Extracting prog: 1h23m38.47883246s
Minimizing prog: 7m6.370792697s
Simplifying prog options: 4m28.390243059s
Extracting C: 1m21.802199865s
Simplifying C: 0s


extracting reproducer from 28 programs
testing a last program of every proc
single: executing 8 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_icmp_raw-setsockopt$inet6_int
detailed listing:
executing program 0:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xd0, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-getsockopt$sock_int
detailed listing:
executing program 0:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={<r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x9, 0x0, &(0x7f0000000300))

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="010008000100"})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-bind$bt_l2cap
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bind$bt_l2cap(r0, &(0x7f0000001640)={0x1f, 0xfdce}, 0xe)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_icmp_raw-setsockopt$inet6_int
detailed listing:
executing program 0:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xd0, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-getsockopt$sock_int
detailed listing:
executing program 0:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={<r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x9, 0x0, &(0x7f0000000300))

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="010008000100"})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-bind$bt_l2cap
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bind$bt_l2cap(r0, &(0x7f0000001640)={0x1f, 0xfdce}, 0xe)

program did not crash
single: failed to extract reproducer
bisect: bisecting 28 programs with base timeout 6m0s
testing program (duration=6m7s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2]
detailed listing:
executing program 0:
r0 = socket(0x8000000010, 0x2, 0x0)
write(r0, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000015481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/xfrm_stat\x00')
ftruncate(r0, 0x3119c976)
executing program 0:
futex(&(0x7f000000cffc), 0x9, 0x0, 0x0, 0x0, 0x80)
futex(&(0x7f000000cffc)=0x2, 0xa, 0x0, 0x0, 0x0, 0x1000000)
executing program 0:
syz_usb_connect(0x0, 0x36, &(0x7f0000001300)=ANY=[@ANYBLOB="120100000cb78a405e0483020b990102030109022400010000000009040000025c291d000905dc00000000000009050b"], 0x0)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x40087708, 0x0)
executing program 1:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x40800, 0x0)
preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="cc0000001b0001032dbd7000fbdbdf25ac1414aa000000000000000000000000e00000010000000000000000000000004e2300004e2300080200802084000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000001040020000000000500000000000000f80000000f0000005e0000000000000001000000000000002f060000000000000c00000000000000f8fffffffffffffffaffffffc06b6e00020003010000000002000000000000000a"], 0xcc}}, 0x0)
executing program 1:
munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000)
msync(&(0x7f0000461000/0x4000)=nil, 0x4000, 0x2)
executing program 1:
r0 = syz_usb_connect$uac1(0x0, 0x71, &(0x7f00000002c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x0, 0x0, 0x2, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x0, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x0, 0x0, 0x8, {0x7, 0x25, 0x1, 0x3, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x0, 0x0, 0x80, {0x7, 0x25, 0x1, 0x0, 0x0, 0xff1d}}}}}}}]}}, 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000000180)={0x14, &(0x7f0000000000)={0x40, 0xa, 0x2, {0x2, 0xe}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c}}}, 0x0)
executing program 2:
r0 = socket$inet6(0x10, 0x3, 0x0)
sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000140)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925001900fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0)
executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00')
openat$cgroup_int(r0, &(0x7f0000000080)='io.max\x00', 0x2, 0x0)
executing program 2:
futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x6, 0x1, 0x0, 0x0, 0x2)
executing program 3:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xcf, 0x0, 0x0)
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)
executing program 3:
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000001040), 0x2002, 0x0)
ioctl$AUTOFS_IOC_FAIL(r0, 0x4c81, 0xffffffffffffffb6)
executing program 3:
mkdir(&(0x7f0000000000)='./file0\x00', 0x2)
mount(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000380)='debugfs\x00', 0x80, &(0x7f00000003c0)='Q*2aGx\xc3P\'7\x0f\xfd`P\x06\xca\a+\x9f\xe4cm,p0\x9f\x0e\x1b\x9a\xc1]\f\x89\xf0\xce[\x9b\xfaE4>DZD\xd8*\x88A\xaaV\x16x\fN\xad\xb7\xb5W\xc1\x7f\xf8%._\x9c\x10D\x1b\x9d%\xa1$\xe5o\xe1\xad\xb3n6H\xa2\xc5\x85\x83\xd0\x03\x8c#\xce\x8f\xbdIX2v\x95\xf4|\xd2\xe7EW\x88\xd0\xd0\x98\xd1\x15\"\xd9\xf1\x1a\x17\x19\x8cR\xfaz\xe8\xa4\x0f\xb7\xf4\x84$0&\r\x04\x85S\xb9$\xaf\x16\xaf\xe1\x93zT\xddGGr\'\x81\x04\x90U\xc5m\xa31\xf6\x86,]')
executing program 2:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TCSETS(r0, 0x545c, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd0, 0xff, 0xec, 0x20, 0x789, 0x160, 0x2cd1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x2, 0xe6, 0xfb, 0x6a, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x18}}]}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched_retired(r0, &(0x7f0000003b80)={0x0, 0x0, &(0x7f0000003b40)={&(0x7f00000015c0)=@newtfilter={0x24, 0x2c, 0x603, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {0xffff, 0xa}, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x80)
executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_int(r0, 0x29, 0x1, 0x0, &(0x7f00000048c0))
executing program 2:
r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x181440)
ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f0000000180)={0x0, 0x0, 0xffffffff})
executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bind$bt_l2cap(r0, &(0x7f0000001640)={0x1f, 0xfdce}, 0xe)
executing program 1:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="010008000100"})
executing program 3:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={<r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x9, 0x0, &(0x7f0000000300))
executing program 2:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xd0, 0x0, 0x0)
executing program 32:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bind$bt_l2cap(r0, &(0x7f0000001640)={0x1f, 0xfdce}, 0xe)
executing program 33:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="010008000100"})
executing program 34:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={<r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x9, 0x0, &(0x7f0000000300))
executing program 35:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xd0, 0x0, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
bisect: bisecting 28 programs
bisect: split chunks (needed=false): <28>
bisect: split chunk #0 of len 28 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2]
detailed listing:
executing program 2:
futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x6, 0x1, 0x0, 0x0, 0x2)
executing program 3:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xcf, 0x0, 0x0)
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)
executing program 3:
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000001040), 0x2002, 0x0)
ioctl$AUTOFS_IOC_FAIL(r0, 0x4c81, 0xffffffffffffffb6)
executing program 3:
mkdir(&(0x7f0000000000)='./file0\x00', 0x2)
mount(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000380)='debugfs\x00', 0x80, &(0x7f00000003c0)='Q*2aGx\xc3P\'7\x0f\xfd`P\x06\xca\a+\x9f\xe4cm,p0\x9f\x0e\x1b\x9a\xc1]\f\x89\xf0\xce[\x9b\xfaE4>DZD\xd8*\x88A\xaaV\x16x\fN\xad\xb7\xb5W\xc1\x7f\xf8%._\x9c\x10D\x1b\x9d%\xa1$\xe5o\xe1\xad\xb3n6H\xa2\xc5\x85\x83\xd0\x03\x8c#\xce\x8f\xbdIX2v\x95\xf4|\xd2\xe7EW\x88\xd0\xd0\x98\xd1\x15\"\xd9\xf1\x1a\x17\x19\x8cR\xfaz\xe8\xa4\x0f\xb7\xf4\x84$0&\r\x04\x85S\xb9$\xaf\x16\xaf\xe1\x93zT\xddGGr\'\x81\x04\x90U\xc5m\xa31\xf6\x86,]')
executing program 2:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TCSETS(r0, 0x545c, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd0, 0xff, 0xec, 0x20, 0x789, 0x160, 0x2cd1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x2, 0xe6, 0xfb, 0x6a, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x18}}]}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched_retired(r0, &(0x7f0000003b80)={0x0, 0x0, &(0x7f0000003b40)={&(0x7f00000015c0)=@newtfilter={0x24, 0x2c, 0x603, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {0xffff, 0xa}, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x80)
executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_int(r0, 0x29, 0x1, 0x0, &(0x7f00000048c0))
executing program 2:
r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x181440)
ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f0000000180)={0x0, 0x0, 0xffffffff})
executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bind$bt_l2cap(r0, &(0x7f0000001640)={0x1f, 0xfdce}, 0xe)
executing program 1:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="010008000100"})
executing program 3:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={<r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x9, 0x0, &(0x7f0000000300))
executing program 2:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xd0, 0x0, 0x0)
executing program 32:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bind$bt_l2cap(r0, &(0x7f0000001640)={0x1f, 0xfdce}, 0xe)
executing program 33:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="010008000100"})
executing program 34:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={<r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x9, 0x0, &(0x7f0000000300))
executing program 35:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xd0, 0x0, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2, 2, 2, 2]
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bind$bt_l2cap(r0, &(0x7f0000001640)={0x1f, 0xfdce}, 0xe)
executing program 1:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="010008000100"})
executing program 3:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={<r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x9, 0x0, &(0x7f0000000300))
executing program 2:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xd0, 0x0, 0x0)
executing program 32:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bind$bt_l2cap(r0, &(0x7f0000001640)={0x1f, 0xfdce}, 0xe)
executing program 33:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="010008000100"})
executing program 34:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={<r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x9, 0x0, &(0x7f0000000300))
executing program 35:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xd0, 0x0, 0x0)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2, 2, 2, 2, 2, 2]
detailed listing:
executing program 2:
futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x6, 0x1, 0x0, 0x0, 0x2)
executing program 3:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xcf, 0x0, 0x0)
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)
executing program 3:
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000001040), 0x2002, 0x0)
ioctl$AUTOFS_IOC_FAIL(r0, 0x4c81, 0xffffffffffffffb6)
executing program 3:
mkdir(&(0x7f0000000000)='./file0\x00', 0x2)
mount(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000380)='debugfs\x00', 0x80, &(0x7f00000003c0)='Q*2aGx\xc3P\'7\x0f\xfd`P\x06\xca\a+\x9f\xe4cm,p0\x9f\x0e\x1b\x9a\xc1]\f\x89\xf0\xce[\x9b\xfaE4>DZD\xd8*\x88A\xaaV\x16x\fN\xad\xb7\xb5W\xc1\x7f\xf8%._\x9c\x10D\x1b\x9d%\xa1$\xe5o\xe1\xad\xb3n6H\xa2\xc5\x85\x83\xd0\x03\x8c#\xce\x8f\xbdIX2v\x95\xf4|\xd2\xe7EW\x88\xd0\xd0\x98\xd1\x15\"\xd9\xf1\x1a\x17\x19\x8cR\xfaz\xe8\xa4\x0f\xb7\xf4\x84$0&\r\x04\x85S\xb9$\xaf\x16\xaf\xe1\x93zT\xddGGr\'\x81\x04\x90U\xc5m\xa31\xf6\x86,]')
executing program 2:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TCSETS(r0, 0x545c, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd0, 0xff, 0xec, 0x20, 0x789, 0x160, 0x2cd1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x2, 0xe6, 0xfb, 0x6a, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x18}}]}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched_retired(r0, &(0x7f0000003b80)={0x0, 0x0, &(0x7f0000003b40)={&(0x7f00000015c0)=@newtfilter={0x24, 0x2c, 0x603, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {0xffff, 0xa}, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x80)
executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_int(r0, 0x29, 0x1, 0x0, &(0x7f00000048c0))
executing program 2:
r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x181440)
ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f0000000180)={0x0, 0x0, 0xffffffff})

program crashed: WARNING in xfrm6_tunnel_net_exit
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2]
detailed listing:
executing program 2:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TCSETS(r0, 0x545c, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd0, 0xff, 0xec, 0x20, 0x789, 0x160, 0x2cd1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x2, 0xe6, 0xfb, 0x6a, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x18}}]}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched_retired(r0, &(0x7f0000003b80)={0x0, 0x0, &(0x7f0000003b40)={&(0x7f00000015c0)=@newtfilter={0x24, 0x2c, 0x603, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {0xffff, 0xa}, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x80)
executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_int(r0, 0x29, 0x1, 0x0, &(0x7f00000048c0))
executing program 2:
r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x181440)
ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f0000000180)={0x0, 0x0, 0xffffffff})

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2]
detailed listing:
executing program 2:
futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x6, 0x1, 0x0, 0x0, 0x2)
executing program 3:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xcf, 0x0, 0x0)
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)
executing program 3:
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000001040), 0x2002, 0x0)
ioctl$AUTOFS_IOC_FAIL(r0, 0x4c81, 0xffffffffffffffb6)
executing program 3:
mkdir(&(0x7f0000000000)='./file0\x00', 0x2)
mount(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000380)='debugfs\x00', 0x80, &(0x7f00000003c0)='Q*2aGx\xc3P\'7\x0f\xfd`P\x06\xca\a+\x9f\xe4cm,p0\x9f\x0e\x1b\x9a\xc1]\f\x89\xf0\xce[\x9b\xfaE4>DZD\xd8*\x88A\xaaV\x16x\fN\xad\xb7\xb5W\xc1\x7f\xf8%._\x9c\x10D\x1b\x9d%\xa1$\xe5o\xe1\xad\xb3n6H\xa2\xc5\x85\x83\xd0\x03\x8c#\xce\x8f\xbdIX2v\x95\xf4|\xd2\xe7EW\x88\xd0\xd0\x98\xd1\x15\"\xd9\xf1\x1a\x17\x19\x8cR\xfaz\xe8\xa4\x0f\xb7\xf4\x84$0&\r\x04\x85S\xb9$\xaf\x16\xaf\xe1\x93zT\xddGGr\'\x81\x04\x90U\xc5m\xa31\xf6\x86,]')

program crashed: WARNING in xfrm6_tunnel_net_exit
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2]
detailed listing:
executing program 3:
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000001040), 0x2002, 0x0)
ioctl$AUTOFS_IOC_FAIL(r0, 0x4c81, 0xffffffffffffffb6)
executing program 3:
mkdir(&(0x7f0000000000)='./file0\x00', 0x2)
mount(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000380)='debugfs\x00', 0x80, &(0x7f00000003c0)='Q*2aGx\xc3P\'7\x0f\xfd`P\x06\xca\a+\x9f\xe4cm,p0\x9f\x0e\x1b\x9a\xc1]\f\x89\xf0\xce[\x9b\xfaE4>DZD\xd8*\x88A\xaaV\x16x\fN\xad\xb7\xb5W\xc1\x7f\xf8%._\x9c\x10D\x1b\x9d%\xa1$\xe5o\xe1\xad\xb3n6H\xa2\xc5\x85\x83\xd0\x03\x8c#\xce\x8f\xbdIX2v\x95\xf4|\xd2\xe7EW\x88\xd0\xd0\x98\xd1\x15\"\xd9\xf1\x1a\x17\x19\x8cR\xfaz\xe8\xa4\x0f\xb7\xf4\x84$0&\r\x04\x85S\xb9$\xaf\x16\xaf\xe1\x93zT\xddGGr\'\x81\x04\x90U\xc5m\xa31\xf6\x86,]')

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2]
detailed listing:
executing program 2:
futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x6, 0x1, 0x0, 0x0, 0x2)
executing program 3:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0xcf, 0x0, 0x0)
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
bisect: concatenation succeeded
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=1m11.976910762s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm
detailed listing:
executing program 0:
socket$nl_xfrm(0x10, 0x3, 0x6)

program did not crash
testing program (duration=1m11.976910762s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm
detailed listing:
executing program 0:
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

program did not crash
testing program (duration=1m11.976910762s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m11.976910762s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=1m11.976910762s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m11.976910762s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program did not crash
simplifying guilty program options
testing program (duration=1m11.976910762s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
extracting C reproducer
testing compiled C program (duration=1m11.976910762s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program did not crash
testing program (duration=1m11.976910762s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
extracting C reproducer
testing compiled C program (duration=1m11.976910762s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program did not crash
testing program (duration=1m11.976910762s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
validation run: crashed=true
testing program (duration=1m11.976910762s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
validation run: crashed=true
testing program (duration=1m11.976910762s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@updsa={0x138, 0x1a, 0xffffffffffffffff, 0x70bd2a, 0x3, {{@in=@private=0xa010101, @in6=@loopback, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0xa0, 0x11}, {@in=@multicast1, 0x84d4, 0x6c}, @in6=@private1, {0x100000000, 0x0, 0x0, 0xfffffffffffffffd, 0x7ff, 0xfffffffffffffffc, 0xfffffffffffffffd}, {0x0, 0x0, 0x80000000, 0xa6}, {0x936d, 0x3d49, 0x4000}, 0x0, 0x3503, 0xa, 0x1, 0x4, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

program crashed: WARNING in xfrm6_tunnel_net_exit
validation run: crashed=true
reproducing took 1h38m36.428323312s
repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 44 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 net/ipv6/xfrm6_tunnel.c:341
Modules linked in:
CPU: 0 UID: 0 PID: 44 Comm: kworker/u8:2 Not tainted syzkaller #0 001c7e68fa735976e9f6b7ad125989e1d2b10b0e
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 net/ipv6/xfrm6_tunnel.c:341
Code: e8 11 3e db fc 4b 83 3c 3e 00 75 19 e8 45 77 83 fc 49 81 ff f8 07 00 00 74 1b e8 37 77 83 fc 49 83 c7 08 eb c9 e8 2c 77 83 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a
RSP: 0018:ffffc900002dfb90 EFLAGS: 00010293
RAX: ffffffff850425e4 RBX: ffff88812fc66a80 RCX: ffff88810ca51300
RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff8881146687e8
RBP: ffffc900002dfbb0 R08: ffffffff87d350c7 R09: 1ffffffff0fa6a18
R10: dffffc0000000000 R11: fffffbfff0fa6a19 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888114668000 R15: 00000000000007e8
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffca6880c80 CR3: 00000000074a8000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x6bd/0xc90 net/core/net_namespace.c:642
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 44 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 net/ipv6/xfrm6_tunnel.c:344
Modules linked in:
CPU: 0 UID: 0 PID: 44 Comm: kworker/u8:2 Tainted: G        W          syzkaller #0 001c7e68fa735976e9f6b7ad125989e1d2b10b0e
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 net/ipv6/xfrm6_tunnel.c:344
Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 f0 76 83 fc 49 81 ff f8 07 00 00 74 1b e8 e2 76 83 fc 49 83 c7 08 eb c5 e8 d7 76 83 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 c7 76 83 fc 5b 41 5c 41 5e 41
RSP: 0018:ffffc900002dfb90 EFLAGS: 00010293
RAX: ffffffff85042639 RBX: ffff888114668800 RCX: ffff88810ca51300
RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff888114668808
RBP: ffffc900002dfbb0 R08: ffffffff87d350c7 R09: 1ffffffff0fa6a18
R10: dffffc0000000000 R11: fffffbfff0fa6a19 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888114668000 R15: 0000000000000008
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffca6880c80 CR3: 00000000074a8000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x6bd/0xc90 net/core/net_namespace.c:642
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 44 at net/xfrm/xfrm_state.c:3215 xfrm_state_fini+0x2be/0x310 net/xfrm/xfrm_state.c:3215
Modules linked in:
CPU: 0 UID: 0 PID: 44 Comm: kworker/u8:2 Tainted: G        W          syzkaller #0 001c7e68fa735976e9f6b7ad125989e1d2b10b0e
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
RIP: 0010:xfrm_state_fini+0x2be/0x310 net/xfrm/xfrm_state.c:3215
Code: 3c 20 00 74 08 48 89 df e8 4f 07 f6 fc 48 8b 3b e8 e7 45 e1 fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 88 b3 b7 00 cc e8 72 40 9e fc <0f> 0b e9 b0 fd ff ff e8 66 40 9e fc 0f 0b e9 18 fe ff ff e8 5a 40
RSP: 0018:ffffc900002dfb70 EFLAGS: 00010293
RAX: ffffffff84e95c9e RBX: ffff88812fc66a80 RCX: ffff88810ca51300
RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff88810ca51300
RBP: ffffc900002dfb98 R08: ffffffff87d350c7 R09: 1ffffffff0fa6a18
R10: dffffc0000000000 R11: fffffbfff0fa6a19 R12: 1ffffffff0fa6768
R13: dffffc0000000000 R14: ffff88812fc67680 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffca6880c80 CR3: 00000000074a8000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 xfrm_net_exit+0x31/0x80 net/xfrm/xfrm_policy.c:4342
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x6bd/0xc90 net/core/net_namespace.c:642
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 44 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 net/ipv6/xfrm6_tunnel.c:341
Modules linked in:
CPU: 0 UID: 0 PID: 44 Comm: kworker/u8:2 Not tainted syzkaller #0 001c7e68fa735976e9f6b7ad125989e1d2b10b0e
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 net/ipv6/xfrm6_tunnel.c:341
Code: e8 11 3e db fc 4b 83 3c 3e 00 75 19 e8 45 77 83 fc 49 81 ff f8 07 00 00 74 1b e8 37 77 83 fc 49 83 c7 08 eb c9 e8 2c 77 83 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a
RSP: 0018:ffffc900002dfb90 EFLAGS: 00010293
RAX: ffffffff850425e4 RBX: ffff88812fc66a80 RCX: ffff88810ca51300
RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff8881146687e8
RBP: ffffc900002dfbb0 R08: ffffffff87d350c7 R09: 1ffffffff0fa6a18
R10: dffffc0000000000 R11: fffffbfff0fa6a19 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888114668000 R15: 00000000000007e8
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffca6880c80 CR3: 00000000074a8000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x6bd/0xc90 net/core/net_namespace.c:642
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 44 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 net/ipv6/xfrm6_tunnel.c:344
Modules linked in:
CPU: 0 UID: 0 PID: 44 Comm: kworker/u8:2 Tainted: G        W          syzkaller #0 001c7e68fa735976e9f6b7ad125989e1d2b10b0e
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 net/ipv6/xfrm6_tunnel.c:344
Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 f0 76 83 fc 49 81 ff f8 07 00 00 74 1b e8 e2 76 83 fc 49 83 c7 08 eb c5 e8 d7 76 83 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 c7 76 83 fc 5b 41 5c 41 5e 41
RSP: 0018:ffffc900002dfb90 EFLAGS: 00010293
RAX: ffffffff85042639 RBX: ffff888114668800 RCX: ffff88810ca51300
RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff888114668808
RBP: ffffc900002dfbb0 R08: ffffffff87d350c7 R09: 1ffffffff0fa6a18
R10: dffffc0000000000 R11: fffffbfff0fa6a19 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888114668000 R15: 0000000000000008
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffca6880c80 CR3: 00000000074a8000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x6bd/0xc90 net/core/net_namespace.c:642
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 44 at net/xfrm/xfrm_state.c:3215 xfrm_state_fini+0x2be/0x310 net/xfrm/xfrm_state.c:3215
Modules linked in:
CPU: 0 UID: 0 PID: 44 Comm: kworker/u8:2 Tainted: G        W          syzkaller #0 001c7e68fa735976e9f6b7ad125989e1d2b10b0e
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
RIP: 0010:xfrm_state_fini+0x2be/0x310 net/xfrm/xfrm_state.c:3215
Code: 3c 20 00 74 08 48 89 df e8 4f 07 f6 fc 48 8b 3b e8 e7 45 e1 fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 88 b3 b7 00 cc e8 72 40 9e fc <0f> 0b e9 b0 fd ff ff e8 66 40 9e fc 0f 0b e9 18 fe ff ff e8 5a 40
RSP: 0018:ffffc900002dfb70 EFLAGS: 00010293
RAX: ffffffff84e95c9e RBX: ffff88812fc66a80 RCX: ffff88810ca51300
RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff88810ca51300
RBP: ffffc900002dfb98 R08: ffffffff87d350c7 R09: 1ffffffff0fa6a18
R10: dffffc0000000000 R11: fffffbfff0fa6a19 R12: 1ffffffff0fa6768
R13: dffffc0000000000 R14: ffff88812fc67680 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffca6880c80 CR3: 00000000074a8000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 xfrm_net_exit+0x31/0x80 net/xfrm/xfrm_policy.c:4342
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x6bd/0xc90 net/core/net_namespace.c:642
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---