3dfd5debb2582bc543de4eaa964aa0f776126ac04b03ce4fca7257231e3f5865ac211e7bcb170cb3de90348aab7640b5a57db0c3522dc9efb6250d591c1f9ceb2d433f02c2a4d27488d9e74e09ee558566b211d6cb7764bdbfcc306efa309f28057b636823f67755296d20281d43a07f1668dfb67fbea0135990febda935374d867d3b4d0fb7eaf80ed1ce0ba3e29ab6f0bac750239bd96b6a249b1a1981955beaebe1204949778fec7f0b8f4a56fc9463f3d5b7e9a35945828dd16599ccbe9a2f68419256f3ed478c7f6b8ba44dd7dc10352f83c8874944ec396b2b7823ab417aa2b463f8a29971a83b640fd65ba67ce46840adc5b63873ecd87429b4dbe2a0562f074f8a063708595f960ba687297bd3298638373ae442fe1959aaddce373e1d1f9da2a3faa15dfcbd96c0317f8cab9d830de8d29eb3d8e153fa36b296511a27fd3de416165e77dafb464d77a11db7916a49c0b3774a814724752e81ffabdee7229c801cb455ef11f2b81ebe2093a578cf90d8adfc09ec8e41f46f777c348d82b9f27db3d59699cd2c41583644d9368893249f6779b7ab3486082d4194af1e6b7ea34a36339558ab9822c9ea170488b0171c237359c6be051eaa2eca5c47f91d4b1c147c1973a6737e2703de0f030205b6c33b354fa1148cf87b0d439d0c870566209c8beb8c7dc4da218a2f61c07baff38a7f02f624278ff2cbc9b469c1aad363e47584e45ef945bd6d5c9a935b1655c924de201995417ac579891647c25d24cdd11c1b455abceff252607cd71218ea6aa907cb0929bbf90137b435c23a11f852c6d58dd0da276343fe24e023569d068ceafb1b4a0706c27406f022f01f5bb4ff55fc28df3c9e6f85cf1b7932f721f141f2d783db0410616915d64e06864fc6874b5bffaabfd88cb2dcafe5b831d9fb437d449b7dc55cceda855d67c33ff689b795f74439ee30851bc4020ba72a15d07d457eb1aae15524dbf71cfa793f1a04137f3029faaee01b2546c7726acb6e51ecf19bc31c3ccd47722bd049154c897f40f3d2e32037bfe64b042eefde540d41dcb644286546f6a25fe44b1bc4bdbb578123c3c88a8600968b821620a10e259eb91bce18de29e1871712f719492d8a7ea75b8bd20d5121c0e6512dd6fe13e2825451a993648a36e64b1dda9428188cbb9edea1ba548ad1f75d110e0fdc4f1e8a39008c8bb644c70fd76db300d2c3accc1ddc64f152425056587fbd775c6be2753b278d370d222ab7b9309cd9a06104318ee496c22538f0ce08395755dab213d2c4602dfaa383a13c76f98f4646d259d72927936ae9f590580517fd0e858ad150c388596e9ecb25550a4a55f1b77601386d0d62230799f347dceaa54d9e1eb7e994fc1d3c23d72d321f94be33b6f84e18446ab56169b5f9f998ca6225124bd51c93e06b4caadb7c35ee7845c39efcbf8be516fc77cdbdf28ec519ce52105d6dd273b4a71d8f488b2f40ba4c62689a1b70bacd97e78c84ad5fbe1af0f61c4b333131d290cb8311de2a4be3a4cad3751948a2f0ed852fe24f1107d54d3c6493c880361dd197de7c0ac4c316c577c17722827ebe8560eabf8a746d33f8466be92965e0ebfc7e96a3cd25dfd185f539a990b0565742c281ba022d0a29ad63fbb94b6eea96af9ffbe1220205bc6f298fecaa7699a9edfed4dae6e53aabd9a29cd3d8e6b22442dd71f0b8045f054aed1dd13fc0a6cfa1389b2d2abb1425b388f8e977433b34814d3717fb6c6db338bbd3ede53f34f0fbc7fbfc63e00ecf8a766590f3818599063326c674c47ef632255508d59cb28b24952adb508809f083fcedb4cd3cd153c8976922d2ce85e21447913a518141b3de91cc7f53b076083cb73dc6ec08725690a41459cc1f8b8e641642a5ba743504c5c1033308292e6ad3831ee0b6f60ef72942dc1684aef552e101ea2feb59b409d66c2def029656d9377675f715db9e4cd7639acc36a197644d4173e667d0c17cce09cfb864a386fda884092c3bf511fffab75cb8a05d3ad4cdc58c8874da3d8c41041acde88f1303bc4b78ae76e3872635a4339bdace42fdbcbc76499fe6b32725951fc25710841c7ca75900567ae83406be6ac5d4e3ebb10f63e9fd1b0637c1f6a67637e5f395b509037df7b0b9af52fb9f4b9d38ead98e05c148bf682cb918f3f038c71e89ec7bf4b7a02669a9251be9b35050305ad26ff23b62eefd2a3a3386d0216c6abfb93b3fa2664923e68d6eeff278e9a17345343be3bf8bef306337c7fa5a0e5364d9eda3766227c25e649041609c7f68f691742e727fce6c9c1cfb7ef6f0dea559c8c3a5016f58025f0e5b1765a4b91e4340a34ba0008167d099262463e8382be4cc986a699cb72799b36248411bade2a0872bc88bf92274dee5ff851a99abd9b822880132695518aaf81f242f801592ab95e87b7db29b20e5920c971053ce1047f24b4418a59fbf80d2bf95bc48dcf826e21a01b640f9b0acc23b0688786ce2ef1d9924fb2d256bf59ce751f297a839eba004ee98f0186e5a538d41c06a32726386b33092a521a62a40fbe665e0f0cb7d8f27690298efe71078d65484d08b1b548095e8eb14ea32285ebb70bdf81cc8d862f1f703804b8858e77926dbfeecd9b032cfba9174a31d64c9797aeeb0ded2d25b0c12f88f37c484d989357c4bfd0772e715611c273d0b3dffe592d819d3ad3b4bdd1b363bb0d94402ecfcd3d50869945b7d5a7976fc89ea2739da38cdb457b76320aebd0f473b5cae79234b7423d7011b5aaed76ca02873d61f3261312e4acf0b0399fb6244aecca4de8b421e92bbe984dd5ee164c866bf22797021ec9a7fa7ac4f9cb7ff0d70810da0b96574ad807f248a9e1ae28ceec2acbce2534118ca2db3db6ea183920fa981edeb7cc070375cef5c405737670be5708931856c4500c551337fa6ec350859516691063838015f8a0bcec212ef5adf447f84bf4ab57ef7058ff9d2e83fe069ea5561f6e5de106e9d6c0564fb40f527abd318626927c7b33e38810350eccfc68dcd69a3b5df58bf4e4fc3c31ee8e0e990c34c95dc8c57e9d2d950d3fb2457356176b5c434848356667b8f718f5f9766b2f2df65cd868bbec8876119f5562cfd21ef342447111921a5169700d4d1a59ffcffe9cfcaed1a687549cd1ea5c94c357f4506333fd6780392a014f94364a3bd27cc44200b3ce5fc8cc08d6f72dc990fe546dd586a188f3c4016a9297f16a723e345e1d513575e07aaed16873d576bd4c231d77bff1ac0eca5c50dc8069c4d07c8a61d6b82532bcd356ad9f2e2584c9df217a985537c8cf300955c1546abc5eb08e712e9e3305ef3698bc21fbbd39c1d1a4af7fd2c2d948c903a7b170844357d414c47f9af2fc9b0637bf5058d599b58b4fd9372a4db9b4e666edb2625071710c274234aa4714ce7d6a7526ca305f959bff5481d10e7d0d87fcbb475be2d4ca5f0e234add10d5ce6585d7f1fbd07a87edfd9cede42a736ce7e8328e5bd02caf6669cddf50319e3743db81f264899567f19327c25bcd26ff18de655f44ba1074c1b022d2006dd01c3e0ade640aa2cb8b69a14a0193864c13179e73a046c0cc6c039bf8f9b1cb1cff26ceec3b870aa73559d169165f8ea58796249b4733765cb31e404a308aa49d9cbf03fb0601ca568f1d643f82bfe4e4ca0aa945c4ecb59177f076249961fc3243942ad5d4b12b72cd38bc25c979763bf838df7a6a49caa9648d9fcae3905e65b5857fedc0ea907edb76b2cb91879d67cb91cb3c33c7c894f1bd1e682ffc7a590ec81d615c76b3d606877638a6b82a5c0c6e3a569655bfde54dc944b482d28feee658799e9ca59e9736fb52d92a8bf16bea525dc27a50b22f5451f84c38060a5a64f70f8689c28cd958b3d04083c45bc921b4017b2e1f2982f73255c848a214cc32dadeba5118a2d678c2d0c651a48a33783f601f65a041836ba9798a7d9fb41399c8eaf13f5a98f9e8bf6de3c6ac35e3750903ffa88a163a704586d66c531352ddb33f685a4c839b4a86fa37e2ef225d7c7c052903d4b06280be1a63f358e43ad9612803cf2b6458fcb5e4cab3ae9f0f644ffbc6cc61c9db10197d977feee57b5a60947ee3fbf88f688aa1789d43d6d2f11d65b6e29af60fa66d78984b6b95a3b213f6b6b584c92731338b6bd67c44a8a181ddfb5c633118695f9a4d6dabe1992a52b5b52538e81aff88c131d0b0670c7f10d39096e0db1bd873435c885a45b1df6657634fd3fc0ad451e57ae103a158c0d3d235ab80d99dabdce72ae5050143afd9166e2e34188332ec8a72d93082ed3c0e9f44687e6558d75b078ea75f01609bd5be7fdc7d58c063356847dd14d672921cf1c0be32258f60758d52e6e08faa212d182a4831e09553a2b1ac933eb314d0b40923b40b43cfb64ca41a4ecff0e63e1a5255d3208d66fca56e339c681a15b4c0ab2c7fcbe23492bc457fe7657e816c5313a43766e51f7826bad3805a476eeda41507b649c73a636d3dba12e72d92d320ddd5c387f3e7e5fa55949689b8364e566045821eac383ea37d118b99908deb4edf290e038004a42bac21d4d15b651721f95a51cfdf30e4ec36fa47b70bbf646dfcd249aede8277053c5bc65ed6fede833983dfd91317ecbad4e53296a48deaa6e999a0e8e132150f5752ad9ad5c83745428bba1c19565c87910d55692f7935b5ad3bea07159c542a34220aa8cafbc2f99828d08e9cbd125b81a05de77f4b7991937b833b1b8e4330b6111742a9b16e22a8463971c4d7c7b97b0a5ea80af5efbf7e5a4c56e1bc828712f5bec8f36925ae39c7f614b3e900763fdbd3508bb3de9fc1da8708c5cae3f0900c2c1d58e39a7052bc3e5da16554ff0d172693ad25121d1c7f4439d501b15d95109935349a0ed859d1aa83fa84a5f05e58fd7ac491a7766a3f60e67798fe136e20c02aa904cde715ab8ad7ee902e11c32c10ca5cb5c5bb90dd564a4f37cb9664d44e2e9a0cccca24df6d3fbe84ffefad77c75bf28912c539ff0898f0544b6826ab61774f561fb89235fcd1f15a91af5cc4fe8f34002aed0a67c4a23708ef1db971cdbc759e9a1946441cc512fe1f9776bc7c505a9a521a5ce7fccc99710f07c672b3ff40301f4bc74f0c6cd8b75b3a6bab262886599a8480d67a41f507c4523c544ae18546f47ef3d6d8a1afb9079a15ca54c0399f3ed42e06355ed5272e78be0cf0a9c31dc0d050701cbc983640715376fcabc78a10a2aa9afe1ee2f51816ab9055e9a88dd92b40c07a97f99b4e5567d3d09a2b72b4613e2d0227fae72a0423fab11790795242a2d9fb431b0a45338345964ebc1567d18b5d027fe756b6d8e5437668293a59eab347171d84b294f95077bb6bb16d2daaaff8676117947f557443f18f9240ef831abc0da4c12ef7b889a24502053a94fee1a0498ce695864dd1319659e45b2224475c3793d31bf516180138d97bda0c96eb8fe2eb5789f34bf34d0b435f291d8b9e2cb11fe4763bd3ed0909588d2ad708e56827fdaeedc6a28d0935fbf0cd9edd004ae293a8418f655f81bd6a6acafc91aaededfe4df3d34bbc10631fbbfc88d6fcfe94d20bf782a0191be46fe53cb", 0x1000}, {&(0x7f00000012c0)}, {&(0x7f0000001300)}, {&(0x7f0000001340)="6927ac9a66d35acc8f8d41cb2e6babe83210a4850df983d47859d275c548c22615b26acd3f34110ee393431c6110b5d59eff74b4ccb7f09241d39e2b11e0f0ae54fbf62ff324685ba9dc9aaa3d54c55c3e01be7238d4b47765a0780fc1f36103a19e9bce005c045878c4a8c51e5bd8", 0x6f}, {&(0x7f00000013c0)}, {&(0x7f0000001400)="139c759b27ba2754dbf4265e949dcee06c311ba9a7c78281d04b74969e1fbe30fba06c2f19da686dbaeb259ea562fc2d648a4317658bfa1704769a0b3baa90ddc61fe577aa6b5b1642fee528f5e7058ae9ce3794ee24a2958309d23677b9869fc1", 0x61}], 0x9, &(0x7f0000001540)=[@hoplimit={{0x14, 0x29, 0x34, 0x1}}, @rthdrdstopts={{0x198, 0x29, 0x37, {0x1d, 0x2f, [], [@generic={0x4393, 0xd9, "b59f83870cdba0e06d5bef9cb2e530aff4922cd0b34aff48886b3584093ef9615d291b8935ffff7ca3d9f732601babb0cead77bebdd97c417312e6e4ec7055c16383bafe6d67332154ef47e8316ed3f841b56d0a10e5a8c4f699429e68ae75e705e6c3c5b3a7952f920558be88da8ed62f15446059fa156669836d4af8a876d8b881dfa83d852ba3173a49e7277490fc1b8c86f895f3f738c6a23adcecd8f92e2d5bb7f9889037ea4ad07acec5f8ed3edac9cd04a252d6994ba1a18ab2b3970a802d1a5c1e13003e34429ddb9d735ef9cede4b54a4b4ecbe50"}, @pad1, @generic={0x2a4, 0x45, "07583439bc519886f20ceee7e6e550dd58cb52e3fe1f57c68c03591ad674a0ff6aa0d059bcfc2c8b30a8adfa98ea6f38bcfe6c789a4f27009af948eeeec423c25985f870d6"}, @hao={0xc9, 0x10, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @padn, @pad1, @pad1, @calipso={0x7, 0x28, {0xffffffffffffffff, 0x8, 0x81b, 0x4, [0x7fffffff, 0x0, 0x5, 0x80]}}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, [], 0x18}}]}}}, @dstopts={{0x40, 0x29, 0x37, {0x2b, 0x5, [], [@calipso={0x7, 0x20, {0x4, 0x6, 0x8, 0x6, [0xf, 0x3000000000000000, 0xe19]}}, @jumbo={0xc2, 0x4, 0xe5}]}}}], 0x1f0}, 0x4010) 20:35:12 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0}, 0x70) 20:35:12 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0}, 0x70) 20:35:12 executing program 5: getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@remote}}, &(0x7f0000000080)=0xe8) stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x1, &(0x7f0000000500)=[0xee01]) getgroups(0x4, &(0x7f0000000540)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff]) r5 = getegid() lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000580)={{}, {0x1, 0x1}, [{0x2, 0x2, r0}, {0x2, 0x2, r1}], {0x4, 0x4}, [{0x8, 0x6, r2}, {0x8, 0x4, r3}, {0x8, 0x4, r4}, {0x8, 0xba90e51a2ddf403b, r5}], {0x10, 0x2}, {0x20, 0x3}}, 0x54, 0x3) request_key(&(0x7f0000000140)='logon\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000001c0)='syz', 0xfffffffffffffffc) r6 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff8) request_key(&(0x7f00000000c0)='cifs.idmap\x00', &(0x7f0000000100)={'syz', 0x2}, 0x0, r6) 20:35:13 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:13 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:13 executing program 4: mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:13 executing program 2 (fault-call:0 fault-nth:0): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:13 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0xff, 0xacbf40ece4b4b46) fcntl$getownex(r0, 0x10, &(0x7f0000000140)) ioctl$TIOCMIWAIT(r0, 0x545c, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f00000000c0)=0x2) 20:35:13 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xe00, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 527.741247][T14344] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 527.832797][T14383] FAULT_INJECTION: forcing a failure. [ 527.832797][T14383] name failslab, interval 1, probability 0, space 0, times 0 [ 527.881188][T14388] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 527.895636][T14383] CPU: 0 PID: 14383 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190827 #74 [ 527.904787][T14383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 527.904794][T14383] Call Trace: [ 527.904821][T14383] dump_stack+0x172/0x1f0 [ 527.904852][T14383] should_fail.cold+0xa/0x15 [ 527.904870][T14383] ? fault_create_debugfs_attr+0x180/0x180 [ 527.904890][T14383] ? ___might_sleep+0x163/0x280 [ 527.938644][T14383] __should_failslab+0x121/0x190 [ 527.943747][T14383] should_failslab+0x9/0x14 [ 527.948235][T14383] kmem_cache_alloc_node_trace+0x274/0x750 [ 527.954190][T14383] __get_vm_area_node+0x12b/0x370 [ 527.960009][T14383] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 527.966701][T14383] __vmalloc_node_range+0xd4/0x7e0 [ 527.971894][T14383] ? bpf_prog_alloc_no_stats+0x6b/0x2b0 [ 527.977689][T14383] ? __lock_acquire+0x16f2/0x4a00 [ 527.982791][T14383] __vmalloc+0x44/0x50 [ 527.986935][T14383] ? bpf_prog_alloc_no_stats+0x6b/0x2b0 [ 527.992660][T14383] bpf_prog_alloc_no_stats+0x6b/0x2b0 [ 527.998111][T14383] bpf_prog_alloc+0x31/0x230 [ 528.002797][T14383] ? ns_capable_common+0x93/0x100 [ 528.008114][T14383] bpf_prog_load+0x400/0x1660 [ 528.012954][T14383] ? bpf_prog_new_fd+0x60/0x60 [ 528.017820][T14383] ? lock_downgrade+0x920/0x920 [ 528.022774][T14383] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 528.029039][T14383] ? security_bpf+0x8b/0xc0 [ 528.033623][T14383] __do_sys_bpf+0xa44/0x3350 [ 528.038289][T14383] ? bpf_prog_load+0x1660/0x1660 [ 528.043322][T14383] ? __kasan_check_write+0x14/0x20 [ 528.048504][T14383] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 528.054124][T14383] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 528.059741][T14383] ? wait_for_completion+0x440/0x440 [ 528.065017][T14383] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 528.071425][T14383] ? fput_many+0x12c/0x1a0 [ 528.075862][T14383] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 528.081350][T14383] ? do_syscall_64+0x26/0x760 [ 528.086099][T14383] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 528.092166][T14383] ? do_syscall_64+0x26/0x760 [ 528.096925][T14383] __x64_sys_bpf+0x73/0xb0 [ 528.101433][T14383] do_syscall_64+0xfa/0x760 [ 528.106191][T14383] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 528.112248][T14383] RIP: 0033:0x459879 [ 528.116218][T14383] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 528.135979][T14383] RSP: 002b:00007faf4944dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 528.144469][T14383] RAX: ffffffffffffffda RBX: 00007faf4944dc90 RCX: 0000000000459879 [ 528.152424][T14383] RDX: 0000000000000021 RSI: 0000000020000080 RDI: 0000000000000005 [ 528.160385][T14383] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 528.168349][T14383] R10: 0000000000000000 R11: 0000000000000246 R12: 00007faf4944e6d4 20:35:13 executing program 5: r0 = request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) keyctl$instantiate_iov(0x14, r0, &(0x7f0000000040)=[{&(0x7f00000000c0)="546403ce20a86959141a93ec29ce93afd41d306c1b072512206d10d923bc38a91563b4ce8d46ee048d81dc8b98ece4f3ff9af0ed5fc13be03a52dd70d06c36115ac1", 0x42}], 0x1, r0) r1 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x1507, 0x200001) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x4d4) 20:35:13 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xf00, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 528.176387][T14383] R13: 00000000004bfcdc R14: 00000000004d19d8 R15: 0000000000000003 20:35:13 executing program 4: mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:13 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:13 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:13 executing program 5: r0 = request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$SG_SET_TIMEOUT(r1, 0x2201, &(0x7f00000000c0)=0x6) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000200)=0x3) write$FUSE_INIT(r1, &(0x7f0000000180)={0x50, 0xfffffffffffffff5, 0x8, {0x7, 0x1f, 0x400, 0x40, 0x8, 0x0, 0x6, 0x9ebe}}, 0x50) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, r0) ioctl$RFKILL_IOCTL_NOINPUT(r1, 0x5201) 20:35:13 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:13 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x2800, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 20:35:14 executing program 4: mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 528.930357][T14383] syz-executor.2: vmalloc: allocation failure: 4096 bytes, mode:0x100dc0(GFP_USER|__GFP_ZERO), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 528.945221][T14383] CPU: 0 PID: 14383 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190827 #74 [ 528.954341][T14383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 528.964523][T14383] Call Trace: [ 528.964550][T14383] dump_stack+0x172/0x1f0 [ 528.964568][T14383] warn_alloc.cold+0x87/0x17f [ 528.964582][T14383] ? zone_watermark_ok_safe+0x260/0x260 [ 528.964614][T14383] ? __get_vm_area_node+0x2bb/0x370 [ 528.964630][T14383] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 528.964651][T14383] __vmalloc_node_range+0x483/0x7e0 [ 528.999528][T14383] ? __lock_acquire+0x16f2/0x4a00 [ 529.004676][T14383] __vmalloc+0x44/0x50 [ 529.008854][T14383] ? bpf_prog_alloc_no_stats+0x6b/0x2b0 [ 529.015124][T14383] bpf_prog_alloc_no_stats+0x6b/0x2b0 [ 529.020649][T14383] bpf_prog_alloc+0x31/0x230 [ 529.025709][T14383] ? ns_capable_common+0x93/0x100 [ 529.030852][T14383] bpf_prog_load+0x400/0x1660 [ 529.035830][T14383] ? bpf_prog_new_fd+0x60/0x60 [ 529.040711][T14383] ? lock_downgrade+0x920/0x920 [ 529.045632][T14383] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 529.052074][T14383] ? security_bpf+0x8b/0xc0 [ 529.056671][T14383] __do_sys_bpf+0xa44/0x3350 [ 529.061379][T14383] ? bpf_prog_load+0x1660/0x1660 [ 529.066811][T14383] ? __kasan_check_write+0x14/0x20 [ 529.071951][T14383] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 529.077522][T14383] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 529.082826][T14383] ? wait_for_completion+0x440/0x440 [ 529.088140][T14383] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 529.094403][T14383] ? fput_many+0x12c/0x1a0 [ 529.099014][T14383] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 529.104583][T14383] ? do_syscall_64+0x26/0x760 [ 529.109454][T14383] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 529.115541][T14383] ? do_syscall_64+0x26/0x760 [ 529.120249][T14383] __x64_sys_bpf+0x73/0xb0 [ 529.124697][T14383] do_syscall_64+0xfa/0x760 [ 529.129226][T14383] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 529.135172][T14383] RIP: 0033:0x459879 [ 529.139181][T14383] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 529.158886][T14383] RSP: 002b:00007faf4944dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 529.167509][T14383] RAX: ffffffffffffffda RBX: 00007faf4944dc90 RCX: 0000000000459879 [ 529.175668][T14383] RDX: 0000000000000021 RSI: 0000000020000080 RDI: 0000000000000005 [ 529.183839][T14383] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 529.191828][T14383] R10: 0000000000000000 R11: 0000000000000246 R12: 00007faf4944e6d4 [ 529.199811][T14383] R13: 00000000004bfcdc R14: 00000000004d19d8 R15: 0000000000000003 [ 529.244080][T14399] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 529.290653][T14383] Mem-Info: [ 529.293959][T14383] active_anon:107535 inactive_anon:455 isolated_anon:0 [ 529.293959][T14383] active_file:7817 inactive_file:46008 isolated_file:0 [ 529.293959][T14383] unevictable:0 dirty:717 writeback:0 unstable:0 [ 529.293959][T14383] slab_reclaimable:12542 slab_unreclaimable:116511 [ 529.293959][T14383] mapped:50115 shmem:502 pagetables:866 bounce:0 [ 529.293959][T14383] free:1251217 free_pcp:574 free_cma:0 [ 529.406881][T14383] Node 0 active_anon:430240kB inactive_anon:1820kB active_file:31132kB inactive_file:184032kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:200560kB dirty:2868kB writeback:0kB shmem:2008kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 98304kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 529.463807][T14383] Node 1 active_anon:0kB inactive_anon:0kB active_file:136kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 529.507194][T14383] Node 0 DMA free:15908kB min:220kB low:272kB high:324kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 529.561659][T14383] lowmem_reserve[]: 0 2547 2548 2548 [ 529.581929][T14383] Node 0 DMA32 free:1206724kB min:36184kB low:45228kB high:54272kB active_anon:429420kB inactive_anon:1820kB active_file:30084kB inactive_file:183948kB unevictable:0kB writepending:2856kB present:3129332kB managed:2611872kB mlocked:0kB kernel_stack:7360kB pagetables:3464kB bounce:0kB free_pcp:2816kB local_pcp:1324kB free_cma:0kB [ 529.614831][T14383] lowmem_reserve[]: 0 0 1 1 [ 529.620084][T14383] Node 0 Normal free:20kB min:16kB low:20kB high:24kB active_anon:20kB inactive_anon:0kB active_file:1048kB inactive_file:84kB unevictable:0kB writepending:12kB present:786432kB managed:1172kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 529.647904][T14383] lowmem_reserve[]: 0 0 0 0 [ 529.652529][T14383] Node 1 Normal free:3782000kB min:53684kB low:67104kB high:80524kB active_anon:0kB inactive_anon:0kB active_file:136kB inactive_file:0kB unevictable:0kB writepending:0kB present:3932160kB managed:3870244kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 529.681285][T14383] lowmem_reserve[]: 0 0 0 0 [ 529.685806][T14383] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 529.700469][T14383] Node 0 DMA32: 517*4kB (UME) 796*8kB (UME) 1650*16kB (UME) 1411*32kB (UME) 843*64kB (UM) 186*128kB (UME) 26*256kB (UME) 8*512kB (UM) 8*1024kB (UM) 5*2048kB (UM) 249*4096kB (UM) = 1206836kB [ 529.720028][T14383] Node 0 Normal: 3*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20kB [ 529.732595][T14383] Node 1 Normal: 62*4kB (UE) 229*8kB (UE) 261*16kB (U) 58*32kB (UME) 23*64kB (UE) 12*128kB (UME) 8*256kB (UME) 3*512kB (UE) 1*1024kB (M) 1*2048kB (M) 919*4096kB (M) = 3782000kB [ 529.751803][T14383] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 529.761940][T14383] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 529.772223][T14383] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 529.772240][T14383] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 529.791671][T14383] 54325 total pagecache pages [ 529.796438][T14383] 0 pages in swap cache [ 529.796448][T14383] Swap cache stats: add 0, delete 0, find 0/0 [ 529.796453][T14383] Free swap = 0kB 20:35:15 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:15 executing program 5: add_key(&(0x7f0000000040)='syzkaller\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100)="39aa1aeccd63e02b30ef12ee8b6f0e02ee80f3aa95638643da241001639ca0bb1c2a4090bb2d76d10c198df9b15abf7b4805fb20a41a8b8fe39bacdf10d1e78511f92d198aa933b73dbc33264f4553c55e6c370638ae7806c2a6da11652b4a03ef9083399572db0e3869b145fa4305017a45b8", 0x73, 0xfffffffffffffffe) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) ioctl$TIOCEXCL(r0, 0x540c) r1 = add_key(&(0x7f0000000180)='ceph\x00', &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000000200)="eba37967ed538966fc8e75bb3571c785c3594171f51ee6ac03a41f89dff006649ae73088a307534ab798ca7e4f290ad25f", 0x31, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000280)=@security={'security\x00', 0xe, 0x4, 0x530, 0x398, 0x280, 0x280, 0x398, 0x398, 0x498, 0x498, 0x498, 0x498, 0x498, 0x4, &(0x7f0000000240), {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x1b}, 0xffffff00, 0x0, 'caif0\x00', 'syz_tun\x00', {0xff}, {}, 0x877e45fe625a18bd, 0x1, 0x2}, 0x0, 0x220, 0x280, 0x0, {}, [@common=@inet=@policy={0x158, 'policy\x00', 0x0, {[{@ipv6=@rand_addr="ad51e4b8ba36230b1758c6d7e576373e", [0xff, 0x0, 0x0, 0xff], @ipv4=@empty, [0xffffff00, 0xffffff00, 0xff, 0xff000000], 0x4d4, 0x3504, 0x3c, 0x0, 0x4, 0x30b9a525effe96b8}, {@ipv4=@multicast2, [0x0, 0x0, 0xffffff00, 0xffffff00], @ipv6=@mcast1, [0x0, 0x0, 0xff, 0xff], 0x4d6, 0x3506, 0x87, 0x0, 0x8, 0x4}, {@ipv6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, [0xffffff00, 0xffffff00, 0xff, 0xffffff00], @ipv6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, [0xffffffff, 0xffffffff, 0xffffffff], 0x4d3, 0x0, 0x87, 0xf25148b6fb52f5f0, 0x8, 0x14}, {@ipv6=@rand_addr="1a9112257741be0f05e2181d6cf6ff5d", [0xffffff00, 0x0, 0xffffff00], @ipv4=@remote, [0xffffffff, 0xffffffff, 0x0, 0xffffff00], 0x4d4, 0x3503, 0x3f, 0x0, 0xd, 0x2}], 0xe, 0x2}}, @common=@addrtype={0x30, 'addrtype\x00', 0x0, {0x190, 0x26387e027dd34a54}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [0x8, 0x23, 0x100, 0x49b6, 0x0, 0x4], 0x40, 0x8}, {0x6, [0x80000000, 0x1, 0x3, 0x68eb0e39, 0x7], 0x800, 0x7}}}}, {{@uncond, 0x0, 0xb8, 0x118, 0x0, {}, [@common=@socket0={0x20, 'socket\x00'}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x200, [0x100, 0x6, 0x3, 0x80000000, 0x8001, 0x7], 0x6, 0x40}, {0x74fac3fa, [0x80, 0x8, 0x1, 0x3, 0x3, 0x4], 0x3, 0x40}}}}, {{@ip={@loopback, @empty, 0xff, 0x0, 'veth0_to_team\x00', 'vlan0\x00', {0xff}, {}, 0xff, 0x2, 0x41}, 0x0, 0xc0, 0x100, 0x0, {}, [@common=@inet=@set1={0x28, 'set\x00', 0x1, {{0x9, 0xde, 0x4}}}]}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "d378b6e2a18d11f694540e0de593045e3b2dbcbae5ca47307b113208f80b"}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x590) request_key(&(0x7f0000000000)='keyring\x00', 0xfffffffffffffffd, 0x0, r1) 20:35:15 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:15 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x1e00, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:15 executing program 4: mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 529.796459][T14383] Total swap = 0kB [ 529.796467][T14383] 1965979 pages RAM [ 529.796477][T14383] 0 pages HighMem/MovableOnly [ 529.811479][T14383] 341180 pages reserved [ 529.819381][T14383] 0 pages cma reserved 20:35:15 executing program 2: bpf$PROG_LOAD(0x2, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:15 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$usbmon(0xffffffffffffff9c, &(0x7f0000000040)='/dev/usbmon0\x00', 0x0, 0x0) readv(r0, &(0x7f0000001280)=[{&(0x7f0000000180)=""/61, 0x3d}, {&(0x7f00000001c0)=""/169, 0xa9}, {&(0x7f0000000280)=""/4096, 0x1000}], 0x3) r1 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x2, 0x2) sendto$unix(r1, &(0x7f0000000100)="e1d59a9b03c4b08edf5170ec499ea032", 0x10, 0x0, &(0x7f00000012c0)=@abs={0x1, 0x0, 0x4e24}, 0x6e) [ 530.235336][T14443] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 530.703696][T14461] IPVS: ftp: loaded support on port[0] = 21 [ 530.852188][T14461] chnl_net:caif_netlink_parms(): no params data found [ 530.865689][ T9965] device bridge_slave_1 left promiscuous mode [ 530.873445][ T9965] bridge0: port 2(bridge_slave_1) entered disabled state [ 530.917978][ T9965] device bridge_slave_0 left promiscuous mode [ 530.924558][ T9965] bridge0: port 1(bridge_slave_0) entered disabled state [ 532.887744][ T9965] device hsr_slave_0 left promiscuous mode [ 532.937255][ T9965] device hsr_slave_1 left promiscuous mode [ 532.990574][ T9965] team0 (unregistering): Port device team_slave_1 removed [ 533.009444][ T9965] team0 (unregistering): Port device team_slave_0 removed [ 533.022824][ T9965] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 533.063704][ T9965] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 533.158101][ T9965] bond0 (unregistering): Released all slaves [ 533.298649][T14461] bridge0: port 1(bridge_slave_0) entered blocking state [ 533.310716][T14461] bridge0: port 1(bridge_slave_0) entered disabled state [ 533.319323][T14461] device bridge_slave_0 entered promiscuous mode [ 533.327990][T14461] bridge0: port 2(bridge_slave_1) entered blocking state [ 533.335627][T14461] bridge0: port 2(bridge_slave_1) entered disabled state [ 533.343884][T14461] device bridge_slave_1 entered promiscuous mode [ 533.364004][T14461] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 533.375420][T14461] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 533.397742][T14461] team0: Port device team_slave_0 added [ 533.405020][T14461] team0: Port device team_slave_1 added [ 533.460190][T14461] device hsr_slave_0 entered promiscuous mode [ 533.497225][T14461] device hsr_slave_1 entered promiscuous mode [ 533.557046][T14461] debugfs: Directory 'hsr0' with parent '/' already present! [ 533.578055][T14461] bridge0: port 2(bridge_slave_1) entered blocking state [ 533.585419][T14461] bridge0: port 2(bridge_slave_1) entered forwarding state [ 533.593072][T14461] bridge0: port 1(bridge_slave_0) entered blocking state [ 533.600205][T14461] bridge0: port 1(bridge_slave_0) entered forwarding state [ 533.634906][T14461] 8021q: adding VLAN 0 to HW filter on device bond0 [ 533.652446][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 533.663354][ T3504] bridge0: port 1(bridge_slave_0) entered disabled state [ 533.671566][ T3504] bridge0: port 2(bridge_slave_1) entered disabled state [ 533.680330][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 533.740350][T14461] 8021q: adding VLAN 0 to HW filter on device team0 [ 533.753075][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 533.762669][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 533.769810][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 533.789041][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 533.798092][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 533.805183][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 533.825956][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 533.835289][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 533.854881][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 533.863360][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 533.872344][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 533.882976][T14461] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 533.928844][T14461] 8021q: adding VLAN 0 to HW filter on device batadv0 20:35:19 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:19 executing program 5: r0 = request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)='%(em0\x00', 0x0) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, r0) removexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=@random={'system.', 'syz'}) 20:35:19 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:19 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:19 executing program 2: bpf$PROG_LOAD(0x3, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:19 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x2000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 534.235864][T14475] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:19 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x400) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000100)={'icmp6\x00'}, &(0x7f0000000140)=0x1e) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') ioctl$BLKROSET(r0, 0x125d, &(0x7f0000000180)=0x35) write$P9_RLERRORu(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="15e7dfba09749b80746b657972696e7a00090000013176bbbfbc8bb614ab98daf0b11ffa6a882b026b69d68c66449a0202bf26d343a1b3ff33cf9f72332558834d4a5813be6f17c76879451232bc0247fc4bc515e85d22cc04f26495bed98f486a63c6a95a4bdc4670d95e2c51a72b6cd06c665eaf7ad25fe46d3841d01fc47537c0cd69e6b008bbd22ec30defa36b1667affc887d5ded9b1737"], 0x15) 20:35:19 executing program 2: bpf$PROG_LOAD(0x4, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:19 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x3f00, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:19 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:20 executing program 2: bpf$PROG_LOAD(0x6, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:20 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:20 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:20 executing program 5: r0 = msgget(0x2, 0x4) msgctl$IPC_INFO(r0, 0x3, &(0x7f00000000c0)=""/186) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:35:20 executing program 2: bpf$PROG_LOAD(0x7, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:20 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:20 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 535.204165][T14499] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x4000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:20 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x10000, 0x0) ioctl$NBD_DISCONNECT(r0, 0xab08) ioctl$RTC_PIE_OFF(r0, 0x7006) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0x0, 0x1, 0x2, 0x2, 0xc4b1}) 20:35:20 executing program 2: bpf$PROG_LOAD(0x8, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 535.413687][T14533] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:20 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:21 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:21 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:21 executing program 5: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0xe0200, 0x0) recvfrom$x25(r0, &(0x7f00000000c0)=""/75, 0x4b, 0x20, 0x0, 0x0) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:35:21 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x4800, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:21 executing program 2: bpf$PROG_LOAD(0x9, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 535.869425][T14547] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:21 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x200000, 0x0) ioctl$VIDIOC_OVERLAY(r0, 0x4004560e, &(0x7f00000002c0)=0x1f) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x200000, 0x0) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000140)={0x0, 0x6, 0x4}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x2, 0x2) fremovexattr(r2, &(0x7f0000000200)=@random={'user.', '\\(\x00'}) write(r1, &(0x7f00000001c0)="f16817b3a1b8a35c4fb2adba569d525a736086875a7edb80d5fdf6c3c149c77ae6698b05b2613cdffb27680ca3ab45dd546d476068483ad52f7abb8fa518", 0x3e) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r0, 0xc008551b, &(0x7f0000000180)={0x401}) 20:35:21 executing program 2: bpf$PROG_LOAD(0xa, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:21 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x4c00, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:21 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x4e22, @local}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x326, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000000000000008001b00000000000800100005000000"], 0x30}}, 0x0) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:35:21 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 536.250056][T14577] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 537.933047][T14598] IPVS: ftp: loaded support on port[0] = 21 [ 538.153500][T14598] chnl_net:caif_netlink_parms(): no params data found [ 538.184839][T14598] bridge0: port 1(bridge_slave_0) entered blocking state [ 538.192280][T14598] bridge0: port 1(bridge_slave_0) entered disabled state [ 538.200815][T14598] device bridge_slave_0 entered promiscuous mode [ 538.276492][T14598] bridge0: port 2(bridge_slave_1) entered blocking state [ 538.283912][T14598] bridge0: port 2(bridge_slave_1) entered disabled state [ 538.292239][T14598] device bridge_slave_1 entered promiscuous mode [ 538.383656][T14598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 538.398281][T14598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 538.409370][ T9965] device bridge_slave_1 left promiscuous mode [ 538.416289][ T9965] bridge0: port 2(bridge_slave_1) entered disabled state [ 538.468057][ T9965] device bridge_slave_0 left promiscuous mode [ 538.474327][ T9965] bridge0: port 1(bridge_slave_0) entered disabled state [ 540.457242][ T9965] device hsr_slave_0 left promiscuous mode [ 540.497087][ T9965] device hsr_slave_1 left promiscuous mode [ 540.545093][ T9965] team0 (unregistering): Port device team_slave_1 removed [ 540.559839][ T9965] team0 (unregistering): Port device team_slave_0 removed [ 540.573529][ T9965] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 540.612192][ T9965] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 540.685340][ T9965] bond0 (unregistering): Released all slaves [ 540.814436][T14598] team0: Port device team_slave_0 added [ 540.828660][T14598] team0: Port device team_slave_1 added [ 540.880078][T14598] device hsr_slave_0 entered promiscuous mode [ 540.927345][T14598] device hsr_slave_1 entered promiscuous mode [ 540.983128][T14598] debugfs: Directory 'hsr0' with parent '/' already present! [ 541.035887][T14598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 541.053457][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 541.062147][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 541.120599][T14598] 8021q: adding VLAN 0 to HW filter on device team0 [ 541.140213][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 541.156687][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 541.166085][T12956] bridge0: port 1(bridge_slave_0) entered blocking state [ 541.173227][T12956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 541.201509][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 541.213115][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 541.226254][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 541.244900][T12956] bridge0: port 2(bridge_slave_1) entered blocking state [ 541.252150][T12956] bridge0: port 2(bridge_slave_1) entered forwarding state [ 541.267543][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 541.297385][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 541.314468][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 541.338114][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 541.355496][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 541.364711][ T2920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 541.386479][T14598] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 541.406996][T14598] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 541.415869][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 541.432562][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 541.460030][T14598] 8021q: adding VLAN 0 to HW filter on device batadv0 20:35:27 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x5865, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:27 executing program 2: bpf$PROG_LOAD(0xb, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:27 executing program 5: r0 = request_key(&(0x7f0000000140)='id_resolver\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000001c0)='syz', 0xfffffffffffffffc) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x51a5f9853476f0bf, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r1, 0x4048ae9b, &(0x7f0000000040)={0x20001, 0x0, [0x1ff, 0x68a, 0x0, 0x2, 0xfffffffffffff801, 0x5, 0x9, 0x8]}) setsockopt$CAIFSO_REQ_PARAM(r1, 0x116, 0x80, &(0x7f0000000200)="cfc91f1e1419061724b918887981fb2c7612a9eacd390eb05f007bb26f73eba20dffc09ca0cca034c23a41095f9799683aec41a5fa42688c49ee6bd88b2d9150a224377a473b74a33c3a3f4646b27b9b8c8ea7c0dc2705863c50c5da35a0302c5a5704fd48a468aaa9f954874e8c77a0d74a59634250231049eb69f1d40338f6fb50a3e930f095f737f1a5d49c890b8ed11d0e9ed8f62e7b2425a01e26556cea06b5c4616c792c0cf5498b154bf803147159be62de562aac8d6481e72fc8db5f4ce71d9f80ec10f8f60c6e999c2ef553ad698230fcac1411ebba0b", 0xdb) request_key(&(0x7f0000000100)='\x90\xb0TD\x8b\x06~\xac', &(0x7f00000000c0)={'syz', 0x2}, 0x0, r0) accept4$bt_l2cap(r1, &(0x7f0000000300), &(0x7f0000000340)=0xe, 0x800) 20:35:27 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(0x0, &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:27 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:27 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 541.733726][T14610] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:27 executing program 2: bpf$PROG_LOAD(0xc, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:27 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x0, 0x0) ioctl$KVM_GET_LAPIC(r0, 0x8400ae8e, &(0x7f00000004c0)={"c9255f9874f5244136c31129991ba77eb1061e7a44d0ee9f55d1f2d0e58dcf169dc0c7a1c58efb718a856a8126ef7f6da5dccb8d96dd0f2882c010a0f4ea46ff1641b5ef97c74dcf5205e9095b42dc9e1a5af6ea85818ec48fe7d6a202fe0c298e95ec38d0662c797745e7bb478814e33a6c26659d8ed1b14e3ef403018d2899c8955d8fe90f320bb7c4f8e780380127b15128791e76af1023cf77ea96e31d6ad7abcfb473df5744e16d817551728c8de417ad59db6fd56f2ee89b7b17dc545f859d1cacdba214a1fe28eb163a38243f0645cf53a5bc4b4af3eceb102dbd529059b55199585b134ea8532eb96bb79f0d9e6b347210caa41758c953c3b46835b4c48d9285b1ac0886923377a9c092629ed0c27512e664e3fb85965f8ce883d12ddff27cfd6da5a0b7bf74e60bd6fcb2892f2639489cf2040d1a7452a490d64e80e9574c3e7939ea0fe81f60dd4028ad81401fa04c89ff013a10f7002b72e88bcb09f3e6237bd623b2fc092f1217a53b4669d4dc9eb46bf3ba2037210fc0cec464a815a1c695c9e829b54b87996bac3622ee4fe3ea0789e67c651b07490b9181ec91a2262bb1147100b30c0068808d1a0f10ab4759c001b074527f4577a4cd97b22d023d02c6c5768a338f5415a824d19eeb9ae814aff0136d5f61064240e6c588c1ee75982f05093367926cd82126b35ffff352808eac087dd1d84fdbcd7da25a18b042536578fe3321c485847f2d72aa7056ccb9eccbb6b27c401d25055f947103ada735de11084e5a4f49a2d03fd1aaf0379c759aeb922c3a79337b0ee0bd93b0bcd9c82ee40efe144765b6cf2968afb1a0cb4a410ed56567925acb63792977a69fb81542ae4037fd222099471a663cd1276d2bf46a757984efda14a0e7bcd9063075a22cb0dc7d3f8ab948fe403b694073a338a4a5f26be9c6ec7b84b2ab4d63a33f7bb1545839824e25628be72f9c47878dacac40d901e88aaf02678cb7a9a4fde418bfec7a27b93a3b8dffb8b0d11e5367db919777c4c9289256a2d0bd9a334829d223e2fccb315748877a410e76dae968930ede152c02df7d03bb3e918b0acfa8c55fe5f0e9ea524ea14d5a0a8671c50a1dc33ae72c1bbd3f9c61d48df7478d02a85b016cb5da6856585d2a9e9bb7d3014df22a5bfc3b4660775f23d02b6042d1f4d0ae3a3a7f69329f33aded5cffe52eea92d3fb66c8670b1a1e05dd2d3d44267cf74a956899de3c1a5ec518f93a1cb19f7925a9c6ce5cae091c1847462f4e25dbd0942235ed6afbb1115270ec004078129430bdf7f1922e491f4dc025c18cb21c718fb4da8a4aa42da43233ec6d03f0c87ab28e6931827a974b17b2388f2eab0982d0f3d60a179cc7a7a3d3207d819b9883b2a79b5fdb49fb5cc41d58e7c01afca579c02d1050c2fe02d9f2ace91733315b0a5f61e739a15318fb2e9f"}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)=0x0) migrate_pages(r1, 0x7ff, &(0x7f0000000080)=0x8001, &(0x7f00000000c0)=0x1) 20:35:27 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x6000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:27 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:27 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='autogroup\x00') getsockopt$inet_tcp_buf(r0, 0x6, 0xb, &(0x7f0000000140)=""/236, &(0x7f0000000240)=0xec) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) ioctl$VIDIOC_OVERLAY(r1, 0x4004560e, &(0x7f00000000c0)=0xfff) 20:35:27 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(0x0, &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:27 executing program 2: bpf$PROG_LOAD(0xd, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:27 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x3, 0x2) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000100)={'filter\x00', 0x7, 0x4, 0x490, 0x270, 0x270, 0x140, 0x3a8, 0x3a8, 0x3a8, 0x4, &(0x7f00000000c0), {[{{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @broadcast, @local, 0x34b4fdee4902b8fe, 0xffffffff}}}, {{@uncond, 0xf0, 0x130}, @unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x857, 0x1, 0x6}}}, {{@arp={@remote, @multicast1, 0xffffffff, 0x0, @empty, {[0x0, 0xff, 0xff, 0xff]}, @mac=@dev={[], 0x16}, {[0xff, 0xff, 0xff, 0xff, 0xff]}, 0x79c, 0x3f, 0x80000001, 0xd1, 0xffffffff, 0x8, 'bridge_slave_1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x0, 0x200}, 0xf0, 0x138}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x495, 'syz0\x00', 0x4}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4e0) 20:35:27 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(0x0, &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:27 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0) [ 542.735477][T14630] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:28 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:28 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:28 executing program 2: bpf$PROG_LOAD(0xe, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:28 executing program 5: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) socket$alg(0x26, 0x5, 0x0) request_key(&(0x7f0000000140)='syzkaller\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, r0) 20:35:28 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:28 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x6558, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:28 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:28 executing program 2: bpf$PROG_LOAD(0xf, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 543.039467][T14669] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:28 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x6800, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:28 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = socket$tipc(0x1e, 0x7, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) 20:35:28 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:28 executing program 2: bpf$PROG_LOAD(0x10, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:28 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:28 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 543.333785][T14686] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:28 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x1c, 0x800) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f0000000100)=""/127, &(0x7f0000000180)=0x7f) 20:35:28 executing program 2: bpf$PROG_LOAD(0x11, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:28 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x6c00, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:29 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 543.627922][T14704] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:29 executing program 5: add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) r0 = add_key(&(0x7f0000000100)='ceph\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)="c492581f81b8e8395b38daf9f883d284d72a34952d36e2c1963e8f1e507c1ac905b7f90657217954624395fcbdeeea7ea7694e56726ff597297079e49a", 0x3d, 0xfffffffffffffffb) request_key(&(0x7f00000001c0)='id_resolver\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, r0) r1 = syz_open_dev$dspn(&(0x7f0000001740)='/dev/dsp#\x00', 0x1f, 0x10000) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000001780)={0xffffffffffff8c07, 0x7, 0x1000}, 0x4) 20:35:29 executing program 2: bpf$PROG_LOAD(0x12, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x7400, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:29 executing program 2: bpf$PROG_LOAD(0x13, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:29 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x20480, 0x0) ioctl$TIOCGPKT(r0, 0x80045438, &(0x7f00000000c0)) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:35:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x7a00, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 544.122561][T14731] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 545.623280][T14737] IPVS: ftp: loaded support on port[0] = 21 [ 545.861650][T14739] IPVS: ftp: loaded support on port[0] = 21 [ 546.055836][T14737] chnl_net:caif_netlink_parms(): no params data found [ 546.243479][T14737] bridge0: port 1(bridge_slave_0) entered blocking state [ 546.251475][T14737] bridge0: port 1(bridge_slave_0) entered disabled state [ 546.261421][T14737] device bridge_slave_0 entered promiscuous mode [ 546.271004][T14737] bridge0: port 2(bridge_slave_1) entered blocking state [ 546.279023][T14737] bridge0: port 2(bridge_slave_1) entered disabled state [ 546.287845][T14737] device bridge_slave_1 entered promiscuous mode [ 546.455037][T14737] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 546.471259][T14737] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 546.635326][T14737] team0: Port device team_slave_0 added [ 546.644935][T14737] team0: Port device team_slave_1 added [ 546.681547][T14739] chnl_net:caif_netlink_parms(): no params data found [ 546.692625][ T9965] device bridge_slave_1 left promiscuous mode [ 546.699902][ T9965] bridge0: port 2(bridge_slave_1) entered disabled state [ 546.767733][ T9965] device bridge_slave_0 left promiscuous mode [ 546.773977][ T9965] bridge0: port 1(bridge_slave_0) entered disabled state [ 546.848326][ T9965] device bridge_slave_1 left promiscuous mode [ 546.854705][ T9965] bridge0: port 2(bridge_slave_1) entered disabled state [ 546.909261][ T9965] device bridge_slave_0 left promiscuous mode [ 546.918159][ T9965] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.768526][ T9965] device hsr_slave_0 left promiscuous mode [ 550.807070][ T9965] device hsr_slave_1 left promiscuous mode [ 550.874706][ T9965] team0 (unregistering): Port device team_slave_1 removed [ 550.889154][ T9965] team0 (unregistering): Port device team_slave_0 removed [ 550.900906][ T9965] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 550.940988][ T9965] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 551.034124][ T9965] bond0 (unregistering): Released all slaves [ 551.159443][ T9965] device hsr_slave_0 left promiscuous mode [ 551.207140][ T9965] device hsr_slave_1 left promiscuous mode [ 551.260225][ T9965] team0 (unregistering): Port device team_slave_1 removed [ 551.273372][ T9965] team0 (unregistering): Port device team_slave_0 removed [ 551.285771][ T9965] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 551.344049][ T9965] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 551.436548][ T9965] bond0 (unregistering): Released all slaves [ 551.609186][T14737] device hsr_slave_0 entered promiscuous mode [ 551.647207][T14737] device hsr_slave_1 entered promiscuous mode [ 551.697069][T14737] debugfs: Directory 'hsr0' with parent '/' already present! [ 551.709725][T14739] bridge0: port 1(bridge_slave_0) entered blocking state [ 551.717199][T14739] bridge0: port 1(bridge_slave_0) entered disabled state [ 551.725567][T14739] device bridge_slave_0 entered promiscuous mode [ 551.735588][T14739] bridge0: port 2(bridge_slave_1) entered blocking state [ 551.743508][T14739] bridge0: port 2(bridge_slave_1) entered disabled state [ 551.751886][T14739] device bridge_slave_1 entered promiscuous mode [ 551.773735][T14739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 551.788766][T14739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 551.819731][T14739] team0: Port device team_slave_0 added [ 551.827829][T14739] team0: Port device team_slave_1 added [ 551.908906][T14739] device hsr_slave_0 entered promiscuous mode [ 551.957954][T14739] device hsr_slave_1 entered promiscuous mode [ 552.017081][T14739] debugfs: Directory 'hsr0' with parent '/' already present! [ 552.062243][T14739] bridge0: port 2(bridge_slave_1) entered blocking state [ 552.069606][T14739] bridge0: port 2(bridge_slave_1) entered forwarding state [ 552.077524][T14739] bridge0: port 1(bridge_slave_0) entered blocking state [ 552.084949][T14739] bridge0: port 1(bridge_slave_0) entered forwarding state [ 552.111067][T14737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 552.246684][T14737] 8021q: adding VLAN 0 to HW filter on device team0 [ 552.256350][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 552.273622][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 552.299800][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 552.308080][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 552.340760][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 552.350150][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 552.359743][ T3504] bridge0: port 1(bridge_slave_0) entered blocking state [ 552.366871][ T3504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 552.377493][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 552.386322][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 552.395468][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 552.402959][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 552.411917][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 552.421232][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 552.445321][T14739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 552.459397][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 552.468531][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 552.476703][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 552.494616][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 552.514612][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 552.535618][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 552.545090][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 552.562666][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 552.592889][T14737] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 552.618860][T14737] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 552.637060][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 552.655080][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 552.665253][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 552.686671][T14739] 8021q: adding VLAN 0 to HW filter on device team0 [ 552.726711][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 552.736354][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 552.753569][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 552.760852][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 552.798942][T14737] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 552.814461][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 552.832966][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 552.846427][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 552.853655][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 552.872238][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 552.884484][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 552.914784][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 552.936021][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 552.946594][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 552.962980][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 552.973269][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 552.993611][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 553.006992][T14739] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 553.027565][T14739] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 553.039760][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 553.056106][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 553.066520][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 553.127239][T14739] 8021q: adding VLAN 0 to HW filter on device batadv0 20:35:38 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:38 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:38 executing program 2: bpf$PROG_LOAD(0x14, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:38 executing program 5: r0 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x2, 0x2) ioctl$RTC_PLL_SET(r0, 0x40207012, &(0x7f00000000c0)={0xff00000000000000, 0x0, 0x2, 0x6, 0x200}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000002c0)=0x0) sched_getattr(r1, &(0x7f0000000300)={0x30}, 0x30, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, &(0x7f0000000140)={0xc, 0x0, {0x54, 0xbbd, 0x2, {0x5, 0x9}, {0x7, 0x30}, @period={0x58, 0x0, 0x0, 0x1, 0x0, {0x6, 0x5, 0x1, 0x400}, 0x3, &(0x7f0000000100)=[0x100000001, 0x77, 0x4]}}, {0x1b5dde55dece3ffb, 0x1000, 0x6, {0x7, 0xffffffff}, {0x1, 0x1ff}, @cond=[{0x1, 0x100000000, 0x0, 0x101, 0x9, 0x80000000}, {0x6, 0x400, 0x20, 0x3, 0x1f, 0x8}]}}) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000001c0)={0x0, 0x81}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000380)=@assoc_id=r2, 0x1) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000280)=0x7, 0xfffffd48) 20:35:38 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x8100, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:38 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:38 executing program 5: r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x1, 0xa9a8e1a6974db9c1) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r1) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000001c0)={0x0, @aes128, 0x2, "9474fb15edf3ec2d"}) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000000c0)={0x0, 0x86d}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000140)={r2, 0x699}, &(0x7f0000000180)=0x8) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280)="01b015246fb453033905c28613c2d524fc688ea06c738ad13b211543d0d71ac8dc5d243df4c42de9964f2e8f8f95c85bf593676215a1643361e436c770cbd6633694", 0x42, r0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffffffffffd9d, 0x0}}], 0x400000000000004, 0x0, 0x0) r4 = semget$private(0x0, 0x1, 0x50) semctl$IPC_RMID(r4, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000200)='cpuset\x00') preadv(r5, &(0x7f00000017c0), 0x3a8, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000680)='/dev/ubi_ctrl\x00', 0x20000, 0x0) r6 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)="0c0e0e24f174ca9f4f9fd4d6048ebb83a77899e77672964aabdd49c49df5d3412d7181843941ed6cfc976439b8a42209c6bc10d96cd50cea67b8166c75cee8726973cbfc30f21999aae2096f9cc7df6380096bdaa89ab69eac306870aa315731be59a376f3f1a925dc3d651eaae6223748f126d333a2fe", 0x77, r0) r7 = request_key(&(0x7f0000000400)='cifs.idmap\x00', &(0x7f0000000440)={'syz', 0x1}, &(0x7f0000000480)='syz', r0) keyctl$dh_compute(0x17, &(0x7f00000004c0)={r3, r6, r7}, &(0x7f0000000500)=""/29, 0x1d, &(0x7f0000000640)={&(0x7f0000000540)={'nhpoly1305\x00'}, &(0x7f0000000580)="a15a26bc2aa51d0aaca389146261adb7274ed03deebbf563f751a9784b9d4eadfe139ce6b4cde38ade349927977b52715a7d6925ef9f2c763f7c2e4d8d9e1245f8b9c124c39cdbe2feb211f8491a2cf98667624334500914d08663a4ed7f2b90b5f8004184ef71fa3dca20d7b82935e9bf5b410224cf19e9fada5d3118c2b9d51abbebce372f77e8456b65c5f916efcb62d8fa207a7ec107bf71b1d810e534", 0x9f}) 20:35:38 executing program 2: bpf$PROG_LOAD(0x15, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:39 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:39 executing program 2: bpf$PROG_LOAD(0x16, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:39 executing program 5: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x101202, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @rand_addr=0xea}}, 0x0, 0x3, 0x0, "eae79a1f4085ea5dd987087c271359a8a73001beb9be0ecc273fecff7dc5b1aa35e2a014b084c8c5f6aff00f87b3e94ebacab1d14b24c29159b1060e8638e1ef2f715721fd0d5be5acae513645811c48"}, 0xd8) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) 20:35:39 executing program 2: bpf$PROG_LOAD(0x17, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 554.070808][T14764] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:39 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:39 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x100, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000140)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x5, @loopback, 0x7}, {0xa, 0x4e21, 0x4, @remote, 0xfff}, r1, 0x1}}, 0x48) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f00000001c0)={0x9, 0x108, 0xfa00, {r1, 0xa0, "d9f56b", "1547cb8170cd9d18de31189f3c91fed1bb51cd35ea926a56341c5b3b50e4f791576c339bfba097180390ebb6418f97e1abf21a0402ce836d67dd63a4310370300fd2b167b0a18dfc1de8618a22af97e8b5dcb4ec1240e0a50289064cc360a7d80b2ce1697479a8d2d4c1b46881a1d7536f41f225a65d94d2a4a55bece7451d940516d91e9f084a24369c2e55510b61212848d3691a7924724e26ed40f351be6a00d630ab5b183f170c3a1897d53243b593b07e5888cd49494de72fbe90bcafaf5eef337e32d42a0767d62e1b6be47e02b07f79446992cb8a7bade85a51b5683d075d525791836f8505c008b1e341b45d0fa757b1535e9dfcafea8d637147e785"}}, 0x110) getsockopt$inet_int(r0, 0x0, 0x32, &(0x7f0000000300), &(0x7f0000000340)=0x4) 20:35:39 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:39 executing program 2: bpf$PROG_LOAD(0x19, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:39 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xf000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:39 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:39 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x2, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:39 executing program 5: syz_emit_ethernet(0x2a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaa2f6c7ad7c7008060001080006040002ffffffffffffffffffffaaaaaaaaaabbac1414aa77cc29868c19f779605189dc774608693fe62714b7c94b8abc6c5296f6522d14dcfdf3aa8566f658289d2712e849a5a399d32914fcfe7ae5690beeb7b15e1d040c1296f93759c55923ae38c488a4c016a96ab9ba0bd2696d574f525882a9a048e786"], 0x0) [ 554.439640][T14800] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:39 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:39 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xfeff, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:40 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:40 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:40 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:40 executing program 5: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xffffffffffffffff, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)=ANY=[], 0x80000239) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0x3ff) r2 = dup2(r1, r0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvfrom(r1, &(0x7f0000000240)=""/184, 0xfffffe4c, 0x10100, 0x0, 0xfffffffffffffcff) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, 0x0, &(0x7f0000000040)) [ 554.769265][T14813] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:40 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:40 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xff0f, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:40 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', 0x0, &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:40 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 555.082546][T14832] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:40 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xfffe, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 555.291138][T14844] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:40 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x7, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 557.143951][T14855] IPVS: ftp: loaded support on port[0] = 21 [ 557.485960][T14855] chnl_net:caif_netlink_parms(): no params data found [ 557.703209][T14858] IPVS: ftp: loaded support on port[0] = 21 [ 557.732632][T14855] bridge0: port 1(bridge_slave_0) entered blocking state [ 557.740862][T14855] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.749850][T14855] device bridge_slave_0 entered promiscuous mode [ 557.758900][T14855] bridge0: port 2(bridge_slave_1) entered blocking state [ 557.765956][T14855] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.773951][T14855] device bridge_slave_1 entered promiscuous mode [ 557.945202][T14855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 557.970157][T14855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 558.162951][T14855] team0: Port device team_slave_0 added [ 558.170399][T14855] team0: Port device team_slave_1 added [ 558.204720][ T9965] device bridge_slave_1 left promiscuous mode [ 558.212736][ T9965] bridge0: port 2(bridge_slave_1) entered disabled state [ 558.278668][ T9965] device bridge_slave_0 left promiscuous mode [ 558.284925][ T9965] bridge0: port 1(bridge_slave_0) entered disabled state [ 558.338922][ T9965] device bridge_slave_1 left promiscuous mode [ 558.345337][ T9965] bridge0: port 2(bridge_slave_1) entered disabled state [ 558.378205][ T9965] device bridge_slave_0 left promiscuous mode [ 558.384405][ T9965] bridge0: port 1(bridge_slave_0) entered disabled state [ 562.227114][ T9965] device hsr_slave_0 left promiscuous mode [ 562.277157][ T9965] device hsr_slave_1 left promiscuous mode [ 562.355300][ T9965] team0 (unregistering): Port device team_slave_1 removed [ 562.372620][ T9965] team0 (unregistering): Port device team_slave_0 removed [ 562.385085][ T9965] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 562.451150][ T9965] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 562.525204][ T9965] bond0 (unregistering): Released all slaves [ 562.677733][ T9965] device hsr_slave_0 left promiscuous mode [ 562.737016][ T9965] device hsr_slave_1 left promiscuous mode [ 562.806266][ T9965] team0 (unregistering): Port device team_slave_1 removed [ 562.820622][ T9965] team0 (unregistering): Port device team_slave_0 removed [ 562.834834][ T9965] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 562.913364][ T9965] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 563.014362][ T9965] bond0 (unregistering): Released all slaves [ 563.170495][T14855] device hsr_slave_0 entered promiscuous mode [ 563.207234][T14855] device hsr_slave_1 entered promiscuous mode [ 563.256991][T14855] debugfs: Directory 'hsr0' with parent '/' already present! [ 563.269974][T14858] chnl_net:caif_netlink_parms(): no params data found [ 563.326168][T14858] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.333827][T14858] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.343144][T14858] device bridge_slave_0 entered promiscuous mode [ 563.366696][T14858] bridge0: port 2(bridge_slave_1) entered blocking state [ 563.374446][T14858] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.384492][T14858] device bridge_slave_1 entered promiscuous mode [ 563.424177][T14858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 563.435728][T14858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 563.460380][T14858] team0: Port device team_slave_0 added [ 563.468937][T14858] team0: Port device team_slave_1 added [ 563.480198][T14855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 563.570659][T14858] device hsr_slave_0 entered promiscuous mode [ 563.627283][T14858] device hsr_slave_1 entered promiscuous mode [ 563.677219][T14858] debugfs: Directory 'hsr0' with parent '/' already present! [ 563.776080][T14858] bridge0: port 2(bridge_slave_1) entered blocking state [ 563.783355][T14858] bridge0: port 2(bridge_slave_1) entered forwarding state [ 563.791241][T14858] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.798356][T14858] bridge0: port 1(bridge_slave_0) entered forwarding state [ 563.822284][T14855] 8021q: adding VLAN 0 to HW filter on device team0 [ 563.839437][ T3504] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.856053][ T3504] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.875107][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 563.884715][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 563.929038][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 563.947755][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 563.956389][T13198] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.963529][T13198] bridge0: port 1(bridge_slave_0) entered forwarding state [ 563.982820][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 563.993914][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 564.010096][T13198] bridge0: port 2(bridge_slave_1) entered blocking state [ 564.017381][T13198] bridge0: port 2(bridge_slave_1) entered forwarding state [ 564.033610][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 564.043762][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 564.084166][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 564.100434][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 564.114960][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 564.132435][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 564.143872][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 564.173824][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 564.185218][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 564.203093][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 564.214610][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 564.230925][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 564.253340][T14855] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 564.295081][T14858] 8021q: adding VLAN 0 to HW filter on device bond0 [ 564.325418][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 564.341571][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 564.361342][T14855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 564.380502][T14858] 8021q: adding VLAN 0 to HW filter on device team0 [ 564.399309][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 564.419119][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 564.434587][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 564.441869][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 564.476050][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 564.486544][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 564.504200][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 564.511391][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 564.529952][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 564.545247][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 564.579859][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 564.599139][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 564.616623][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 564.665988][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 564.689103][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready 20:35:50 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:50 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', 0x0, &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:50 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x30000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:50 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 564.722667][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 564.734853][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 564.783622][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 564.800484][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 564.824688][T14858] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 564.841308][T14872] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 565.188280][T14858] 8021q: adding VLAN 0 to HW filter on device batadv0 20:35:50 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:50 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0xd, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='cpuacct.usage_sys\x00', 0x275a, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x2000002) fallocate(r1, 0x0, 0x0, 0x10fffc) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000040)={0x0, r2}) write$FUSE_NOTIFY_DELETE(r1, 0x0, 0x0) creat(&(0x7f0000000480)='./file0\x00', 0x0) 20:35:50 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:50 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', 0x0, &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:50 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x34000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:50 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 565.447950][T14892] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:50 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x400300, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:35:50 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', 0x0, 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:51 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 565.819127][ T26] audit: type=1800 audit(1567110951.170:42): pid=14891 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="cpuacct.usage_sys" dev="sda1" ino=16586 res=0 20:35:51 executing program 5: futex(&(0x7f0000000000)=0x1, 0x4, 0x0, 0x0, &(0x7f0000000080), 0x0) 20:35:51 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 566.494452][T14906] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 566.520915][T14925] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:35:51 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:35:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', 0x0, 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:51 executing program 5: clone(0x3102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x2000, 0x0) ioctl$TIOCSSERIAL(r0, 0x541f, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x2ab, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r1, &(0x7f0000006e40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 20:35:51 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:35:51 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xf0ffff, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 566.680720][T14938] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 567.760585][T14945] IPVS: ftp: loaded support on port[0] = 21 [ 567.977688][T14945] chnl_net:caif_netlink_parms(): no params data found [ 568.007369][T14945] bridge0: port 1(bridge_slave_0) entered blocking state [ 568.017130][T14945] bridge0: port 1(bridge_slave_0) entered disabled state [ 568.025147][T14945] device bridge_slave_0 entered promiscuous mode [ 568.174189][T14945] bridge0: port 2(bridge_slave_1) entered blocking state [ 568.183174][T14945] bridge0: port 2(bridge_slave_1) entered disabled state [ 568.191573][T14945] device bridge_slave_1 entered promiscuous mode [ 568.353346][T14945] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 568.365159][T14945] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 568.524962][T14945] team0: Port device team_slave_0 added [ 568.532713][T14945] team0: Port device team_slave_1 added [ 568.610112][T14945] device hsr_slave_0 entered promiscuous mode [ 568.647391][T14945] device hsr_slave_1 entered promiscuous mode [ 568.716932][T14945] debugfs: Directory 'hsr0' with parent '/' already present! [ 568.879740][T14945] bridge0: port 2(bridge_slave_1) entered blocking state [ 568.887070][T14945] bridge0: port 2(bridge_slave_1) entered forwarding state [ 568.894495][T14945] bridge0: port 1(bridge_slave_0) entered blocking state [ 568.901705][T14945] bridge0: port 1(bridge_slave_0) entered forwarding state [ 569.068093][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 569.076342][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 569.104712][T14945] 8021q: adding VLAN 0 to HW filter on device bond0 [ 569.260322][T14945] 8021q: adding VLAN 0 to HW filter on device team0 [ 569.267688][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 569.275482][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 569.286054][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 569.295965][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 569.304613][ T8922] bridge0: port 1(bridge_slave_0) entered blocking state [ 569.311896][ T8922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 569.468407][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 569.477811][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 569.486559][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 569.493798][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 569.502153][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 569.511472][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 569.520377][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 569.529751][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 569.544992][T14945] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 569.557870][T14945] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 569.570612][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 569.579037][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 569.588393][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 569.598687][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 569.607766][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 569.616093][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 569.625031][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 569.634012][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 569.643442][ T82] device bridge_slave_1 left promiscuous mode [ 569.650973][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 569.687940][ T82] device bridge_slave_0 left promiscuous mode [ 569.694601][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 569.739088][ T82] device bridge_slave_1 left promiscuous mode [ 569.745631][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 569.798161][ T82] device bridge_slave_0 left promiscuous mode [ 569.804499][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.667871][ T82] device hsr_slave_0 left promiscuous mode [ 573.717191][ T82] device hsr_slave_1 left promiscuous mode [ 573.780547][ T82] team0 (unregistering): Port device team_slave_1 removed [ 573.792515][ T82] team0 (unregistering): Port device team_slave_0 removed [ 573.806236][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 573.844360][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 573.925048][ T82] bond0 (unregistering): Released all slaves [ 574.097477][ T82] device hsr_slave_0 left promiscuous mode [ 574.147191][ T82] device hsr_slave_1 left promiscuous mode [ 574.201854][ T82] team0 (unregistering): Port device team_slave_1 removed [ 574.216221][ T82] team0 (unregistering): Port device team_slave_0 removed [ 574.230509][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 574.273671][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 574.369754][ T82] bond0 (unregistering): Released all slaves [ 574.489187][T14945] 8021q: adding VLAN 0 to HW filter on device batadv0 20:35:59 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:35:59 executing program 5: mknod(&(0x7f0000000180)='./file1\x00', 0x0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000040)='qnx4\x00', 0x0, 0x0) clone(0x1ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = msgget$private(0x0, 0x0) msgrcv(r2, 0x0, 0x0, 0x0, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, 0x0, &(0x7f0000000240)) msgctl$IPC_RMID(r2, 0x0) wait4(0x0, 0x0, 0x80000000, 0x0) 20:35:59 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:36:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', 0x0, 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x1000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xf, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 574.717761][T14963] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x2000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x10, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:01 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 575.800042][T14980] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:01 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, 0x0) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 575.972477][T15012] 9pnet_virtio: no channels available for device 127.0.0.1 [ 577.010741][T15017] IPVS: ftp: loaded support on port[0] = 21 [ 577.093400][T15017] chnl_net:caif_netlink_parms(): no params data found [ 577.125241][T15017] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.135505][T15017] bridge0: port 1(bridge_slave_0) entered disabled state [ 577.144177][T15017] device bridge_slave_0 entered promiscuous mode [ 577.152888][T15017] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.160793][T15017] bridge0: port 2(bridge_slave_1) entered disabled state [ 577.169849][T15017] device bridge_slave_1 entered promiscuous mode [ 577.192384][T15017] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 577.204298][T15017] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 577.228377][T15017] team0: Port device team_slave_0 added [ 577.236401][T15017] team0: Port device team_slave_1 added [ 577.300206][T15017] device hsr_slave_0 entered promiscuous mode [ 577.337414][T15017] device hsr_slave_1 entered promiscuous mode [ 577.387081][T15017] debugfs: Directory 'hsr0' with parent '/' already present! [ 577.403972][T15017] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.413268][T15017] bridge0: port 2(bridge_slave_1) entered forwarding state [ 577.421262][T15017] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.428686][T15017] bridge0: port 1(bridge_slave_0) entered forwarding state [ 577.468534][T15017] 8021q: adding VLAN 0 to HW filter on device bond0 [ 577.486569][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 577.496473][ T8925] bridge0: port 1(bridge_slave_0) entered disabled state [ 577.507719][ T8925] bridge0: port 2(bridge_slave_1) entered disabled state [ 577.519573][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 577.534231][T15017] 8021q: adding VLAN 0 to HW filter on device team0 [ 577.548516][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 577.558291][ T3504] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.566563][ T3504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 577.720004][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 577.730218][ T8925] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.742229][ T8925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 577.835786][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 577.847018][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 577.860381][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 577.948789][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 577.962846][T15017] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 577.977482][T15017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 577.987652][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 578.078660][T15017] 8021q: adding VLAN 0 to HW filter on device batadv0 20:36:03 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:36:03 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x12, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:03 executing program 5: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = request_key(0x0, 0x0, 0x0, 0xfffffffffffffffa) keyctl$invalidate(0x15, r0) 20:36:03 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:03 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, 0x0) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:03 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x3000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:03 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 578.469717][T15035] 9pnet_virtio: no channels available for device 127.0.0.1 20:36:04 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, 0x0) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:04 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x268, 0x0, 0x200000000000000}]}) 20:36:04 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x14, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:04 executing program 5: r0 = getpid() prctl$PR_SET_PTRACER(0x59616d61, r0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000480)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905085bf4c90ccb170e62b3a8bf5294cc377a0a96b6be0d0a17270bbce74b47874750bb7739d3d69c6", 0x3d}], 0x4, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x38) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) 20:36:04 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 578.869100][T15030] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 578.880290][T15052] 9pnet_virtio: no channels available for device 127.0.0.1 20:36:04 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:36:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x4000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:04 executing program 5: sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="5fb88c750196077aa3214bebc13f7d74ad4d9320611cf5a33f2a3f09e1c926359dcfe20001c781cb67f79cb0c6f5f4bf8ed60dce2176c22a20b22b9b24172b5569ec67906e7df93b05b19ba5360f2eab62812070fc181a2483366595113b240804d882a7dcd7ac4ba53e06d02558968b978122716d1823dcc7d40155c1bc1e8433f5ba15f5ee48c0ca941fce872e497d1377e2a5bde956f003caaf58c7520f82d7346c266e8ea70dab3bb7af6d78602a31ab8d232b07f6e3ef524b552ed88a1b1c02bc89f4f671855d40a2c1c173d4bb121bc86270c32d39c4c0d09a29b8983169914d8df86417a802b772bb638f72ccdcbb46267b5751816c77b6739f484292d5ca", 0x102, 0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x800452d3, &(0x7f0000000100)) [ 579.516360][T15065] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 579.727824][ T82] device bridge_slave_1 left promiscuous mode [ 579.735180][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 579.778393][ T82] device bridge_slave_0 left promiscuous mode [ 579.785143][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 581.777237][ T82] device hsr_slave_0 left promiscuous mode [ 581.817090][ T82] device hsr_slave_1 left promiscuous mode [ 581.899521][ T82] team0 (unregistering): Port device team_slave_1 removed [ 581.915375][ T82] team0 (unregistering): Port device team_slave_0 removed [ 581.931958][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 581.975523][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 582.049227][ T82] bond0 (unregistering): Released all slaves [ 582.146431][T15071] IPVS: ftp: loaded support on port[0] = 21 [ 582.223305][T15071] chnl_net:caif_netlink_parms(): no params data found [ 582.258129][T15071] bridge0: port 1(bridge_slave_0) entered blocking state [ 582.266077][T15071] bridge0: port 1(bridge_slave_0) entered disabled state [ 582.274853][T15071] device bridge_slave_0 entered promiscuous mode [ 582.337280][T15071] bridge0: port 2(bridge_slave_1) entered blocking state [ 582.344747][T15071] bridge0: port 2(bridge_slave_1) entered disabled state [ 582.354130][T15071] device bridge_slave_1 entered promiscuous mode [ 582.379653][T15071] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 582.392170][T15071] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 582.418711][T15071] team0: Port device team_slave_0 added [ 582.426486][T15071] team0: Port device team_slave_1 added [ 582.499874][T15071] device hsr_slave_0 entered promiscuous mode [ 582.547301][T15071] device hsr_slave_1 entered promiscuous mode [ 582.646998][T15071] debugfs: Directory 'hsr0' with parent '/' already present! [ 582.675896][T15071] bridge0: port 2(bridge_slave_1) entered blocking state [ 582.683600][T15071] bridge0: port 2(bridge_slave_1) entered forwarding state [ 582.691870][T15071] bridge0: port 1(bridge_slave_0) entered blocking state [ 582.699192][T15071] bridge0: port 1(bridge_slave_0) entered forwarding state [ 582.795984][T15071] 8021q: adding VLAN 0 to HW filter on device bond0 [ 582.832274][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 582.845679][ T8922] bridge0: port 1(bridge_slave_0) entered disabled state [ 582.864298][ T8922] bridge0: port 2(bridge_slave_1) entered disabled state [ 582.887822][T15071] 8021q: adding VLAN 0 to HW filter on device team0 [ 582.901775][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 582.911589][ T8922] bridge0: port 1(bridge_slave_0) entered blocking state [ 582.919082][ T8922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 582.938820][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 582.949212][ T8922] bridge0: port 2(bridge_slave_1) entered blocking state [ 582.956946][ T8922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 582.980027][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 582.997644][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 583.006492][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 583.019084][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 583.033713][T15071] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 583.046684][T15071] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 583.057693][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 583.084919][T15071] 8021q: adding VLAN 0 to HW filter on device batadv0 20:36:08 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:08 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:08 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:08 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x5000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:08 executing program 5: syz_mount_image$f2fs(&(0x7f0000000240)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x2000000, 0x1, &(0x7f0000000200)=[{&(0x7f00000000c0)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000016000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, 0x0) 20:36:08 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 583.299910][T15083] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:08 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x6000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:08 executing program 5: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = dup2(r0, r0) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000080)) 20:36:08 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x17, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:08 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:09 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:09 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:09 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:09 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:09 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x2, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:09 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 584.280336][T15095] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x7000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 584.507665][T15125] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 585.294206][T15131] IPVS: ftp: loaded support on port[0] = 21 [ 585.370733][T15131] chnl_net:caif_netlink_parms(): no params data found [ 585.667488][T15131] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.674898][T15131] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.683243][T15131] device bridge_slave_0 entered promiscuous mode [ 585.828592][T15131] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.835858][T15131] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.845390][T15131] device bridge_slave_1 entered promiscuous mode [ 585.864515][T15131] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 585.875934][T15131] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 586.040102][T15131] team0: Port device team_slave_0 added [ 586.048231][T15131] team0: Port device team_slave_1 added [ 586.100019][T15131] device hsr_slave_0 entered promiscuous mode [ 586.187346][T15131] device hsr_slave_1 entered promiscuous mode [ 586.237087][T15131] debugfs: Directory 'hsr0' with parent '/' already present! [ 586.389109][T15131] bridge0: port 2(bridge_slave_1) entered blocking state [ 586.396564][T15131] bridge0: port 2(bridge_slave_1) entered forwarding state [ 586.404573][T15131] bridge0: port 1(bridge_slave_0) entered blocking state [ 586.411681][T15131] bridge0: port 1(bridge_slave_0) entered forwarding state [ 586.421407][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.429886][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.611998][T15131] 8021q: adding VLAN 0 to HW filter on device bond0 [ 586.625076][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 586.634192][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 586.788907][T15131] 8021q: adding VLAN 0 to HW filter on device team0 [ 586.798719][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 586.813475][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 586.822428][T13654] bridge0: port 1(bridge_slave_0) entered blocking state [ 586.830405][T13654] bridge0: port 1(bridge_slave_0) entered forwarding state [ 586.986318][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 586.996408][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 587.005827][ T8925] bridge0: port 2(bridge_slave_1) entered blocking state [ 587.013135][ T8925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 587.169855][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 587.179848][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 587.199511][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 587.209076][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 587.218699][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 587.227799][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 587.236614][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 587.245808][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 587.254680][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 587.263156][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 587.272215][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 587.282039][T15131] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 587.445936][T15131] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 587.468793][ T82] device bridge_slave_1 left promiscuous mode [ 587.475242][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 587.538061][ T82] device bridge_slave_0 left promiscuous mode [ 587.544526][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 587.589107][ T82] device bridge_slave_1 left promiscuous mode [ 587.595485][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 587.638073][ T82] device bridge_slave_0 left promiscuous mode [ 587.644411][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 591.507573][ T82] device hsr_slave_0 left promiscuous mode [ 591.547099][ T82] device hsr_slave_1 left promiscuous mode [ 591.600227][ T82] team0 (unregistering): Port device team_slave_1 removed [ 591.614305][ T82] team0 (unregistering): Port device team_slave_0 removed [ 591.626526][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 591.661530][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 591.754549][ T82] bond0 (unregistering): Released all slaves [ 591.897952][ T82] device hsr_slave_0 left promiscuous mode [ 591.947063][ T82] device hsr_slave_1 left promiscuous mode [ 592.010303][ T82] team0 (unregistering): Port device team_slave_1 removed [ 592.024231][ T82] team0 (unregistering): Port device team_slave_0 removed [ 592.037297][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 592.064295][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 592.155808][ T82] bond0 (unregistering): Released all slaves 20:36:17 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:36:17 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x4, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:17 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xa000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:17 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:17 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:17 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x5, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 592.472499][T15145] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xc000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:18 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0xa, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:18 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:18 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0xb, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:18 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:18 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:36:18 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x14, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 593.434111][T15156] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 594.781179][T15181] IPVS: ftp: loaded support on port[0] = 21 [ 594.866323][T15181] chnl_net:caif_netlink_parms(): no params data found [ 594.926408][T15181] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.934258][T15181] bridge0: port 1(bridge_slave_0) entered disabled state [ 594.943639][T15181] device bridge_slave_0 entered promiscuous mode [ 594.953598][T15181] bridge0: port 2(bridge_slave_1) entered blocking state [ 594.962563][T15181] bridge0: port 2(bridge_slave_1) entered disabled state [ 594.973986][T15181] device bridge_slave_1 entered promiscuous mode [ 594.993266][T15181] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 595.007371][T15181] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 595.027899][T15181] team0: Port device team_slave_0 added [ 595.041491][T15181] team0: Port device team_slave_1 added [ 595.090229][T15181] device hsr_slave_0 entered promiscuous mode [ 595.137455][T15181] device hsr_slave_1 entered promiscuous mode [ 595.177111][T15181] debugfs: Directory 'hsr0' with parent '/' already present! [ 595.520825][T15184] IPVS: ftp: loaded support on port[0] = 21 [ 595.521328][T15181] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.535663][T15181] bridge0: port 2(bridge_slave_1) entered forwarding state [ 595.544082][T15181] bridge0: port 1(bridge_slave_0) entered blocking state [ 595.552105][T15181] bridge0: port 1(bridge_slave_0) entered forwarding state [ 595.911441][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 595.920186][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 596.109280][T15181] 8021q: adding VLAN 0 to HW filter on device bond0 [ 596.120854][T15184] chnl_net:caif_netlink_parms(): no params data found [ 596.305887][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 596.317804][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 596.472698][T15184] bridge0: port 1(bridge_slave_0) entered blocking state [ 596.480809][T15184] bridge0: port 1(bridge_slave_0) entered disabled state [ 596.489988][T15184] device bridge_slave_0 entered promiscuous mode [ 596.500997][T15181] 8021q: adding VLAN 0 to HW filter on device team0 [ 596.513440][T15184] bridge0: port 2(bridge_slave_1) entered blocking state [ 596.521941][T15184] bridge0: port 2(bridge_slave_1) entered disabled state [ 596.532906][T15184] device bridge_slave_1 entered promiscuous mode [ 596.562927][T15184] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 596.581829][T15184] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 596.737913][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 596.747453][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 596.757870][T13654] bridge0: port 1(bridge_slave_0) entered blocking state [ 596.765091][T13654] bridge0: port 1(bridge_slave_0) entered forwarding state [ 596.924931][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 596.940287][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 596.954030][ T8925] bridge0: port 2(bridge_slave_1) entered blocking state [ 596.961982][ T8925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 596.980283][T15184] team0: Port device team_slave_0 added [ 597.128642][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 597.158028][T15184] team0: Port device team_slave_1 added [ 597.165644][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 597.174902][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 597.184523][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 597.194797][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 597.206180][ T82] device bridge_slave_1 left promiscuous mode [ 597.215485][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 597.268277][ T82] device bridge_slave_0 left promiscuous mode [ 597.275400][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 597.309257][ T82] device bridge_slave_1 left promiscuous mode [ 597.316710][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 597.368060][ T82] device bridge_slave_0 left promiscuous mode [ 597.374960][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 601.207648][ T82] device hsr_slave_0 left promiscuous mode [ 601.256998][ T82] device hsr_slave_1 left promiscuous mode [ 601.339939][ T82] team0 (unregistering): Port device team_slave_1 removed [ 601.353818][ T82] team0 (unregistering): Port device team_slave_0 removed [ 601.365985][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 601.414068][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 601.505472][ T82] bond0 (unregistering): Released all slaves [ 601.687923][ T82] device hsr_slave_0 left promiscuous mode [ 601.737222][ T82] device hsr_slave_1 left promiscuous mode [ 601.814429][ T82] team0 (unregistering): Port device team_slave_1 removed [ 601.828026][ T82] team0 (unregistering): Port device team_slave_0 removed [ 601.839369][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 601.883837][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 601.994157][ T82] bond0 (unregistering): Released all slaves [ 602.134825][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 602.146219][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 602.162818][T15181] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 602.173777][T15181] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 602.218918][T15184] device hsr_slave_0 entered promiscuous mode [ 602.257235][T15184] device hsr_slave_1 entered promiscuous mode [ 602.307059][T15184] debugfs: Directory 'hsr0' with parent '/' already present! [ 602.314989][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 602.323616][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 602.333107][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 602.341636][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 602.368244][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 602.384511][T15181] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 602.559945][T15184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 602.581585][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 602.613644][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 602.635751][T15184] 8021q: adding VLAN 0 to HW filter on device team0 [ 602.659739][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 602.675859][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 602.690585][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.697735][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 602.739066][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 602.768153][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 602.777853][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 602.789310][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 602.797119][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 602.805394][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 602.814389][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 602.823390][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 602.832671][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 602.843511][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 602.852154][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 602.861434][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 603.269152][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 603.278212][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 603.286586][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 603.302212][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 603.314231][T15184] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 603.384017][T15184] 8021q: adding VLAN 0 to HW filter on device batadv0 20:36:29 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:29 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xe000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:29 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3fe, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:29 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:36:29 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:29 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0xf4240, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 603.750102][T15204] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xf000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:29 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:29 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:30 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:30 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 604.804492][T15216] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:30 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x10000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:30 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:30 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 605.042558][T15237] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:30 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x1e000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 605.238989][T15243] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 605.977576][T15251] IPVS: ftp: loaded support on port[0] = 21 [ 606.076626][T15251] chnl_net:caif_netlink_parms(): no params data found [ 606.592871][T15251] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.601303][T15251] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.609935][T15251] device bridge_slave_0 entered promiscuous mode [ 606.618101][T15251] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.625313][T15251] bridge0: port 2(bridge_slave_1) entered disabled state [ 606.634243][T15251] device bridge_slave_1 entered promiscuous mode [ 606.905759][T15251] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 606.917426][T15251] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 606.932610][T15254] IPVS: ftp: loaded support on port[0] = 21 [ 607.176573][T15251] team0: Port device team_slave_0 added [ 607.192174][T15251] team0: Port device team_slave_1 added [ 607.520548][T15251] device hsr_slave_0 entered promiscuous mode [ 607.577203][T15251] device hsr_slave_1 entered promiscuous mode [ 607.627122][T15251] debugfs: Directory 'hsr0' with parent '/' already present! [ 607.855932][T15256] IPVS: ftp: loaded support on port[0] = 21 [ 608.031275][ T82] bridge0: port 3(erspan0) entered disabled state [ 608.105852][ T82] device erspan0 left promiscuous mode [ 608.111607][ T82] bridge0: port 3(erspan0) entered disabled state [ 608.185170][T15254] chnl_net:caif_netlink_parms(): no params data found [ 608.659962][T15254] bridge0: port 1(bridge_slave_0) entered blocking state [ 608.668486][T15254] bridge0: port 1(bridge_slave_0) entered disabled state [ 608.676389][T15254] device bridge_slave_0 entered promiscuous mode [ 608.684736][T15254] bridge0: port 2(bridge_slave_1) entered blocking state [ 608.692534][T15254] bridge0: port 2(bridge_slave_1) entered disabled state [ 608.702014][T15254] device bridge_slave_1 entered promiscuous mode [ 608.948498][T15254] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 608.961322][T15254] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 608.993699][T15254] team0: Port device team_slave_0 added [ 609.010540][T15254] team0: Port device team_slave_1 added [ 609.106359][T15251] 8021q: adding VLAN 0 to HW filter on device bond0 [ 609.119067][T15256] chnl_net:caif_netlink_parms(): no params data found [ 609.180166][T15254] device hsr_slave_0 entered promiscuous mode [ 609.227503][T15254] device hsr_slave_1 entered promiscuous mode [ 609.267056][T15254] debugfs: Directory 'hsr0' with parent '/' already present! [ 609.374323][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 609.384096][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 609.442588][T15256] bridge0: port 1(bridge_slave_0) entered blocking state [ 609.450751][T15256] bridge0: port 1(bridge_slave_0) entered disabled state [ 609.459199][T15256] device bridge_slave_0 entered promiscuous mode [ 609.468266][T15256] bridge0: port 2(bridge_slave_1) entered blocking state [ 609.475562][T15256] bridge0: port 2(bridge_slave_1) entered disabled state [ 609.485016][T15256] device bridge_slave_1 entered promiscuous mode [ 609.504178][T15256] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 609.516361][T15251] 8021q: adding VLAN 0 to HW filter on device team0 [ 609.530151][T15256] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 609.590754][ T82] device bridge_slave_1 left promiscuous mode [ 609.597581][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 609.658376][ T82] device bridge_slave_0 left promiscuous mode [ 609.665082][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 609.719772][ T82] device bridge_slave_1 left promiscuous mode [ 609.726007][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 609.769545][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 609.838302][ T82] device bridge_slave_1 left promiscuous mode [ 609.844764][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 609.907681][ T82] device bridge_slave_0 left promiscuous mode [ 609.914001][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 615.827381][ T82] device hsr_slave_0 left promiscuous mode [ 615.867118][ T82] device hsr_slave_1 left promiscuous mode [ 615.921154][ T82] team0 (unregistering): Port device team_slave_1 removed [ 615.936933][ T82] team0 (unregistering): Port device team_slave_0 removed [ 615.949170][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 616.013362][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 616.085914][ T82] bond0 (unregistering): Released all slaves [ 616.327351][ T82] device hsr_slave_0 left promiscuous mode [ 616.367123][ T82] device hsr_slave_1 left promiscuous mode [ 616.419455][ T82] team0 (unregistering): Port device team_slave_1 removed [ 616.433217][ T82] team0 (unregistering): Port device team_slave_0 removed [ 616.444822][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 616.494042][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 616.587089][ T82] bond0 (unregistering): Released all slaves [ 616.727851][ T82] device hsr_slave_0 left promiscuous mode [ 616.777020][ T82] device hsr_slave_1 left promiscuous mode [ 616.841486][ T82] team0 (unregistering): Port device team_slave_1 removed [ 616.855891][ T82] team0 (unregistering): Port device team_slave_0 removed [ 616.869178][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 616.931362][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 617.035741][ T82] bond0 (unregistering): Released all slaves [ 617.111823][T15256] team0: Port device team_slave_0 added [ 617.120355][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 617.129266][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 617.138083][T12956] bridge0: port 1(bridge_slave_0) entered blocking state [ 617.145128][T12956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 617.153360][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 617.170831][T15256] team0: Port device team_slave_1 added [ 617.184631][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 617.193878][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 617.202759][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 617.210233][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 617.218883][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 617.252664][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 617.262726][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 617.271684][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 617.281658][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 617.291068][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 617.302465][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 617.378851][T15256] device hsr_slave_0 entered promiscuous mode [ 617.437275][T15256] device hsr_slave_1 entered promiscuous mode [ 617.477051][T15256] debugfs: Directory 'hsr0' with parent '/' already present! [ 617.509442][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 617.518505][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 617.528859][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 617.537623][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 617.552173][T15251] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 617.606614][T15256] 8021q: adding VLAN 0 to HW filter on device bond0 [ 617.630003][T15251] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 617.642872][T15256] 8021q: adding VLAN 0 to HW filter on device team0 [ 617.664478][T15254] 8021q: adding VLAN 0 to HW filter on device bond0 [ 617.671737][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 617.681125][T13654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 617.708643][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 617.717991][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 617.726396][T12955] bridge0: port 1(bridge_slave_0) entered blocking state [ 617.734084][T12955] bridge0: port 1(bridge_slave_0) entered forwarding state [ 617.743206][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 617.752741][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 617.761808][T12955] bridge0: port 2(bridge_slave_1) entered blocking state [ 617.769279][T12955] bridge0: port 2(bridge_slave_1) entered forwarding state [ 617.777106][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 617.786331][T12955] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 617.873921][T15254] 8021q: adding VLAN 0 to HW filter on device team0 [ 617.903231][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 617.912677][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 617.921260][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 20:36:43 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 618.062873][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 618.086440][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 618.124559][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 618.144442][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 618.154027][T13430] bridge0: port 1(bridge_slave_0) entered blocking state [ 618.161368][T13430] bridge0: port 1(bridge_slave_0) entered forwarding state [ 618.177291][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 618.186321][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 618.195876][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 618.206498][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 618.222651][T13430] bridge0: port 2(bridge_slave_1) entered blocking state [ 618.229961][T13430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 618.239040][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 618.247551][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 618.258597][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 618.266441][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 618.275469][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 618.290396][T15256] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 618.322073][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 618.333785][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 618.352267][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 618.363508][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 618.372812][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 618.382161][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 618.392047][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 618.815144][T15254] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 618.826104][T15254] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 618.863477][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 618.872201][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 618.891388][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 618.901044][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 618.918355][T15256] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 618.959816][T15254] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 618.983415][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 20:36:44 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:44 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x20000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:44 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:44 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0x18, 0x0, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:44 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:36:44 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 619.348446][T15285] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:44 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x2, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:44 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:44 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x3f000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:45 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x3, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:45 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:45 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:46 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:46 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x5, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:46 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:46 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 620.657292][T15299] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 621.492292][T15332] IPVS: ftp: loaded support on port[0] = 21 [ 621.557926][T15332] chnl_net:caif_netlink_parms(): no params data found [ 621.587626][T15332] bridge0: port 1(bridge_slave_0) entered blocking state [ 621.595079][T15332] bridge0: port 1(bridge_slave_0) entered disabled state [ 621.603584][T15332] device bridge_slave_0 entered promiscuous mode [ 621.611502][T15332] bridge0: port 2(bridge_slave_1) entered blocking state [ 621.619147][T15332] bridge0: port 2(bridge_slave_1) entered disabled state [ 621.627404][T15332] device bridge_slave_1 entered promiscuous mode [ 622.056090][T15332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 622.071606][T15332] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 622.091280][T15332] team0: Port device team_slave_0 added [ 622.099291][T15332] team0: Port device team_slave_1 added [ 622.369447][T15332] device hsr_slave_0 entered promiscuous mode [ 622.447391][T15332] device hsr_slave_1 entered promiscuous mode [ 622.486953][T15332] debugfs: Directory 'hsr0' with parent '/' already present! [ 622.953980][T15332] 8021q: adding VLAN 0 to HW filter on device bond0 [ 622.970803][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 622.979806][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 622.990892][T15332] 8021q: adding VLAN 0 to HW filter on device team0 [ 623.004321][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 623.013751][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 623.023126][ T8922] bridge0: port 1(bridge_slave_0) entered blocking state [ 623.031104][ T8922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 623.040806][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 623.261073][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 623.271462][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 623.280922][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 623.289899][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 623.298920][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 623.516938][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 623.525839][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 623.535353][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 623.544602][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 623.763658][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 623.774097][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 623.991927][T15332] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 624.003191][T15332] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 624.016165][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 624.025116][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 624.034095][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 624.043332][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 624.262163][T15332] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 624.269850][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 624.298971][ T82] device bridge_slave_1 left promiscuous mode [ 624.305205][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 624.358169][ T82] device bridge_slave_0 left promiscuous mode [ 624.364556][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 624.438375][ T82] device bridge_slave_1 left promiscuous mode [ 624.444702][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 624.507780][ T82] device bridge_slave_0 left promiscuous mode [ 624.514218][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 624.578899][ T82] device bridge_slave_1 left promiscuous mode [ 624.585842][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 624.628113][ T82] device bridge_slave_0 left promiscuous mode [ 624.634302][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 630.178120][ T82] device hsr_slave_0 left promiscuous mode [ 630.217152][ T82] device hsr_slave_1 left promiscuous mode [ 630.266597][ T82] team0 (unregistering): Port device team_slave_1 removed [ 630.280928][ T82] team0 (unregistering): Port device team_slave_0 removed [ 630.293609][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 630.333649][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 630.426593][ T82] bond0 (unregistering): Released all slaves [ 630.607644][ T82] device hsr_slave_0 left promiscuous mode [ 630.647038][ T82] device hsr_slave_1 left promiscuous mode [ 630.705098][ T82] team0 (unregistering): Port device team_slave_1 removed [ 630.719213][ T82] team0 (unregistering): Port device team_slave_0 removed [ 630.730331][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 630.770592][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 630.853267][ T82] bond0 (unregistering): Released all slaves [ 630.977852][ T82] device hsr_slave_0 left promiscuous mode [ 631.017081][ T82] device hsr_slave_1 left promiscuous mode [ 631.069559][ T82] team0 (unregistering): Port device team_slave_1 removed [ 631.083452][ T82] team0 (unregistering): Port device team_slave_0 removed [ 631.095762][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 631.132035][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 631.224026][ T82] bond0 (unregistering): Released all slaves 20:36:56 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:36:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x40000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:56 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:56 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:56 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x6, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:56 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 631.510330][T15343] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x48000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:36:56 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x7, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:57 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:36:57 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0xa, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:57 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x10, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:36:57 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 632.563360][T15353] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:36:57 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:36:57 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x48, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 633.604915][T15383] IPVS: ftp: loaded support on port[0] = 21 [ 633.737982][T15383] chnl_net:caif_netlink_parms(): no params data found [ 633.796050][T15383] bridge0: port 1(bridge_slave_0) entered blocking state [ 633.805090][T15383] bridge0: port 1(bridge_slave_0) entered disabled state [ 633.818938][T15383] device bridge_slave_0 entered promiscuous mode [ 633.832070][T15383] bridge0: port 2(bridge_slave_1) entered blocking state [ 633.840860][T15383] bridge0: port 2(bridge_slave_1) entered disabled state [ 633.853518][T15383] device bridge_slave_1 entered promiscuous mode [ 633.892003][T15383] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 633.904578][T15383] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 633.936656][T15383] team0: Port device team_slave_0 added [ 633.951063][T15383] team0: Port device team_slave_1 added [ 634.009415][T15383] device hsr_slave_0 entered promiscuous mode [ 634.047286][T15383] device hsr_slave_1 entered promiscuous mode [ 634.086994][T15383] debugfs: Directory 'hsr0' with parent '/' already present! [ 634.104088][T15383] bridge0: port 2(bridge_slave_1) entered blocking state [ 634.111813][T15383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 634.119260][T15383] bridge0: port 1(bridge_slave_0) entered blocking state [ 634.126486][T15383] bridge0: port 1(bridge_slave_0) entered forwarding state [ 634.168215][T15383] 8021q: adding VLAN 0 to HW filter on device bond0 [ 634.182720][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 634.192050][T13198] bridge0: port 1(bridge_slave_0) entered disabled state [ 634.200840][T13198] bridge0: port 2(bridge_slave_1) entered disabled state [ 634.217686][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 634.236445][T15383] 8021q: adding VLAN 0 to HW filter on device team0 [ 634.255098][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 634.264578][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 634.271984][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 634.304409][T15386] IPVS: ftp: loaded support on port[0] = 21 [ 634.305276][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 634.324668][ T8919] bridge0: port 2(bridge_slave_1) entered blocking state [ 634.331822][ T8919] bridge0: port 2(bridge_slave_1) entered forwarding state [ 634.364248][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 634.375107][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 634.390749][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 634.413272][T15383] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 634.424755][T15383] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 634.444204][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 634.452781][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 634.478956][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 634.494335][T15383] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 634.683723][T15386] chnl_net:caif_netlink_parms(): no params data found [ 634.828744][T15386] bridge0: port 1(bridge_slave_0) entered blocking state [ 634.842706][T15386] bridge0: port 1(bridge_slave_0) entered disabled state [ 634.851058][T15386] device bridge_slave_0 entered promiscuous mode [ 634.859490][T15386] bridge0: port 2(bridge_slave_1) entered blocking state [ 634.866587][T15386] bridge0: port 2(bridge_slave_1) entered disabled state [ 634.875275][T15386] device bridge_slave_1 entered promiscuous mode [ 634.986610][T15386] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 634.998571][T15386] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 635.021673][T15386] team0: Port device team_slave_0 added [ 635.194247][T15386] team0: Port device team_slave_1 added [ 635.340294][T15386] device hsr_slave_0 entered promiscuous mode [ 635.387226][T15386] device hsr_slave_1 entered promiscuous mode [ 635.437049][T15386] debugfs: Directory 'hsr0' with parent '/' already present! [ 635.520239][T15386] bridge0: port 2(bridge_slave_1) entered blocking state [ 635.527940][T15386] bridge0: port 2(bridge_slave_1) entered forwarding state [ 635.637640][T15386] 8021q: adding VLAN 0 to HW filter on device bond0 [ 635.649488][ T8919] bridge0: port 2(bridge_slave_1) entered disabled state [ 635.659582][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 635.670218][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 635.678473][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 635.760543][T15386] 8021q: adding VLAN 0 to HW filter on device team0 [ 635.776585][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 635.786122][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 635.794832][T12956] bridge0: port 1(bridge_slave_0) entered blocking state [ 635.802190][T12956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 635.888317][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 635.897846][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 635.906484][ T8922] bridge0: port 2(bridge_slave_1) entered blocking state [ 635.913823][ T8922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 635.922892][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 635.932422][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 636.023638][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 636.033363][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 636.042295][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 636.051847][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 636.061258][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 636.073085][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 636.082258][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 636.094823][T15386] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 636.107605][T15386] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 636.116291][ T82] device bridge_slave_1 left promiscuous mode [ 636.123521][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 636.178024][ T82] device bridge_slave_0 left promiscuous mode [ 636.184452][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 638.038199][ T82] device hsr_slave_0 left promiscuous mode [ 638.077290][ T82] device hsr_slave_1 left promiscuous mode [ 638.127620][ T82] team0 (unregistering): Port device team_slave_1 removed [ 638.141245][ T82] team0 (unregistering): Port device team_slave_0 removed [ 638.153662][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 638.213751][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 638.314885][ T82] bond0 (unregistering): Released all slaves [ 638.402291][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 638.411648][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 638.446183][T15386] 8021q: adding VLAN 0 to HW filter on device batadv0 20:37:04 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:04 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x4c000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:04 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:04 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:04 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4c, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 638.810443][T15406] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:04 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x68, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x60000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:04 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:04 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x6c, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:04 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x74, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:04 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 639.876097][T15418] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:05 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:05 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x7a, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:05 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 640.976911][T15452] IPVS: ftp: loaded support on port[0] = 21 [ 641.091048][T15452] chnl_net:caif_netlink_parms(): no params data found [ 641.119888][T15452] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.127214][T15452] bridge0: port 1(bridge_slave_0) entered disabled state [ 641.135318][T15452] device bridge_slave_0 entered promiscuous mode [ 641.143610][T15452] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.154405][T15452] bridge0: port 2(bridge_slave_1) entered disabled state [ 641.162784][T15452] device bridge_slave_1 entered promiscuous mode [ 641.180724][T15452] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 641.191892][T15452] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 641.211487][T15452] team0: Port device team_slave_0 added [ 641.218853][T15452] team0: Port device team_slave_1 added [ 641.281981][T15452] device hsr_slave_0 entered promiscuous mode [ 641.327464][T15452] device hsr_slave_1 entered promiscuous mode [ 641.376918][T15452] debugfs: Directory 'hsr0' with parent '/' already present! [ 641.696565][T15452] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.703998][T15452] bridge0: port 2(bridge_slave_1) entered forwarding state [ 641.711488][T15452] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.714531][T15455] IPVS: ftp: loaded support on port[0] = 21 [ 641.718686][T15452] bridge0: port 1(bridge_slave_0) entered forwarding state [ 641.933128][T15452] 8021q: adding VLAN 0 to HW filter on device bond0 [ 642.125098][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 642.138362][ T8922] bridge0: port 1(bridge_slave_0) entered disabled state [ 642.146584][ T8922] bridge0: port 2(bridge_slave_1) entered disabled state [ 642.158173][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 642.171767][T15452] 8021q: adding VLAN 0 to HW filter on device team0 [ 642.181737][T15455] chnl_net:caif_netlink_parms(): no params data found [ 642.332688][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 642.342229][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 642.351430][T12956] bridge0: port 1(bridge_slave_0) entered blocking state [ 642.358531][T12956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 642.390268][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 642.403469][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 642.412519][T13430] bridge0: port 2(bridge_slave_1) entered blocking state [ 642.419890][T13430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 642.428445][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 642.595327][T15455] bridge0: port 1(bridge_slave_0) entered blocking state [ 642.603103][T15455] bridge0: port 1(bridge_slave_0) entered disabled state [ 642.611508][T15455] device bridge_slave_0 entered promiscuous mode [ 642.619991][T15455] bridge0: port 2(bridge_slave_1) entered blocking state [ 642.627605][T15455] bridge0: port 2(bridge_slave_1) entered disabled state [ 642.635653][T15455] device bridge_slave_1 entered promiscuous mode [ 642.643359][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 642.814127][T15455] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 642.828780][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 642.839871][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 642.849527][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 642.858584][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 642.868610][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 642.881515][T15455] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 643.036252][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 643.045884][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 643.058187][T15452] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 643.071472][T15452] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 643.086275][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 643.095234][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 643.111650][T15455] team0: Port device team_slave_0 added [ 643.119228][T15455] team0: Port device team_slave_1 added [ 643.318922][T15455] device hsr_slave_0 entered promiscuous mode [ 643.367515][T15455] device hsr_slave_1 entered promiscuous mode [ 643.407462][T15455] debugfs: Directory 'hsr0' with parent '/' already present! [ 643.417286][T15452] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 643.620639][ T82] device bridge_slave_1 left promiscuous mode [ 643.627823][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 643.648776][ T82] device bridge_slave_0 left promiscuous mode [ 643.655039][ T82] bridge0: port 1(bridge_slave_0) entered disabled state 20:37:09 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 643.709362][ T82] device bridge_slave_1 left promiscuous mode [ 643.715617][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 643.769824][ T82] device bridge_slave_0 left promiscuous mode [ 643.776817][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 647.507499][ T82] device hsr_slave_0 left promiscuous mode [ 647.546949][ T82] device hsr_slave_1 left promiscuous mode [ 647.607710][ T82] team0 (unregistering): Port device team_slave_1 removed [ 647.620787][ T82] team0 (unregistering): Port device team_slave_0 removed [ 647.633627][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 647.701590][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 647.774369][ T82] bond0 (unregistering): Released all slaves [ 647.927753][ T82] device hsr_slave_0 left promiscuous mode [ 647.977066][ T82] device hsr_slave_1 left promiscuous mode [ 648.038205][ T82] team0 (unregistering): Port device team_slave_1 removed [ 648.051546][ T82] team0 (unregistering): Port device team_slave_0 removed [ 648.064841][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 648.091875][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 648.204513][ T82] bond0 (unregistering): Released all slaves [ 648.304850][T15455] 8021q: adding VLAN 0 to HW filter on device bond0 [ 648.502699][T15455] 8021q: adding VLAN 0 to HW filter on device team0 [ 648.513383][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 648.521581][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 648.553947][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 648.563358][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 648.572287][T13198] bridge0: port 1(bridge_slave_0) entered blocking state [ 648.579431][T13198] bridge0: port 1(bridge_slave_0) entered forwarding state [ 648.588045][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 648.598904][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 648.612094][T13198] bridge0: port 2(bridge_slave_1) entered blocking state [ 648.619423][T13198] bridge0: port 2(bridge_slave_1) entered forwarding state [ 648.627713][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 648.636285][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 648.660953][T15455] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 648.672007][T15455] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 648.684706][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 648.693698][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 648.702826][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 648.711633][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 648.721985][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 648.731357][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 648.740033][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 648.748954][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 648.757897][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 648.766525][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 648.774789][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 648.897353][T15455] 8021q: adding VLAN 0 to HW filter on device batadv0 20:37:14 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:14 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x65580000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:14 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(0x0, &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:14 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:14 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:14 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x251, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 649.289408][T15476] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:14 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x300, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:14 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x68000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:14 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 20:37:14 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x500, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:15 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x600, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:15 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 20:37:15 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) socket$inet(0x2b, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:15 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x700, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 650.238631][T15486] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 651.584710][T15513] IPVS: ftp: loaded support on port[0] = 21 [ 651.664030][T15513] chnl_net:caif_netlink_parms(): no params data found [ 651.959118][T15513] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.966578][T15513] bridge0: port 1(bridge_slave_0) entered disabled state [ 651.974939][T15513] device bridge_slave_0 entered promiscuous mode [ 651.982814][T15513] bridge0: port 2(bridge_slave_1) entered blocking state [ 651.990274][T15513] bridge0: port 2(bridge_slave_1) entered disabled state [ 651.998875][T15513] device bridge_slave_1 entered promiscuous mode [ 652.193496][T15513] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 652.205468][T15513] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 652.229309][T15513] team0: Port device team_slave_0 added [ 652.236247][T15513] team0: Port device team_slave_1 added [ 652.381202][T15516] IPVS: ftp: loaded support on port[0] = 21 [ 652.429389][T15513] device hsr_slave_0 entered promiscuous mode [ 652.467321][T15513] device hsr_slave_1 entered promiscuous mode [ 652.537024][T15513] debugfs: Directory 'hsr0' with parent '/' already present! [ 652.915971][T15516] chnl_net:caif_netlink_parms(): no params data found [ 652.956438][T15516] bridge0: port 1(bridge_slave_0) entered blocking state [ 652.964489][T15516] bridge0: port 1(bridge_slave_0) entered disabled state [ 652.973077][T15516] device bridge_slave_0 entered promiscuous mode [ 652.982781][T15516] bridge0: port 2(bridge_slave_1) entered blocking state [ 652.990366][T15516] bridge0: port 2(bridge_slave_1) entered disabled state [ 652.998740][T15516] device bridge_slave_1 entered promiscuous mode [ 653.164095][T15516] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 653.177513][T15516] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 653.351061][T15513] 8021q: adding VLAN 0 to HW filter on device bond0 [ 653.360245][T15516] team0: Port device team_slave_0 added [ 653.505107][T15516] team0: Port device team_slave_1 added [ 653.522272][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 653.530027][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 653.541766][T15513] 8021q: adding VLAN 0 to HW filter on device team0 [ 653.740510][T15516] device hsr_slave_0 entered promiscuous mode [ 653.797386][T15516] device hsr_slave_1 entered promiscuous mode [ 653.841053][T15516] debugfs: Directory 'hsr0' with parent '/' already present! [ 653.848985][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 653.857707][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 653.866484][T13430] bridge0: port 1(bridge_slave_0) entered blocking state [ 653.873590][T13430] bridge0: port 1(bridge_slave_0) entered forwarding state [ 653.884487][ T82] device bridge_slave_1 left promiscuous mode [ 653.892715][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 653.937679][ T82] device bridge_slave_0 left promiscuous mode [ 653.944072][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 653.999177][ T82] device bridge_slave_1 left promiscuous mode [ 654.005538][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 654.068327][ T82] device bridge_slave_0 left promiscuous mode [ 654.074719][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 657.787540][ T82] device hsr_slave_0 left promiscuous mode [ 657.827054][ T82] device hsr_slave_1 left promiscuous mode [ 657.898989][ T82] team0 (unregistering): Port device team_slave_1 removed [ 657.910650][ T82] team0 (unregistering): Port device team_slave_0 removed [ 657.924114][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 657.991257][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 658.103675][ T82] bond0 (unregistering): Released all slaves [ 658.257645][ T82] device hsr_slave_0 left promiscuous mode [ 658.297131][ T82] device hsr_slave_1 left promiscuous mode [ 658.354536][ T82] team0 (unregistering): Port device team_slave_1 removed [ 658.369385][ T82] team0 (unregistering): Port device team_slave_0 removed [ 658.382798][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 658.425272][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 658.534740][ T82] bond0 (unregistering): Released all slaves [ 658.630589][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 658.638764][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 658.648124][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 658.656877][T13430] bridge0: port 2(bridge_slave_1) entered blocking state [ 658.664173][T13430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 658.672913][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 658.687332][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 658.709839][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 658.719762][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 658.730595][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 658.743689][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 658.752907][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 658.762537][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 658.771600][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 658.783559][T15513] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 658.795553][T15513] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 658.812528][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 658.821420][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 658.865068][T15516] 8021q: adding VLAN 0 to HW filter on device bond0 [ 658.883681][T15516] 8021q: adding VLAN 0 to HW filter on device team0 [ 658.891633][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 658.900743][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 658.988387][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 659.000544][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 659.009616][T13430] bridge0: port 1(bridge_slave_0) entered blocking state [ 659.017027][T13430] bridge0: port 1(bridge_slave_0) entered forwarding state [ 659.025557][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 659.034656][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 659.043769][T13430] bridge0: port 2(bridge_slave_1) entered blocking state [ 659.051026][T13430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 659.059470][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 659.068448][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 659.134691][T15513] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 659.142252][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 659.151587][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 659.161446][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 659.180860][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 659.194435][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 659.210755][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 659.220038][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 659.229427][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 659.238860][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 659.248053][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 659.260033][T15516] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 659.294278][T15516] 8021q: adding VLAN 0 to HW filter on device batadv0 20:37:24 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(0x0, &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:24 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x0, &(0x7f0000000580)={'trans=rdma,', {'port'}, 0x2c, {[{@rq={'rq'}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 20:37:24 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0xa00, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x6c000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:24 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) socket$inet(0x2b, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:24 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 659.618240][T15537] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:25 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x2000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:25 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x74000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:25 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:25 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xf, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:25 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_sco(r0, &(0x7f0000000040), 0x8) listen(r0, 0x0) 20:37:25 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4800, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 660.874007][T15547] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:26 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(0x0, &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:26 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4c00, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:26 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) sendmmsg$inet(r0, &(0x7f00000033c0)=[{{&(0x7f0000000080)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10, 0x0}}, {{&(0x7f0000000840)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_tos_int={{0x10, 0x0, 0x1, 0x8000}}], 0x10}}], 0x2, 0x0) 20:37:26 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 661.799765][T15572] IPVS: ftp: loaded support on port[0] = 21 [ 661.923619][T15572] chnl_net:caif_netlink_parms(): no params data found [ 661.953849][T15572] bridge0: port 1(bridge_slave_0) entered blocking state [ 661.961586][T15572] bridge0: port 1(bridge_slave_0) entered disabled state [ 661.969891][T15572] device bridge_slave_0 entered promiscuous mode [ 661.979025][T15572] bridge0: port 2(bridge_slave_1) entered blocking state [ 661.986272][T15572] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.994461][T15572] device bridge_slave_1 entered promiscuous mode [ 662.015878][T15572] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 662.029788][T15572] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 662.052587][T15572] team0: Port device team_slave_0 added [ 662.060168][T15572] team0: Port device team_slave_1 added [ 662.130448][T15572] device hsr_slave_0 entered promiscuous mode [ 662.207353][T15572] device hsr_slave_1 entered promiscuous mode [ 662.297903][T15572] debugfs: Directory 'hsr0' with parent '/' already present! [ 662.573553][T15572] bridge0: port 2(bridge_slave_1) entered blocking state [ 662.580889][T15572] bridge0: port 2(bridge_slave_1) entered forwarding state [ 662.588568][T15572] bridge0: port 1(bridge_slave_0) entered blocking state [ 662.595819][T15572] bridge0: port 1(bridge_slave_0) entered forwarding state [ 662.634669][T15572] 8021q: adding VLAN 0 to HW filter on device bond0 [ 662.782817][T15572] 8021q: adding VLAN 0 to HW filter on device team0 [ 662.791372][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 662.800668][ T9002] bridge0: port 1(bridge_slave_0) entered disabled state [ 662.814279][ T9002] bridge0: port 2(bridge_slave_1) entered disabled state [ 662.823982][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 662.977724][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 662.986651][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 662.995331][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 663.003593][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 663.012515][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 663.019983][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 663.167804][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 663.179098][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 663.196554][T15572] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 663.208939][T15572] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 663.221205][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 663.230643][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 663.240157][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 663.249943][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 663.258779][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 663.267433][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 663.275805][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 663.284248][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 663.293120][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 663.301248][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 663.465829][T15572] 8021q: adding VLAN 0 to HW filter on device batadv0 20:37:29 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) socket$inet(0x2b, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x7a000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:29 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x5102, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:29 executing program 1: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$P9_ROPEN(r0, &(0x7f0000000180)={0x18}, 0x18) 20:37:29 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:29 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 663.903947][T15582] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:29 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='veth0_to_bond\x00', 0x10) sendto$inet(r0, &(0x7f0000000040)="ba", 0x1, 0x0, 0x0, 0x0) 20:37:29 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x60ff, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:29 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x81000000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 664.064413][T15591] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 20:37:29 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x6800, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:29 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000300)={{{@in=@remote, @in6=@initdev}}, {{@in6=@mcast1}, 0x0, @in6=@initdev}}, &(0x7f0000000040)=0xe8) recvmmsg(r1, &(0x7f00000073c0)=[{{&(0x7f0000000180)=@l2, 0x80, &(0x7f0000000280)=[{&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/179, 0xb3}, {&(0x7f0000000100)=""/23, 0x17}], 0x3, &(0x7f00000014c0)=""/220, 0xdc}, 0x3}, {{&(0x7f00000015c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000001d00)=[{&(0x7f0000001640)=""/106, 0x6a}, {&(0x7f00000016c0)=""/112, 0x70}, {&(0x7f0000001740)=""/223, 0xdf}, {&(0x7f0000001840)=""/156, 0x9c}, {&(0x7f0000001900)=""/177, 0xb1}, {&(0x7f00000019c0)=""/233, 0xe9}, {&(0x7f0000001ac0)=""/245, 0xf5}, {&(0x7f0000001bc0)=""/226, 0xe2}, {&(0x7f0000001cc0)=""/10, 0xa}], 0x9, &(0x7f0000001dc0)=""/51, 0x33}, 0x16e9}, {{&(0x7f0000001e00)=@in6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f00000040c0)=[{&(0x7f0000001e80)=""/4096, 0x1000}, {&(0x7f0000002e80)=""/21, 0x15}, {&(0x7f0000002ec0)=""/201, 0xc9}, {&(0x7f0000002fc0)=""/187, 0xbb}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000004080)=""/46, 0x2e}], 0x6, &(0x7f0000004140)=""/9, 0x9}, 0x4}, {{&(0x7f0000004180)=@pppol2tp, 0x80, &(0x7f0000004480)=[{&(0x7f0000004200)=""/100, 0x64}, {&(0x7f0000004280)=""/245, 0xf5}, {&(0x7f0000004380)=""/245, 0xf5}], 0x3, &(0x7f00000044c0)=""/176, 0xb0}, 0xffffffffffff0001}, {{&(0x7f0000004580)=@nfc_llcp, 0x80, &(0x7f0000004640)=[{&(0x7f0000004600)=""/38, 0x26}], 0x1, &(0x7f0000004680)=""/125, 0x7d}, 0x20}, {{&(0x7f0000004700)=@caif, 0x80, &(0x7f0000005bc0)=[{&(0x7f0000004780)=""/227, 0xe3}, {&(0x7f0000004880)=""/195, 0xc3}, {&(0x7f0000004980)=""/23, 0x17}, {&(0x7f00000049c0)=""/159, 0x9f}, {&(0x7f0000004a80)=""/78, 0x4e}, {&(0x7f0000004b00)=""/4096, 0x1000}, {&(0x7f0000005b00)=""/190, 0xbe}], 0x7, &(0x7f0000005c40)=""/130, 0x82}, 0xb}, {{0x0, 0x0, &(0x7f0000005d80)=[{&(0x7f0000005d00)=""/88, 0x58}], 0x1}, 0xcaf}, {{&(0x7f0000005dc0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000007200)=[{&(0x7f0000005e40)=""/176, 0xb0}, {&(0x7f0000005f00)=""/4096, 0x1000}, {&(0x7f0000006f00)=""/24, 0x18}, {&(0x7f0000006f40)=""/5, 0x5}, {&(0x7f0000006f80)=""/53, 0x35}, {&(0x7f0000006fc0)=""/129, 0x81}, {&(0x7f0000007080)}, {&(0x7f00000070c0)=""/74, 0x4a}, {&(0x7f0000007140)=""/166, 0xa6}], 0x9, &(0x7f00000072c0)=""/212, 0xd4}}], 0x8, 0x100, &(0x7f00000075c0)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv0\x02\x00', r2}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000200)={@mcast1, @dev, @mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3}) socket$inet6(0xa, 0x2, 0xfffffffffffff544) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000080)={@mcast1, @rand_addr="e4e19a5c10c9332dc4b500fa97eeb441", @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3}) 20:37:29 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x6c00, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 664.596860][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 664.602774][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 664.845191][T15596] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:30 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:30 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x7400, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:30 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x88a8ffff, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:30 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x200001000008912, &(0x7f0000000040)="11dca5055e0bcfce7bf070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000040)={0x0, r3}) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x1}) [ 665.251243][T15620] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 665.288241][ T82] device bridge_slave_1 left promiscuous mode [ 665.296984][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.387981][ T82] device bridge_slave_0 left promiscuous mode [ 665.404571][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 665.469147][ T82] device bridge_slave_1 left promiscuous mode [ 665.475560][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.527868][ T82] device bridge_slave_0 left promiscuous mode [ 665.539339][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 669.377481][ T82] device hsr_slave_0 left promiscuous mode [ 669.417014][ T82] device hsr_slave_1 left promiscuous mode [ 669.468602][ T82] team0 (unregistering): Port device team_slave_1 removed [ 669.482245][ T82] team0 (unregistering): Port device team_slave_0 removed [ 669.494495][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 669.531523][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 669.622049][ T82] bond0 (unregistering): Released all slaves [ 669.767748][ T82] device hsr_slave_0 left promiscuous mode [ 669.807051][ T82] device hsr_slave_1 left promiscuous mode [ 669.857695][ T82] team0 (unregistering): Port device team_slave_1 removed [ 669.870491][ T82] team0 (unregistering): Port device team_slave_0 removed [ 669.882081][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 669.931288][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 670.012643][ T82] bond0 (unregistering): Released all slaves [ 670.176579][T15632] IPVS: ftp: loaded support on port[0] = 21 [ 670.189716][T15628] IPVS: ftp: loaded support on port[0] = 21 [ 670.316587][T15632] chnl_net:caif_netlink_parms(): no params data found [ 670.491218][T15632] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.498892][T15632] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.507454][T15632] device bridge_slave_0 entered promiscuous mode [ 670.517788][T15632] bridge0: port 2(bridge_slave_1) entered blocking state [ 670.524869][T15632] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.534398][T15632] device bridge_slave_1 entered promiscuous mode [ 670.542412][T15628] chnl_net:caif_netlink_parms(): no params data found [ 670.589672][T15632] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 670.608478][T15632] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 670.641712][T15628] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.654404][T15628] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.664512][T15628] device bridge_slave_0 entered promiscuous mode [ 670.681203][T15632] team0: Port device team_slave_0 added [ 670.689328][T15632] team0: Port device team_slave_1 added [ 670.695230][T15628] bridge0: port 2(bridge_slave_1) entered blocking state [ 670.703763][T15628] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.718523][T15628] device bridge_slave_1 entered promiscuous mode [ 670.761226][T15628] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 670.829782][T15632] device hsr_slave_0 entered promiscuous mode [ 670.867276][T15632] device hsr_slave_1 entered promiscuous mode [ 670.921110][T15632] debugfs: Directory 'hsr0' with parent '/' already present! [ 670.933071][T15628] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 670.965917][T15628] team0: Port device team_slave_0 added [ 670.974028][T15632] bridge0: port 2(bridge_slave_1) entered blocking state [ 670.981281][T15632] bridge0: port 2(bridge_slave_1) entered forwarding state [ 670.988917][T15632] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.995995][T15632] bridge0: port 1(bridge_slave_0) entered forwarding state [ 671.021319][T15628] team0: Port device team_slave_1 added [ 671.072270][T15632] 8021q: adding VLAN 0 to HW filter on device bond0 [ 671.150065][T15628] device hsr_slave_0 entered promiscuous mode [ 671.197255][T15628] device hsr_slave_1 entered promiscuous mode [ 671.236933][T15628] debugfs: Directory 'hsr0' with parent '/' already present! [ 671.248899][ T9002] bridge0: port 1(bridge_slave_0) entered disabled state [ 671.257207][ T9002] bridge0: port 2(bridge_slave_1) entered disabled state [ 671.286499][T15632] 8021q: adding VLAN 0 to HW filter on device team0 [ 671.298380][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 671.306373][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 671.337523][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 671.346610][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 671.355327][T13430] bridge0: port 1(bridge_slave_0) entered blocking state [ 671.362579][T13430] bridge0: port 1(bridge_slave_0) entered forwarding state [ 671.370534][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 671.379555][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 671.388070][T13430] bridge0: port 2(bridge_slave_1) entered blocking state [ 671.395197][T13430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 671.416958][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 671.429852][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 671.444239][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 671.455669][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 671.471198][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 671.480530][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 671.499102][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 671.507489][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 671.516250][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 671.529656][T15632] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 671.542486][T15632] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 671.553815][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 671.563062][T13430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 671.593278][T15628] 8021q: adding VLAN 0 to HW filter on device bond0 [ 671.608339][T15632] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 671.623622][T15628] 8021q: adding VLAN 0 to HW filter on device team0 [ 671.632127][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 671.649688][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 671.672834][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 671.684969][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 671.695053][ T8925] bridge0: port 1(bridge_slave_0) entered blocking state [ 671.702236][ T8925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 671.710951][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 671.720495][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 671.729908][ T8925] bridge0: port 2(bridge_slave_1) entered blocking state [ 671.737207][ T8925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 671.745662][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 671.770343][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 671.779151][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 671.795829][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 671.815709][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 671.832951][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 671.842266][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 671.857787][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 671.873020][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 671.886192][T15628] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 671.905045][T15628] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 671.924731][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 671.934789][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 671.952291][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 672.003755][T15628] 8021q: adding VLAN 0 to HW filter on device batadv0 20:37:37 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:37 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:37 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x7a00, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:37 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x9effffff, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:37 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:37 executing program 1: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000480)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905085bf4c90ccb170e62b3a8bf5294cc377a0a96b6be0d0a17270bbce74b47874750bb7739d3d69c6fbe1c0a002cb4179277631b277cf551abc65b2c4ea0717", 0x54}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 20:37:37 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0xff00, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x200001000008912, &(0x7f0000000040)="11dca5055e0bcfce7bf070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000040)={0x0, r3}) 20:37:37 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x200000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:38 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x1000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:38 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x2000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:38 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x3000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 673.085368][T15654] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:38 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:38 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:38 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:38 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xf0ffffff, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) [ 673.400088][T15681] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 674.322464][T15688] IPVS: ftp: loaded support on port[0] = 21 [ 674.665515][T15688] chnl_net:caif_netlink_parms(): no params data found [ 674.835345][T15688] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.845191][T15688] bridge0: port 1(bridge_slave_0) entered disabled state [ 674.853346][T15688] device bridge_slave_0 entered promiscuous mode [ 674.995210][T15688] bridge0: port 2(bridge_slave_1) entered blocking state [ 675.002791][T15688] bridge0: port 2(bridge_slave_1) entered disabled state [ 675.011296][T15688] device bridge_slave_1 entered promiscuous mode [ 675.166688][T15688] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 675.179728][T15688] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 675.197694][T15688] team0: Port device team_slave_0 added [ 675.205867][T15688] team0: Port device team_slave_1 added [ 675.399440][T15688] device hsr_slave_0 entered promiscuous mode [ 675.437371][T15688] device hsr_slave_1 entered promiscuous mode [ 675.497039][T15688] debugfs: Directory 'hsr0' with parent '/' already present! [ 675.644389][T15688] bridge0: port 2(bridge_slave_1) entered blocking state [ 675.651786][T15688] bridge0: port 2(bridge_slave_1) entered forwarding state [ 675.659616][T15688] bridge0: port 1(bridge_slave_0) entered blocking state [ 675.667402][T15688] bridge0: port 1(bridge_slave_0) entered forwarding state [ 675.700104][ T82] device bridge_slave_1 left promiscuous mode [ 675.706344][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 675.747837][ T82] device bridge_slave_0 left promiscuous mode [ 675.754432][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 675.820007][ T82] device bridge_slave_1 left promiscuous mode [ 675.826285][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 675.858080][ T82] device bridge_slave_0 left promiscuous mode [ 675.864491][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 679.577573][ T82] device hsr_slave_0 left promiscuous mode [ 679.617129][ T82] device hsr_slave_1 left promiscuous mode [ 679.666136][ T82] team0 (unregistering): Port device team_slave_1 removed [ 679.680848][ T82] team0 (unregistering): Port device team_slave_0 removed [ 679.692207][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 679.734197][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 679.805346][ T82] bond0 (unregistering): Released all slaves [ 679.937914][ T82] device hsr_slave_0 left promiscuous mode [ 679.977154][ T82] device hsr_slave_1 left promiscuous mode [ 680.039350][ T82] team0 (unregistering): Port device team_slave_1 removed [ 680.053526][ T82] team0 (unregistering): Port device team_slave_0 removed [ 680.065158][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 680.101616][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 680.174143][ T82] bond0 (unregistering): Released all slaves [ 680.261665][ T9002] bridge0: port 1(bridge_slave_0) entered disabled state [ 680.272320][ T9002] bridge0: port 2(bridge_slave_1) entered disabled state [ 680.288670][T15688] 8021q: adding VLAN 0 to HW filter on device bond0 [ 680.304895][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 680.313557][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 680.325476][T15688] 8021q: adding VLAN 0 to HW filter on device team0 [ 680.335277][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 680.345099][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 680.355467][ T8922] bridge0: port 1(bridge_slave_0) entered blocking state [ 680.363110][ T8922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 680.390394][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 680.400407][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 680.409326][ T8922] bridge0: port 2(bridge_slave_1) entered blocking state [ 680.417021][ T8922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 680.425461][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 680.434514][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 680.443296][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 680.452163][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 680.460919][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 680.469884][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 680.478692][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 680.487538][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 680.499488][T15688] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 680.512578][T15688] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 680.525611][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 680.534047][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 680.543152][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 680.565436][T15688] 8021q: adding VLAN 0 to HW filter on device batadv0 20:37:46 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:46 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:46 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xfeff0000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x200000000000000, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000001000010600"/20, @ANYRES32=0x0, @ANYBLOB="003f9200000000001c0012000c000100626f6e64000000000c00020008000e0000000000"], 0x3c}}, 0x0) 20:37:46 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:46 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x5000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 680.951950][T15699] netlink: 'syz-executor.1': attribute type 14 has an invalid length. 20:37:46 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x6000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 681.038071][T15699] device bond1 entered promiscuous mode [ 681.056288][T15702] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:46 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x102, 0x10, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) 20:37:46 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x7000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:46 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xff0f0000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:46 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0xa000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:46 executing program 1: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/audio\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r1, 0x0, 0x0) fsetxattr$security_capability(r1, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000080)=@v2={0x2000000, [{0x9, 0x2}, {0xfff, 0x7}]}, 0x14, 0x3) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='dctcp\x00', 0x6) fsopen(&(0x7f0000000240)='cgroup\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x9b0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) sendto$inet(r1, 0x0, 0x0, 0x210007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) getsockopt$inet_int(r1, 0x0, 0xe, &(0x7f00000001c0), &(0x7f0000000200)=0x4) 20:37:47 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) [ 682.051674][T15713] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 683.012517][T15730] IPVS: ftp: loaded support on port[0] = 21 [ 683.097053][T15730] chnl_net:caif_netlink_parms(): no params data found [ 683.135544][T15730] bridge0: port 1(bridge_slave_0) entered blocking state [ 683.142885][T15730] bridge0: port 1(bridge_slave_0) entered disabled state [ 683.151200][T15730] device bridge_slave_0 entered promiscuous mode [ 683.159587][T15730] bridge0: port 2(bridge_slave_1) entered blocking state [ 683.166893][T15730] bridge0: port 2(bridge_slave_1) entered disabled state [ 683.175302][T15730] device bridge_slave_1 entered promiscuous mode [ 683.197392][T15730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 683.209140][T15730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 683.231467][T15730] team0: Port device team_slave_0 added [ 683.239730][T15730] team0: Port device team_slave_1 added [ 683.299780][T15730] device hsr_slave_0 entered promiscuous mode [ 683.347858][T15730] device hsr_slave_1 entered promiscuous mode [ 683.376947][T15730] debugfs: Directory 'hsr0' with parent '/' already present! [ 683.395666][T15730] bridge0: port 2(bridge_slave_1) entered blocking state [ 683.403762][T15730] bridge0: port 2(bridge_slave_1) entered forwarding state [ 683.411734][T15730] bridge0: port 1(bridge_slave_0) entered blocking state [ 683.419291][T15730] bridge0: port 1(bridge_slave_0) entered forwarding state [ 683.754919][T15733] IPVS: ftp: loaded support on port[0] = 21 [ 683.940310][T15730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 684.101917][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 684.111508][ T9002] bridge0: port 1(bridge_slave_0) entered disabled state [ 684.120949][ T9002] bridge0: port 2(bridge_slave_1) entered disabled state [ 684.131554][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 684.165922][T15730] 8021q: adding VLAN 0 to HW filter on device team0 [ 684.182463][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 684.191652][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 684.200779][T12956] bridge0: port 1(bridge_slave_0) entered blocking state [ 684.208210][T12956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 684.216989][T15733] chnl_net:caif_netlink_parms(): no params data found [ 684.371244][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 684.380276][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 684.390151][ T8922] bridge0: port 2(bridge_slave_1) entered blocking state [ 684.397458][ T8922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 684.429924][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 684.440500][T15733] bridge0: port 1(bridge_slave_0) entered blocking state [ 684.447844][T15733] bridge0: port 1(bridge_slave_0) entered disabled state [ 684.455850][T15733] device bridge_slave_0 entered promiscuous mode [ 684.609313][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 684.622768][T15733] bridge0: port 2(bridge_slave_1) entered blocking state [ 684.630041][T15733] bridge0: port 2(bridge_slave_1) entered disabled state [ 684.638502][T15733] device bridge_slave_1 entered promiscuous mode [ 684.660928][T15733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 684.813713][T15733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 684.851930][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 684.861847][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 684.880013][T15733] team0: Port device team_slave_0 added [ 684.889057][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 684.897095][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 684.906060][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 684.916359][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 684.925126][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 684.933750][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 684.942575][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 684.953393][T15730] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 684.963395][T15733] team0: Port device team_slave_1 added [ 685.149547][T15733] device hsr_slave_0 entered promiscuous mode [ 685.197347][T15733] device hsr_slave_1 entered promiscuous mode [ 685.237140][T15733] debugfs: Directory 'hsr0' with parent '/' already present! [ 685.393689][T15730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 685.597109][T15733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 685.610654][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 685.619821][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 685.637946][ T82] device bridge_slave_1 left promiscuous mode [ 685.644447][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 685.708170][ T82] device bridge_slave_0 left promiscuous mode [ 685.714952][ T82] bridge0: port 1(bridge_slave_0) entered disabled state 20:37:51 executing program 3: mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:51 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x10000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:51 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dc900d5e0bcfe47bf070") r1 = socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x3, 0x300) close(r1) [ 685.759052][ T82] device bridge_slave_1 left promiscuous mode [ 685.765662][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 685.830611][ T82] device bridge_slave_0 left promiscuous mode [ 685.837857][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 686.196915][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 686.204291][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 686.210190][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 686.216242][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 689.727993][ T82] device hsr_slave_0 left promiscuous mode [ 689.767127][ T82] device hsr_slave_1 left promiscuous mode [ 689.816667][ T82] team0 (unregistering): Port device team_slave_1 removed [ 689.830553][ T82] team0 (unregistering): Port device team_slave_0 removed [ 689.842489][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 689.891889][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 689.963197][ T82] bond0 (unregistering): Released all slaves [ 690.148124][ T82] device hsr_slave_0 left promiscuous mode [ 690.197113][ T82] device hsr_slave_1 left promiscuous mode [ 690.248897][ T82] team0 (unregistering): Port device team_slave_1 removed [ 690.262671][ T82] team0 (unregistering): Port device team_slave_0 removed [ 690.274543][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 690.330857][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 690.432358][ T82] bond0 (unregistering): Released all slaves [ 690.522446][T15733] 8021q: adding VLAN 0 to HW filter on device team0 [ 690.556631][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 690.568680][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 690.592872][T12956] bridge0: port 1(bridge_slave_0) entered blocking state [ 690.600296][T12956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 690.619030][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 690.628348][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 690.637553][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 690.646299][T12956] bridge0: port 2(bridge_slave_1) entered blocking state [ 690.653498][T12956] bridge0: port 2(bridge_slave_1) entered forwarding state [ 690.662136][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 690.677154][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 690.685798][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 690.695195][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 690.706329][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 690.715307][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 690.729614][T15733] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 690.740596][T15733] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 690.753626][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 690.762780][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 690.771755][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 690.780513][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 690.790006][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 690.798826][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 690.828866][T15733] 8021q: adding VLAN 0 to HW filter on device batadv0 20:37:56 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xffffa888, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:56 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:56 executing program 3: mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:56 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x40000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000000)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000640)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000480)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000001c0)=[@mss], 0x20000365) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000040), 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) ioctl$TCSETXF(r0, 0x5434, 0x0) [ 691.232688][T15765] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:37:56 executing program 3: mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:56 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x48000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xfffff000, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:37:56 executing program 3: mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:37:56 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x33) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000400)='/proc/self/net/pfkey\x00', 0x100, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) openat$cgroup_ro(r1, &(0x7f0000000280)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x4) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) r3 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read$eventfd(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, 0x0) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0xff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x2100, 0x2, 0x3c5b, 0x0, 0xffff, 0x9a, 0x4, 0x1, 0x1, 0x10000, 0xfe1, 0xe7, 0x8, 0x3f, 0x1, 0x3, 0x3, 0x6814, 0x8000, 0x2, 0x6, 0x7, 0x0, 0x80, 0x4, 0x400, 0x8000, 0x8, 0x6, 0x2, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000140), 0x1}, 0x0, 0x5, 0x100, 0x6, 0x4, 0x7ff, 0x7626}, 0x0, 0x7, r2, 0xe3ce6655379bfab6) fallocate(0xffffffffffffffff, 0x0, 0x6, 0x2) creat(&(0x7f00000000c0)='./bus\x00', 0x0) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f0000000640)=ANY=[@ANYBLOB, @ANYBLOB='\x00\x00'], 0x2) r4 = socket$inet6(0xa, 0x1, 0x0) r5 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r4) setsockopt$inet6_tcp_int(r3, 0x6, 0x9, &(0x7f0000000000)=0x40, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f0000000800)=0x16c, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000480)={@in={{0x2, 0x0, @local}}, 0x0, 0x20000000005, 0x2, "a77760f5a7645bc43c241d69912dda0c63c2a66726f8cfafd6c8fe2c98de7ba44947a79015f0fe57917cb62a93987a938fdedfce7bbba4fec2d8a09c41fb233245f2604b9e07b8ab79ec15ef2818a179"}, 0xd8) bind$inet(r6, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x200007fd, &(0x7f0000000100)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000000), 0x9f) recvmsg(r6, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, &(0x7f0000000380)={'filter\x00', 0x3, [{}, {}, {}]}, 0x58) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) write$binfmt_elf64(r6, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) write$eventfd(r5, &(0x7f0000000440)=0x74, 0xffffffffffffff0a) 20:37:57 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4c000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:37:57 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:37:57 executing program 3: mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 692.590343][T15782] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 693.702911][T15810] IPVS: ftp: loaded support on port[0] = 21 [ 693.782905][T15810] chnl_net:caif_netlink_parms(): no params data found [ 693.813833][T15810] bridge0: port 1(bridge_slave_0) entered blocking state [ 693.821237][T15810] bridge0: port 1(bridge_slave_0) entered disabled state [ 693.829165][T15810] device bridge_slave_0 entered promiscuous mode [ 693.837147][T15810] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.844373][T15810] bridge0: port 2(bridge_slave_1) entered disabled state [ 693.852341][T15810] device bridge_slave_1 entered promiscuous mode [ 694.002349][T15810] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 694.014238][T15810] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 694.036095][T15810] team0: Port device team_slave_0 added [ 694.044359][T15810] team0: Port device team_slave_1 added [ 694.158780][T15810] device hsr_slave_0 entered promiscuous mode [ 694.217324][T15810] device hsr_slave_1 entered promiscuous mode [ 694.286966][T15810] debugfs: Directory 'hsr0' with parent '/' already present! [ 694.368805][T15810] bridge0: port 2(bridge_slave_1) entered blocking state [ 694.376181][T15810] bridge0: port 2(bridge_slave_1) entered forwarding state [ 694.383729][T15810] bridge0: port 1(bridge_slave_0) entered blocking state [ 694.390961][T15810] bridge0: port 1(bridge_slave_0) entered forwarding state [ 694.424986][T15810] 8021q: adding VLAN 0 to HW filter on device bond0 [ 694.507154][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 694.515279][T12956] bridge0: port 1(bridge_slave_0) entered disabled state [ 694.523738][T12956] bridge0: port 2(bridge_slave_1) entered disabled state [ 694.532202][T12956] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 694.610950][T15810] 8021q: adding VLAN 0 to HW filter on device team0 [ 694.621596][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 694.631030][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 694.638527][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 694.720161][ T8922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 694.729762][ T8922] bridge0: port 2(bridge_slave_1) entered blocking state [ 694.737347][ T8922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 694.758418][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 694.768755][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 694.780905][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 694.862803][T15810] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 694.875266][T15810] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 694.884141][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 694.892128][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 694.981300][T15810] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 695.142488][ T82] device bridge_slave_1 left promiscuous mode [ 695.156982][ T82] bridge0: port 2(bridge_slave_1) entered disabled state 20:38:00 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:38:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x51020000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 695.191728][ T82] device bridge_slave_0 left promiscuous mode [ 695.205012][ T82] bridge0: port 1(bridge_slave_0) entered disabled state 20:38:00 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00005e7ff8)={0xffffffffffffffff, 0xffffffffffffffff}) setrlimit(0x1000000000000007, &(0x7f0000000040)) sendmsg(r0, &(0x7f0000bfe000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000298000)=[{0x10, 0x1, 0x1, "02"}], 0x10}, 0x0) 20:38:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xffffff7f, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:38:00 executing program 3: mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:38:00 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(0x0, &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:38:00 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:38:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x68000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:38:00 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x200001000008912, &(0x7f0000000040)="11dca5055e0bcfce7bf070") r1 = socket$isdn_base(0x22, 0x3, 0x0) close(r1) 20:38:00 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:38:00 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x6c000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:38:01 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) [ 697.928124][ T82] device hsr_slave_0 left promiscuous mode [ 697.967076][ T82] device hsr_slave_1 left promiscuous mode [ 698.015283][ T82] team0 (unregistering): Port device team_slave_1 removed [ 698.030906][ T82] team0 (unregistering): Port device team_slave_0 removed [ 698.043253][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 698.111327][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 698.206015][ T82] bond0 (unregistering): Released all slaves [ 698.318937][T15822] netlink: 'syz-executor.0': attribute type 9 has an invalid length. 20:38:03 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:38:03 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x74000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:38:03 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:38:03 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xffffff9e, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:38:03 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x14, 0x1a200) clock_gettime(0x0, &(0x7f0000000080)) write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x1}, 0x7) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r0, 0xc0245720, &(0x7f00000003c0)={0x1, {0x0, 0x1c9c380}, 0x8}) mmap$xdp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x9, 0x10, r0, 0x80000000) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x6000000000000001, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/autofs\x00', 0x8000000000000002, 0x0) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000580)={'nat\x00\x00\x00\x00\x00\x00\x00\x00\xb9\xd9\xd3q\xa1h\x00', 0x0, 0xfffffffffffffffd, 0x5, [], 0x0, 0x0, &(0x7f0000000500)=""/5}, &(0x7f00000002c0)=0xffffffffffffffbf) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000300)={0xffffffffffffffff, r2, 0x0, 0xa, &(0x7f0000000240)='/dev/vcs#\x00', 0xffffffffffffffff}, 0x30) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340)=0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0x0, r2, 0x0, 0x14, &(0x7f0000000380)=':/:&}md5sumppp0eth1\x00', 0xffffffffffffffff}, 0x30) getpgid(r3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) mmap(&(0x7f00006b7000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000000000)=0x8000, 0x4) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x100000, 0x0, 0x52, r4, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) [ 698.539193][T15852] IPVS: ftp: loaded support on port[0] = 21 [ 698.617260][T15859] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 698.881500][T15852] chnl_net:caif_netlink_parms(): no params data found [ 698.920632][T15852] bridge0: port 1(bridge_slave_0) entered blocking state [ 698.935964][T15852] bridge0: port 1(bridge_slave_0) entered disabled state [ 698.944796][T15852] device bridge_slave_0 entered promiscuous mode [ 698.968429][T15852] bridge0: port 2(bridge_slave_1) entered blocking state [ 698.975738][T15852] bridge0: port 2(bridge_slave_1) entered disabled state [ 698.986428][T15852] device bridge_slave_1 entered promiscuous mode [ 699.024060][T15852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 699.036522][T15852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 699.061048][T15852] team0: Port device team_slave_0 added [ 699.068468][T15852] team0: Port device team_slave_1 added [ 699.170658][T15852] device hsr_slave_0 entered promiscuous mode [ 699.213457][T15852] device hsr_slave_1 entered promiscuous mode [ 699.296862][T15852] debugfs: Directory 'hsr0' with parent '/' already present! [ 699.338299][T15852] bridge0: port 2(bridge_slave_1) entered blocking state [ 699.345391][T15852] bridge0: port 2(bridge_slave_1) entered forwarding state [ 699.352815][T15852] bridge0: port 1(bridge_slave_0) entered blocking state [ 699.360142][T15852] bridge0: port 1(bridge_slave_0) entered forwarding state [ 699.436704][T15852] 8021q: adding VLAN 0 to HW filter on device bond0 [ 699.460277][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 699.475642][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 699.484291][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 699.507717][T15852] 8021q: adding VLAN 0 to HW filter on device team0 [ 699.527218][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 699.536188][ T3504] bridge0: port 1(bridge_slave_0) entered blocking state [ 699.543405][ T3504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 699.575579][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 699.592537][ T9002] bridge0: port 2(bridge_slave_1) entered blocking state [ 699.599725][ T9002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 699.635907][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 699.653839][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 699.664985][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 699.681905][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 699.693441][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 699.709882][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 699.721308][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 699.730735][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 699.742301][T15852] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 699.750947][ T3504] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 699.775703][T15852] 8021q: adding VLAN 0 to HW filter on device batadv0 20:38:05 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0xfffffff0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_TYPE={0x8, 0x9, 0xffffff89}]]}}}]}, 0x3c}}, 0x0) 20:38:05 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x7a000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) 20:38:05 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:38:05 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r1}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:38:05 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000200)=""/210, 0xd2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f00000003c0)) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x1) pivot_root(0x0, &(0x7f0000000100)='./file0\x00') socket$inet_udp(0x2, 0x2, 0x0) stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000900)=[0x0, &(0x7f0000000740)='security.apparmor\x00', &(0x7f0000000780)='system\\&wlan1!\x00', &(0x7f00000007c0)='port', &(0x7f0000000840)='[:d+/em1\x00', 0x0, &(0x7f00000008c0)='subj_type'], &(0x7f0000000940)) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) r1 = socket$inet(0x2b, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) getgroups(0x2, &(0x7f0000000540)=[0xffffffffffffffff, 0xee01]) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid', 0x3d, r2}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) sendto$llc(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0) 20:38:05 executing program 1: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0xfffffffffffffffd, 0x0, &(0x7f0000007400)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) 20:38:05 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000580)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq'}}, {@rq={'rq', 0x3d, 0x4a19}}, {@sq={'sq'}}, {@common=@dfltgid={'dfltgid'}}, {@common=@cachetag={'cachetag', 0x3d, '/dev/ubi_ctrl\x00'}}, {@common=@version_L='version=9p2000.L'}, {@rq={'rq'}}], [{@subj_type={'subj_type', 0x3d, 'keyring)'}}]}}) 20:38:05 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0xff000000, 0x0, 0x0, 0x43, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x21) [ 700.113129][T15889] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 700.217657][T15891] ------------[ cut here ]------------ [ 700.223565][T15891] WARNING: CPU: 1 PID: 15891 at kernel/time/posix-cpu-timers.c:401 posix_cpu_timer_del+0x2f0/0x3b0 [ 700.234246][T15891] Kernel panic - not syncing: panic_on_warn set ... [ 700.241028][T15891] CPU: 1 PID: 15891 Comm: syz-executor.1 Not tainted 5.3.0-rc6-next-20190827 #74 [ 700.250135][T15891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 700.260492][T15891] Call Trace: [ 700.263831][T15891] dump_stack+0x172/0x1f0 [ 700.268327][T15891] ? posix_cpu_timer_del+0x230/0x3b0 [ 700.273631][T15891] panic+0x2dc/0x755 [ 700.277702][T15891] ? add_taint.cold+0x16/0x16 [ 700.282487][T15891] ? printk+0xba/0xed [ 700.286485][T15891] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 700.292061][T15891] ? __warn.cold+0x14/0x3c [ 700.296518][T15891] ? __warn+0xd9/0x1d0 [ 700.300780][T15891] ? posix_cpu_timer_del+0x2f0/0x3b0 [ 700.306165][T15891] __warn.cold+0x2f/0x3c [ 700.310514][T15891] ? report_bug.cold+0x63/0xad [ 700.315494][T15891] ? posix_cpu_timer_del+0x2f0/0x3b0 [ 700.320800][T15891] report_bug+0x289/0x300 [ 700.325244][T15891] do_error_trap+0x11b/0x200 [ 700.329914][T15891] do_invalid_op+0x37/0x50 [ 700.334346][T15891] ? posix_cpu_timer_del+0x2f0/0x3b0 [ 700.339649][T15891] invalid_op+0x23/0x30 [ 700.344014][T15891] RIP: 0010:posix_cpu_timer_del+0x2f0/0x3b0 [ 700.349914][T15891] Code: 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b5 00 00 00 48 83 bb c8 00 00 00 00 74 16 e8 10 58 0d 00 <0f> 0b e9 87 fe ff ff e8 b4 3e 48 00 e9 dd fd ff ff e8 fa 57 0d 00 [ 700.370021][T15891] RSP: 0018:ffff888096f77a30 EFLAGS: 00010093 [ 700.376557][T15891] RAX: ffff88808e5a0180 RBX: ffff88809602be60 RCX: 1ffff11011cb4142 [ 700.384628][T15891] RDX: 0000000000000000 RSI: ffffffff8164d5c0 RDI: ffff88809602bf28 [ 700.392695][T15891] RBP: ffff888096f77ac0 R08: 0000000000000002 R09: ffff88808e5a0a18 [ 700.400967][T15891] R10: fffffbfff138b140 R11: ffffffff89c58a07 R12: ffff888090aec140 [ 700.408960][T15891] R13: 1ffff11012deef47 R14: ffff888096f77a98 R15: ffff88809602beb8 [ 700.417058][T15891] ? posix_cpu_timer_del+0x2f0/0x3b0 [ 700.422678][T15891] ? lock_acquire+0x190/0x410 [ 700.427466][T15891] ? thread_cpu_clock_getres+0x90/0x90 [ 700.432962][T15891] ? thread_cpu_clock_getres+0x90/0x90 [ 700.438443][T15891] exit_itimers+0xdb/0x2e0 [ 700.442918][T15891] do_exit+0x1980/0x2e60 [ 700.447180][T15891] ? get_signal+0x392/0x2500 [ 700.451790][T15891] ? find_held_lock+0x35/0x130 [ 700.456771][T15891] ? get_signal+0x392/0x2500 [ 700.461559][T15891] ? mm_update_next_owner+0x640/0x640 [ 700.467144][T15891] ? lock_downgrade+0x920/0x920 [ 700.472309][T15891] ? _raw_spin_unlock_irq+0x28/0x90 [ 700.477632][T15891] ? get_signal+0x392/0x2500 [ 700.482348][T15891] ? _raw_spin_unlock_irq+0x28/0x90 [ 700.487710][T15891] do_group_exit+0x135/0x360 [ 700.492502][T15891] get_signal+0x47c/0x2500 [ 700.497070][T15891] ? lock_downgrade+0x920/0x920 [ 700.502062][T15891] do_signal+0x87/0x1700 [ 700.506331][T15891] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 700.512679][T15891] ? debug_smp_processor_id+0x3c/0x214 [ 700.518251][T15891] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 700.524426][T15891] ? setup_sigcontext+0x7d0/0x7d0 [ 700.529573][T15891] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 700.535871][T15891] ? exit_to_usermode_loop+0x43/0x380 [ 700.541272][T15891] ? do_syscall_64+0x65f/0x760 [ 700.546191][T15891] ? exit_to_usermode_loop+0x43/0x380 [ 700.551711][T15891] ? lockdep_hardirqs_on+0x418/0x5d0 [ 700.557142][T15891] ? trace_hardirqs_on+0x67/0x240 [ 700.562217][T15891] exit_to_usermode_loop+0x286/0x380 [ 700.567538][T15891] do_syscall_64+0x65f/0x760 [ 700.572188][T15891] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 700.578116][T15891] RIP: 0033:0x459879 [ 700.582113][T15891] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 700.602319][T15891] RSP: 002b:00007f5aa5a05cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 700.610839][T15891] RAX: fffffffffffffe00 RBX: 000000000075bfd0 RCX: 0000000000459879 [ 700.619068][T15891] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bfd0 [ 700.627162][T15891] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 700.635266][T15891] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bfd4 [ 700.643380][T15891] R13: 00007fff437337cf R14: 00007f5aa5a069c0 R15: 000000000075bfd4 [ 700.654001][T15891] Kernel Offset: disabled [ 700.658599][T15891] Rebooting in 86400 seconds..