Extracting prog: 1h32m44.314641387s Minimizing prog: 2h31m3.668930613s Simplifying prog options: 17m30.379708345s Extracting C: 6m30.379148164s Simplifying C: 0s extracting reproducer from 68 programs testing a last program of every proc single: executing 18 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_smc-accept4-socket$nl_generic-bind$bt_hci-syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_ABORT_SCAN-socket$inet6-setsockopt$inet6_int-setsockopt$sock_int-setsockopt$inet6_buf-sendto$inet6-recvfrom$inet6-socket-getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED-getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO-socket-socket-setsockopt$netlink_NETLINK_TX_RING-sendmsg$nl_generic-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-sendmmsg-ioctl$ifreq_SIOCGIFINDEX_team-socket$inet6_mptcp-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) accept4(r0, &(0x7f0000000400)=@vsock={0x28, 0x0, 0x0, @my}, &(0x7f0000000480)=0x80, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x67) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r2, &(0x7f0000000040)=ANY=[], 0x6) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_ABORT_SCAN(r1, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r3, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10048040}, 0xc011) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) setsockopt$sock_int(r5, 0x1, 0x1d, &(0x7f0000000000)=0x202, 0x18) setsockopt$inet6_buf(r5, 0x29, 0x3e, &(0x7f00002cef88)="d84f7398", 0x4) sendto$inet6(r5, &(0x7f0000000800)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ef42eeb66c3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dff02ba9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cabc206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea09364ab42ee9802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e218daa5a3ef64617beb30cccb31016b13ed8d7bcabb03e176b1c9bda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c71f496cfe90400fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97184339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f40029d7cfcaf26fd1900d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60e7222697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe072820662d20d4774d66c5ae270adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2cf7196c76959824bbb475a7cad8f57853fe05f59f341b5207cc9bb8d686982c2f158e0d8f5c7ec6cbfd5", 0x5ad, 0x0, &(0x7f0000000080)={0xa, 0x5e20, 0x0, @mcast2}, 0x1c) recvfrom$inet6(r5, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket(0x11, 0x800000003, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x2}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f00000000c0)={0x7, 0x4, 0x81, 0x8, r7}, &(0x7f0000000100)=0x10) r8 = socket(0x10, 0x3, 0x0) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000280)={0x3}, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001200010a000000000000000080000080"], 0x26}}, 0x0) r10 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r10, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmmsg(r10, &(0x7f0000006300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x10}}], 0x1, 0x4000000) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x90, 0x24, 0xf0b, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [], 0x0, [0x4, 0x2], [0x0, 0x4]}}}}, @TCA_RATE={0x6}]}, 0x90}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-setsockopt$bt_BT_SECURITY-sendmsg$sock-socket-ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL-setsockopt$SO_RDS_TRANSPORT-socket-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000003000)={0x2}, 0x2) sendmsg$sock(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x200040d4) r3 = socket(0x2b, 0x80801, 0x1) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f0000000440)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x4, 0x247d, 0x4, @remote, @mcast1, 0x700, 0x8, 0x3a, 0xe9f4}}) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000080)=0x1, 0x4) socket(0x10, 0x6, 0x7f) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x0, 0x0, 0x0, 0x0, 0xffffffff}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}, @TCA_NETEM_LOSS={0x4}]}}}]}, 0x58}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_xfrm-getuid-sendmsg$nl_xfrm-getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET-socket-setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-sendmsg$nl_xfrm-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-sendmsg$NFT_BATCH-socketpair-sendmsg$802154_dgram-ioctl$sock_inet_tcp_SIOCATMARK-sendmsg$kcm-socket$inet_icmp_raw-socket-setsockopt$netlink_NETLINK_TX_RING-sendmsg$nl_generic-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$ethtool detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) getuid() sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000dc020078000000000000000000000000ff02000000000000e26ea7250000000100000000000000000a"], 0xb8}}, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000040)={0x0, 0xffff}, 0x0) r3 = socket(0x9, 0x2, 0xf) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f00000004c0)={r2, @in6={{0xa, 0x4e23, 0x8000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4}}, 0x4, 0x8}, 0x90) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x188}}, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0b040000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}, 0x1, 0x0, 0x0, 0x2408c004}, 0x4808) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$802154_dgram(r6, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000100)="04", 0x1}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r5, 0x8905, &(0x7f0000000280)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000300)="d80000001c0081064e81f782db44b9040a1d08040e000000000002a1180002000600142603600e1208000f0000810401a8001605200001400200680803600cfab94dcf5c0461c1d67f6f94007134cf61e08000a0e4", 0x55}], 0x1, 0x0, 0x0, 0x7400}, 0x40000) socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000180)={0x4000}, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB=' \x00\x00\x00\"\x00'], 0x20}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000fbff00000000000a38000000060a01040000000000000000020000000900020073797a32000000000900010073797a30000000000c0003400000000000000002140000001100010000000000000000000700000a"], 0x60}}, 0x40040d0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r7) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-setsockopt$bt_BT_SECURITY-sendmsg$sock-socket-ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL-setsockopt$SO_RDS_TRANSPORT-socket-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000003000)={0x2}, 0x2) sendmsg$sock(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x200040d4) r3 = socket(0x2b, 0x80801, 0x1) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f0000000440)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x4, 0x247d, 0x4, @remote, @mcast1, 0x700, 0x8, 0x3a, 0xe9f4}}) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000080)=0x1, 0x4) socket(0x10, 0x6, 0x7f) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x0, 0x0, 0x0, 0x0, 0xffffffff}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}, @TCA_NETEM_LOSS={0x4}]}}}]}, 0x58}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD-ioctl$sock_bt_hidp_HIDPCONNDEL-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-syz_init_net_socket$bt_l2cap-setsockopt$bt_l2cap_L2CAP_LM-connect$bt_l2cap-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000000)=0x20, 0x4) connect$bt_l2cap(r1, &(0x7f0000000240)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @quota={{0xa}, @void}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x6, 0x84}}}, 0xd0}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD-ioctl$sock_bt_hidp_HIDPCONNDEL-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-syz_init_net_socket$bt_l2cap-setsockopt$bt_l2cap_L2CAP_LM-connect$bt_l2cap-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000000)=0x20, 0x4) connect$bt_l2cap(r1, &(0x7f0000000240)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @quota={{0xa}, @void}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x6, 0x84}}}, 0xd0}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD-syz_emit_ethernet-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x17, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0xba}]}, &(0x7f0000000140)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000080)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f00000000c0)=ANY=[@ANYRES32=r0]) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @private, @broadcast}, @address_reply={0x2a}}}}}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x7}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_BTF_LOAD-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD-ioctl$sock_bt_hidp_HIDPCONNDEL-sendmsg$NL80211_CMD_CONNECT-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_route-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-sendmsg$nl_route-sendmsg$NL80211_CMD_VENDOR detailed listing: executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020d6a000000000000000010000000002000"], 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r3, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r2, @ANYBLOB="050034008b00f7f80f004c"], 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000013c0)={'syztnl2\x00', 0x0, 0x29, 0x9, 0x6, 0x4, 0x1, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8010, 0x700}}) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_DPORT={0x6}, @IFLA_GRE_TTL={0x5, 0x8, 0x9}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NL80211_CMD_VENDOR(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x10d4, r1, 0x1, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_VENDOR_DATA={0x1004, 0xc5, "65a3d6a1ff6dedb71768136978f05a409fbc1073fffc2ce6bb3316615a4bf2b2ff2ffbc871809dcb848bce1d7bf3088a2296717e8f8a0cc91c9c38375a0ea5335272a3051eaba5d997c2aed8c769ad83b7df10f83965d6e69d07e3e334a1e97768277ea16c6d2ac9b5c565e8c481133d2e4794ce2155fdd108e4806f5375412056bb3e54e469b153c6de390feee1445871f994997acca54331d0ee4411e6f2969aab4efcb989ccc854faf94d8930fabd079a69e906a0f6a8e97f74217d77dfa752675d4195ae18881376d7313fa262309d780579d1d101743529bd83e434b7e53e726ecf5e140520c2328a3ca5af8be75f57bba407235719c960ce16da76f6139c91e37cde4dbd953748eebda25b66b86fdcebd2cee705a716f2734abb085019b7515df8f7e2bc4622ec88b36caafa35cb77e2c06687aff8f300f1149436b89b411a56bd114935ce30cd1d6c5e6a720dcfcc2bac8069d1e83b29d831f0d56e59c3c0ba5d845a53371ac61a5f15b7c6932fe6d9ac85f084c238c0e9a22672c8ac7f095517bb9167da5ddf20cd12f00cd5549db57754b0b295eab9d4efd119524f9e42fe0915535120b71a754004c3831f86dfd0fd8888c732f59ffe6870189de9276b2952c195ee80be7e965713f7cebad682c1b7f1df34c3fbb415b6d7bfa4e464332a76461305b34fc77f4f7e916ba8f614c9de4ed7fff7b93d2df4bb2ed3eba61ce9605dfc3350a17814dbc744f6e76d922ed3d029e1a004419c75d27c2b82182173966dae5b07a2f1067b3dee6706a45192641dc61c5ec57ac284b83d95ce768f4890adb0e7c34ed3e6888b6962ffa95f2e9aaf5c60165c20a4ef03e95bd8b0a56d2b1a6d21e8514e9351214b160e15d434b95ab0400f6a302774ab0869c6c32aaf4a2d23bb094e06de65952ffdeb43f188e4a1c75b837695177bdbb8235e47f7a3d423f989495898919b597f9d092faf3a386eec3aee279afeaae2ed3aec4704803c6ab3517cf85b88c2ea8456cb30bc394ba7be66f6653eede9cc5518257514d6a521a332faa234c303981c1716ddf9cca442ec5737833e0b913670280654451083681aa053f1b28bb724b6ecdb861005f00053a51cd015999153a7eb484ecad3c481e8b1f416db72db1835adc9fa1e9a44676e2290306075ebaff5d3a6781321f17823e6df9150b667344424f425323350b405cab1241de9c0ff817cff918ddc0de76df2985f4bdd464a6aa1cbb49b783c121f1437dbc4984f597264cd5f72cc2b9c16f763fcf3e4941ea53d343da5eb15d2dc1baf0a3f1b729b4eca3e069aae992ed6958b51940276e54ec5f32a73a3233df4e2c57331c98271c7d860cae90cbe92c22354b541fa1361a98169d320b1062def768a3de2fdae34b331d5d586d4f4dc0f98c3d5850b00dad82a6cc22b8c2a56d3391db37624951dea6cb558dc02e1f8930c0e52f97e1054ba90aee52442990b2f4d96f3ef1bfbd0c2a01446b062c685eed4639a666dad892161c2ca1082c5a3b5abaca92c914a9bbd1911fc2594e1586d217258afb0f37c1b9dcaba42f16fc9781aa01dbe4472960730cb100e92914ce7556c2938f9b105f568ea91bf60ac36c80df6dafbc0b0c276ecb9ec2832e5ea6d26b729e140d63dc078081ef2d6eaf2b875bdddbe779cd1b373b4c3863598c6b9a06a82f1c8a6dcfe4e739e35345df68fedf2acf583055f41267699979ebd905fdd34130682ebcd87d5ed34fea2666fd3d18d85ddb5a51ccb6f4494826bde29e9f9c4911b4793dd319f74c65d6b75bc37920f59ed00e7b9fe36716466ffaf24e01d91b645117d14bbf49b64931571ce338234a950a361fd8ea6d7b26561ad4c5dab45f17cb2057f268dd1d080fc0a85ebe439a188503902a247d7d6a1b5a368d6b04ee16d302a67b2d3f60ac9cad7cdb0a5a5b06341e764a422f110cbc65a8a69cc0c52a876692982e3b6db15fe93e5f1032581c3c94c58f03eb7b46583e195e8bd24d24cd6d9e56f3fe7d8876d99540cfe56189ecdefcb1166f11b40e34e0ed998060d9425ace0f6a798e6f7d6e99e906ac4886bb1c72858fedf017b421ccbe9284d3d893bce6f000cdb1211d4b1dca597b8f9ac55dc5e3255355f012a3e7d6736cd806971d44b59ffade97f983dbb45980303ad8ee2e1a770a50e74f7994c51c3e3a35c63e5367ff161e507893da407a590c37fc88345ed1cbe847152a834f1873875a463050a7ef879f8646b8e9dc2e7e927ef2ae7b9b0fb6357a575d8191dafbabead892a112c0e0a0262cc0c77a1f364c405034e14d3682cd30daac36bdabef79e2f7495a1f45207165364d189d7ffbffc6da3462bc99629673edc8382b9549e8bef70536ebab209c7372a26964195675064977296fe813c0c6c68c507757f5606c892490b68dc21330dafacc72979b5c55107bcb310c2b8a7798923d1f3fc94fd811db6bd9042909e612879e5d8df0248fe3afe445cbaf90345f7be1f025dc09a3982939dd63a732835ec1cf7f224148cf8064387be0dc3331f185ef75cb01bf4cc536ae12f1b0fda43d2ed283a436fd92761c2275cf58bf984c51a9c823bb997466b960a1ada51bd27d7c17b067f0c162b4a7fd179c28cfc63439577968779046f8308195824c2c1c21a3110ac2d08a8be954228489e73700212f1ec9433a9aad6821809086ecdbfe87f78f6ee0e68474290712448cc056c7701b02f351df13cae73236db99b67aa6349616f67f2f527db2873f5b59189aa7dda93fc478f76d4818efe246af58c05d7443675ac1b2fba47b0f6ee2d5aececfa673a159336cb5e3bbb303e96c79dcda60c6f14d4197e57c7cd75a7fb48f7f52142bd62a2fdb14f1fd7206e8443928071df4bcb1d59755f67294ea404c856b30b84fbf690f831a9b1a5e63a2f57f4bb0a09b6ef61213887a6937cc3df0e1c8a1d5f9dd6508781f915f5d1c23437089dcd35a2c0343a3466ed22c9c85f503953e8665428b2d40076870095d9d027ac0c94a1ffda0f998a26935164af89fe3336b85c6783d490d1650ba4cbc11aaa837af93fb7f89225f6297259c70525c7f33e1191b46a7e26840dab489af01dc2c56ad8059e73171e45e066952dd3681cf20c1f3c627f1e22b0a3b00639a004bf94ec76895135f0ab537cd7cfa2d28d96c99ab09baf1034a4ba5f2edd52eb4135703f50cbf012155332390282e6fad5c02fdbaa298e286973a46dc81a3b2f5a040f2e2048d9fef70a4e15e6916e1eefc04fffe836e6c14a735f3ef1b134b68026fc6363b84c246f46be83b06e58f7fce7ff6d442ddaaaecf51eb9a45d500c066fad7db3964476b653d07f3413392d7d2d3a4d948c54a41df4d56de980c0a003d3786f3f045d474cc660f97ccb8854e7945acb24f3985b8a2b8e577afd3394cb99d87608a684a2c64469f8c6cdcc27b7a5a3084013dc39344bbc3c950864e2df77851a15d30cbae98a3db0572a1914b3a9be29ad6d7d34fa9023b4636eae86f82adeb527504d0fad27ca6f38f32e823e772f96ff6775e668995529feefd8ab415a56b21929919e1f9debfcef9f029ab746a2e84101fb252f068fe1ad25ef9f953d6a93240c98f51b5f9a80963b0ff1c0e4af8c09b445208d6edecfa4e5b6d8147bc627441fac93dc7a2da7eee79f62116d12f6ca9dcddf5a3ba4fa3ee1acefbf99b5a579b342afc36b4de58719044c55fe65cfc070f8e77368a2ef575481be700fadac2cdf5871fe92543c973725c469598784f43afbed3f7e6f129e6305b7acdb4f65d5dae2fa7cc2b234ebf6c112a3e824f5d6a67cd52a483e7eee9890005ebf43713de2d4117468b2a95f5fd1c43319ca6d806afbbf8eea01c4b0ed04ea3c5fb553caac488dce85b6b606c81e38842c6196118fd3219f7e8cd51303b5492cc2f228d6b660070b5fc3c783c6f5fe7234986743cd930fc5a4ab97458a901f5c7db17aeddf75124475e6f677daf958bc884989cf878bb717cc024b86d0dc13b054d025165be935cbe1eab69e46b7436fdd1576c2f430e13796d95b8540d2e09882ad63c2bbb0e3338d74a67c24dc82b0ee7560cf08dcab2368d915ffc3485f51652d8517996ef0f1c27e8881c573717ec00f96e313a1a2e55dd145edcceea6ea65bceb3c405f6a33fe012080f75a019fab499492af84cfef9b7b56913b03c7825066d78c1a1c3328fac7729227c60e2d990dd7fe9286f10549d69b2a20ffd498ac880972deb14885efe37d903842eb7f962bda466208d2b85ddc30b43a5cead25da36a3c96319a66087653a3df2a6cefd0ca323cb3f09453c79c58d0e7a9d475f84ead3a50887d9a025503c15f9f43c91ba65ee86b1470a2672a4a642661f2839b3d71da1c9639dee23c3a3fb5521b8adfebd08d8c4152cf210ae9a677f2f89dc58f2f9f54924f7f2393c9fa87db8a273a6aee65bde1e0e9c26e22cc6cc472bf1a819a6c67fef80abee86f510fb4094300f136395dbafc5ed092226e379e88ec44e853b68fa67d1d1205bf2d8d2eff13fd5b87890a20baa5d8f83f022de61a9b5451c348d45f483a3d80036f968858c5e81f26478502909ccbea1ec713e5361ddb453ab75604858459866dd34fe4692d1f307d446dccf1c7f50181e096f0eec6cffc01b4295c84956a91c726754d00d2f6527910b96b5be2a48664eb34e0892c3242081411c464fd0671fcb7a1acddee3f65cf18360f16679bc706f0c549dba37f6e700b30f8e3f5591e3113835fe51ee4314f00ad3e36b76ab7503df4ff7fdd7c08c186ed934cb192e88daf9b75652c352dd2fd336457f42abad8538ba73807d8b558cedacf2555d0b8e6fdc5c481fa09a45121f81f16c50c096f3f2d23645e14250891239385dd48863069257b0e6502bbaa47e671de13f76d8a00006dc781c1611d4239ed53471a7f7464deaf960810b420cb257f82b0145280c6b8f5d9bdf36d37c0b675f3531a546ce43b8464f72c72284d58f9e9e2559f7339c1f6cfceea0b6dbea4d700efc81681783b978f9a0f638eb039f94c1f11c02303293dcf5038cedf942ded9456aa17188cb1420e233a0a409a9b02caaed4a29c1cb77644897749d7adc97f95054b19573f32b1c972cf59b5d31303b040d28ad26b6f6d3142c24f6ee53248a53e2dbe5b306860ee4fa8af45757782e7144eebb9755970eb5d7be3672385b1fe59492d7c37f2ce7054ad379dc3e24b718c801b1d0c5eb8481c387a7f6eb831fdf8014748259248ad444ae4b394d27563a6e8312da75b1d18d3f5315affd936f101a7c06812dc8a9501ebafc6db2319d615b63d4be028516eb18aaa2188ca1e8a409983a48f7ac139d9af29a7957ab2d4c4e53dc2a482c371a9df8028b8f3d616fbe815cc0168c009cc2a719477de5e7cd8e70818af5f5532e4ebd2ac621082338aa01430b98c8203b7705e156496bd895f41c8de2c72e860e96974c2979f208724344175eb0120a364baf48e4479ba468a07cdfaed2f2178986ed00dde3098991bd29ab048b8704028953c5f28518e2b49c592a98f10f28d2192b1c35739dc7fee864ba25a21365e2ac24afb9e329c199a214f1e4281cd71efc21e43cebbc540cbaab12ea16b44d62d4e877b2dadefe868b051853d2411262a4d0b6ba0281f27f58f76e1c91dc04a4e00c82f8e63312a1cbc7f13f3b915926eb6447da1aa486fa7ce9c3a11a5aa4b7856dccc19a7e0e3974a09c3d1b2df204dffb7bbcb28ff901d4a15a6e71f902874648ac70f2ad1ea0e697316cc6f2f42ca2d48b4ce6531a597575c6cf75ef65e43990b"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_DATA={0xac, 0xc5, "1fccda8a10a4b3adac19b1d7e08d5c92c11a908803dcc3a87b36e1d0ef8e6f27b2321c79aa0fa089453585bfbb88fcfc8147d77db8aadbf59eda8688c078f675d08c15e5e4d561de1f5bd21e15c72bd24c5e59038a539022675ad066c0d57499f8c51dc7a264b4788e51f34a3f404878f257d26c0613557d1d9d0f9d86997cbc6cad75522d16260b81ed9e1360cfd99380e222103475e148eb3b39081dc63268ebb540618a744a39"}]}, 0x10d4}, 0x1, 0x0, 0x0, 0x811}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-setsockopt$bt_BT_FLUSHABLE-sendmmsg$sock-socket$nl_route-ioctl$F2FS_IOC_MOVE_RANGE-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-sendmsg$nl_route detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r0, &(0x7f00000060c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20000010) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000080)={r1, 0x3, 0x0, 0x6}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x9, 0x4, 0x2, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r2, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001500)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gre={{0x8}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x1}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_TYPE={0x6}]}}}]}, 0x44}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD-syz_emit_ethernet-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x17, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0xba}]}, &(0x7f0000000140)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000080)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f00000000c0)=ANY=[@ANYRES32=r0]) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @private, @broadcast}, @address_reply={0x2a}}}}}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x7}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_BTF_LOAD-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD-ioctl$sock_bt_hidp_HIDPCONNDEL-sendmsg$NL80211_CMD_CONNECT-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_route-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-sendmsg$nl_route-sendmsg$NL80211_CMD_VENDOR detailed listing: executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020d6a000000000000000010000000002000"], 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r3, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r2, @ANYBLOB="050034008b00f7f80f004c"], 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000013c0)={'syztnl2\x00', 0x0, 0x29, 0x9, 0x6, 0x4, 0x1, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8010, 0x700}}) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_DPORT={0x6}, @IFLA_GRE_TTL={0x5, 0x8, 0x9}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NL80211_CMD_VENDOR(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x10d4, r1, 0x1, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_VENDOR_DATA={0x1004, 0xc5, "65a3d6a1ff6dedb71768136978f05a409fbc1073fffc2ce6bb3316615a4bf2b2ff2ffbc871809dcb848bce1d7bf3088a2296717e8f8a0cc91c9c38375a0ea5335272a3051eaba5d997c2aed8c769ad83b7df10f83965d6e69d07e3e334a1e97768277ea16c6d2ac9b5c565e8c481133d2e4794ce2155fdd108e4806f5375412056bb3e54e469b153c6de390feee1445871f994997acca54331d0ee4411e6f2969aab4efcb989ccc854faf94d8930fabd079a69e906a0f6a8e97f74217d77dfa752675d4195ae18881376d7313fa262309d780579d1d101743529bd83e434b7e53e726ecf5e140520c2328a3ca5af8be75f57bba407235719c960ce16da76f6139c91e37cde4dbd953748eebda25b66b86fdcebd2cee705a716f2734abb085019b7515df8f7e2bc4622ec88b36caafa35cb77e2c06687aff8f300f1149436b89b411a56bd114935ce30cd1d6c5e6a720dcfcc2bac8069d1e83b29d831f0d56e59c3c0ba5d845a53371ac61a5f15b7c6932fe6d9ac85f084c238c0e9a22672c8ac7f095517bb9167da5ddf20cd12f00cd5549db57754b0b295eab9d4efd119524f9e42fe0915535120b71a754004c3831f86dfd0fd8888c732f59ffe6870189de9276b2952c195ee80be7e965713f7cebad682c1b7f1df34c3fbb415b6d7bfa4e464332a76461305b34fc77f4f7e916ba8f614c9de4ed7fff7b93d2df4bb2ed3eba61ce9605dfc3350a17814dbc744f6e76d922ed3d029e1a004419c75d27c2b82182173966dae5b07a2f1067b3dee6706a45192641dc61c5ec57ac284b83d95ce768f4890adb0e7c34ed3e6888b6962ffa95f2e9aaf5c60165c20a4ef03e95bd8b0a56d2b1a6d21e8514e9351214b160e15d434b95ab0400f6a302774ab0869c6c32aaf4a2d23bb094e06de65952ffdeb43f188e4a1c75b837695177bdbb8235e47f7a3d423f989495898919b597f9d092faf3a386eec3aee279afeaae2ed3aec4704803c6ab3517cf85b88c2ea8456cb30bc394ba7be66f6653eede9cc5518257514d6a521a332faa234c303981c1716ddf9cca442ec5737833e0b913670280654451083681aa053f1b28bb724b6ecdb861005f00053a51cd015999153a7eb484ecad3c481e8b1f416db72db1835adc9fa1e9a44676e2290306075ebaff5d3a6781321f17823e6df9150b667344424f425323350b405cab1241de9c0ff817cff918ddc0de76df2985f4bdd464a6aa1cbb49b783c121f1437dbc4984f597264cd5f72cc2b9c16f763fcf3e4941ea53d343da5eb15d2dc1baf0a3f1b729b4eca3e069aae992ed6958b51940276e54ec5f32a73a3233df4e2c57331c98271c7d860cae90cbe92c22354b541fa1361a98169d320b1062def768a3de2fdae34b331d5d586d4f4dc0f98c3d5850b00dad82a6cc22b8c2a56d3391db37624951dea6cb558dc02e1f8930c0e52f97e1054ba90aee52442990b2f4d96f3ef1bfbd0c2a01446b062c685eed4639a666dad892161c2ca1082c5a3b5abaca92c914a9bbd1911fc2594e1586d217258afb0f37c1b9dcaba42f16fc9781aa01dbe4472960730cb100e92914ce7556c2938f9b105f568ea91bf60ac36c80df6dafbc0b0c276ecb9ec2832e5ea6d26b729e140d63dc078081ef2d6eaf2b875bdddbe779cd1b373b4c3863598c6b9a06a82f1c8a6dcfe4e739e35345df68fedf2acf583055f41267699979ebd905fdd34130682ebcd87d5ed34fea2666fd3d18d85ddb5a51ccb6f4494826bde29e9f9c4911b4793dd319f74c65d6b75bc37920f59ed00e7b9fe36716466ffaf24e01d91b645117d14bbf49b64931571ce338234a950a361fd8ea6d7b26561ad4c5dab45f17cb2057f268dd1d080fc0a85ebe439a188503902a247d7d6a1b5a368d6b04ee16d302a67b2d3f60ac9cad7cdb0a5a5b06341e764a422f110cbc65a8a69cc0c52a876692982e3b6db15fe93e5f1032581c3c94c58f03eb7b46583e195e8bd24d24cd6d9e56f3fe7d8876d99540cfe56189ecdefcb1166f11b40e34e0ed998060d9425ace0f6a798e6f7d6e99e906ac4886bb1c72858fedf017b421ccbe9284d3d893bce6f000cdb1211d4b1dca597b8f9ac55dc5e3255355f012a3e7d6736cd806971d44b59ffade97f983dbb45980303ad8ee2e1a770a50e74f7994c51c3e3a35c63e5367ff161e507893da407a590c37fc88345ed1cbe847152a834f1873875a463050a7ef879f8646b8e9dc2e7e927ef2ae7b9b0fb6357a575d8191dafbabead892a112c0e0a0262cc0c77a1f364c405034e14d3682cd30daac36bdabef79e2f7495a1f45207165364d189d7ffbffc6da3462bc99629673edc8382b9549e8bef70536ebab209c7372a26964195675064977296fe813c0c6c68c507757f5606c892490b68dc21330dafacc72979b5c55107bcb310c2b8a7798923d1f3fc94fd811db6bd9042909e612879e5d8df0248fe3afe445cbaf90345f7be1f025dc09a3982939dd63a732835ec1cf7f224148cf8064387be0dc3331f185ef75cb01bf4cc536ae12f1b0fda43d2ed283a436fd92761c2275cf58bf984c51a9c823bb997466b960a1ada51bd27d7c17b067f0c162b4a7fd179c28cfc63439577968779046f8308195824c2c1c21a3110ac2d08a8be954228489e73700212f1ec9433a9aad6821809086ecdbfe87f78f6ee0e68474290712448cc056c7701b02f351df13cae73236db99b67aa6349616f67f2f527db2873f5b59189aa7dda93fc478f76d4818efe246af58c05d7443675ac1b2fba47b0f6ee2d5aececfa673a159336cb5e3bbb303e96c79dcda60c6f14d4197e57c7cd75a7fb48f7f52142bd62a2fdb14f1fd7206e8443928071df4bcb1d59755f67294ea404c856b30b84fbf690f831a9b1a5e63a2f57f4bb0a09b6ef61213887a6937cc3df0e1c8a1d5f9dd6508781f915f5d1c23437089dcd35a2c0343a3466ed22c9c85f503953e8665428b2d40076870095d9d027ac0c94a1ffda0f998a26935164af89fe3336b85c6783d490d1650ba4cbc11aaa837af93fb7f89225f6297259c70525c7f33e1191b46a7e26840dab489af01dc2c56ad8059e73171e45e066952dd3681cf20c1f3c627f1e22b0a3b00639a004bf94ec76895135f0ab537cd7cfa2d28d96c99ab09baf1034a4ba5f2edd52eb4135703f50cbf012155332390282e6fad5c02fdbaa298e286973a46dc81a3b2f5a040f2e2048d9fef70a4e15e6916e1eefc04fffe836e6c14a735f3ef1b134b68026fc6363b84c246f46be83b06e58f7fce7ff6d442ddaaaecf51eb9a45d500c066fad7db3964476b653d07f3413392d7d2d3a4d948c54a41df4d56de980c0a003d3786f3f045d474cc660f97ccb8854e7945acb24f3985b8a2b8e577afd3394cb99d87608a684a2c64469f8c6cdcc27b7a5a3084013dc39344bbc3c950864e2df77851a15d30cbae98a3db0572a1914b3a9be29ad6d7d34fa9023b4636eae86f82adeb527504d0fad27ca6f38f32e823e772f96ff6775e668995529feefd8ab415a56b21929919e1f9debfcef9f029ab746a2e84101fb252f068fe1ad25ef9f953d6a93240c98f51b5f9a80963b0ff1c0e4af8c09b445208d6edecfa4e5b6d8147bc627441fac93dc7a2da7eee79f62116d12f6ca9dcddf5a3ba4fa3ee1acefbf99b5a579b342afc36b4de58719044c55fe65cfc070f8e77368a2ef575481be700fadac2cdf5871fe92543c973725c469598784f43afbed3f7e6f129e6305b7acdb4f65d5dae2fa7cc2b234ebf6c112a3e824f5d6a67cd52a483e7eee9890005ebf43713de2d4117468b2a95f5fd1c43319ca6d806afbbf8eea01c4b0ed04ea3c5fb553caac488dce85b6b606c81e38842c6196118fd3219f7e8cd51303b5492cc2f228d6b660070b5fc3c783c6f5fe7234986743cd930fc5a4ab97458a901f5c7db17aeddf75124475e6f677daf958bc884989cf878bb717cc024b86d0dc13b054d025165be935cbe1eab69e46b7436fdd1576c2f430e13796d95b8540d2e09882ad63c2bbb0e3338d74a67c24dc82b0ee7560cf08dcab2368d915ffc3485f51652d8517996ef0f1c27e8881c573717ec00f96e313a1a2e55dd145edcceea6ea65bceb3c405f6a33fe012080f75a019fab499492af84cfef9b7b56913b03c7825066d78c1a1c3328fac7729227c60e2d990dd7fe9286f10549d69b2a20ffd498ac880972deb14885efe37d903842eb7f962bda466208d2b85ddc30b43a5cead25da36a3c96319a66087653a3df2a6cefd0ca323cb3f09453c79c58d0e7a9d475f84ead3a50887d9a025503c15f9f43c91ba65ee86b1470a2672a4a642661f2839b3d71da1c9639dee23c3a3fb5521b8adfebd08d8c4152cf210ae9a677f2f89dc58f2f9f54924f7f2393c9fa87db8a273a6aee65bde1e0e9c26e22cc6cc472bf1a819a6c67fef80abee86f510fb4094300f136395dbafc5ed092226e379e88ec44e853b68fa67d1d1205bf2d8d2eff13fd5b87890a20baa5d8f83f022de61a9b5451c348d45f483a3d80036f968858c5e81f26478502909ccbea1ec713e5361ddb453ab75604858459866dd34fe4692d1f307d446dccf1c7f50181e096f0eec6cffc01b4295c84956a91c726754d00d2f6527910b96b5be2a48664eb34e0892c3242081411c464fd0671fcb7a1acddee3f65cf18360f16679bc706f0c549dba37f6e700b30f8e3f5591e3113835fe51ee4314f00ad3e36b76ab7503df4ff7fdd7c08c186ed934cb192e88daf9b75652c352dd2fd336457f42abad8538ba73807d8b558cedacf2555d0b8e6fdc5c481fa09a45121f81f16c50c096f3f2d23645e14250891239385dd48863069257b0e6502bbaa47e671de13f76d8a00006dc781c1611d4239ed53471a7f7464deaf960810b420cb257f82b0145280c6b8f5d9bdf36d37c0b675f3531a546ce43b8464f72c72284d58f9e9e2559f7339c1f6cfceea0b6dbea4d700efc81681783b978f9a0f638eb039f94c1f11c02303293dcf5038cedf942ded9456aa17188cb1420e233a0a409a9b02caaed4a29c1cb77644897749d7adc97f95054b19573f32b1c972cf59b5d31303b040d28ad26b6f6d3142c24f6ee53248a53e2dbe5b306860ee4fa8af45757782e7144eebb9755970eb5d7be3672385b1fe59492d7c37f2ce7054ad379dc3e24b718c801b1d0c5eb8481c387a7f6eb831fdf8014748259248ad444ae4b394d27563a6e8312da75b1d18d3f5315affd936f101a7c06812dc8a9501ebafc6db2319d615b63d4be028516eb18aaa2188ca1e8a409983a48f7ac139d9af29a7957ab2d4c4e53dc2a482c371a9df8028b8f3d616fbe815cc0168c009cc2a719477de5e7cd8e70818af5f5532e4ebd2ac621082338aa01430b98c8203b7705e156496bd895f41c8de2c72e860e96974c2979f208724344175eb0120a364baf48e4479ba468a07cdfaed2f2178986ed00dde3098991bd29ab048b8704028953c5f28518e2b49c592a98f10f28d2192b1c35739dc7fee864ba25a21365e2ac24afb9e329c199a214f1e4281cd71efc21e43cebbc540cbaab12ea16b44d62d4e877b2dadefe868b051853d2411262a4d0b6ba0281f27f58f76e1c91dc04a4e00c82f8e63312a1cbc7f13f3b915926eb6447da1aa486fa7ce9c3a11a5aa4b7856dccc19a7e0e3974a09c3d1b2df204dffb7bbcb28ff901d4a15a6e71f902874648ac70f2ad1ea0e697316cc6f2f42ca2d48b4ce6531a597575c6cf75ef65e43990b"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_DATA={0xac, 0xc5, "1fccda8a10a4b3adac19b1d7e08d5c92c11a908803dcc3a87b36e1d0ef8e6f27b2321c79aa0fa089453585bfbb88fcfc8147d77db8aadbf59eda8688c078f675d08c15e5e4d561de1f5bd21e15c72bd24c5e59038a539022675ad066c0d57499f8c51dc7a264b4788e51f34a3f404878f257d26c0613557d1d9d0f9d86997cbc6cad75522d16260b81ed9e1360cfd99380e222103475e148eb3b39081dc63268ebb540618a744a39"}]}, 0x10d4}, 0x1, 0x0, 0x0, 0x811}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-setsockopt$bt_BT_FLUSHABLE-sendmmsg$sock-socket$nl_route-ioctl$F2FS_IOC_MOVE_RANGE-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-sendmsg$nl_route detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r0, &(0x7f00000060c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20000010) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000080)={r1, 0x3, 0x0, 0x6}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x9, 0x4, 0x2, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r2, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001500)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gre={{0x8}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x1}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_TYPE={0x6}]}}}]}, 0x44}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket-setsockopt$packet_tx_ring-connect$can_bcm-connect$pptp-socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET-setsockopt$inet_int-getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r3, 0x58, &(0x7f0000000040)}, 0x10) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r8 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r9, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x10000ed, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x101}]}, &(0x7f0000000200)=0x10) r10 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r10, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) connect$can_bcm(r10, &(0x7f0000000040), 0x10) connect$pptp(r10, &(0x7f0000000040)={0x18, 0x2, {0x3, @rand_addr=0x64010102}}, 0x1e) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r11, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="2400340000040801020000000006000b400000000005000300"/36], 0x24}}, 0x0) setsockopt$inet_int(r2, 0x0, 0x22, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000240)={r1}, &(0x7f0000000180)=0x8) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket-setsockopt$packet_tx_ring-connect$can_bcm-connect$pptp-socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET-setsockopt$inet_int detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r3, 0x58, &(0x7f0000000040)}, 0x10) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r8 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r9, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x10000ed, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x101}]}, &(0x7f0000000200)=0x10) r10 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r10, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) connect$can_bcm(r10, &(0x7f0000000040), 0x10) connect$pptp(r10, &(0x7f0000000040)={0x18, 0x2, {0x3, @rand_addr=0x64010102}}, 0x1e) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r11, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="2400340000040801020000000006000b400000000005000300"/36], 0x24}}, 0x0) setsockopt$inet_int(r2, 0x0, 0x22, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket-setsockopt$packet_tx_ring-connect$can_bcm-connect$pptp-socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r2, 0x58, &(0x7f0000000040)}, 0x10) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r7 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r8, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x10000ed, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x101}]}, &(0x7f0000000200)=0x10) r9 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) connect$can_bcm(r9, &(0x7f0000000040), 0x10) connect$pptp(r9, &(0x7f0000000040)={0x18, 0x2, {0x3, @rand_addr=0x64010102}}, 0x1e) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r10, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="2400340000040801020000000006000b400000000005000300"/36], 0x24}}, 0x0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket-setsockopt$packet_tx_ring-connect$can_bcm-connect$pptp-socket$nl_netfilter detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r2, 0x58, &(0x7f0000000040)}, 0x10) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r7 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r8, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x10000ed, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x101}]}, &(0x7f0000000200)=0x10) r9 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) connect$can_bcm(r9, &(0x7f0000000040), 0x10) connect$pptp(r9, &(0x7f0000000040)={0x18, 0x2, {0x3, @rand_addr=0x64010102}}, 0x1e) socket$nl_netfilter(0x10, 0x3, 0xc) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket-setsockopt$packet_tx_ring-connect$can_bcm-connect$pptp detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r2, 0x58, &(0x7f0000000040)}, 0x10) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r7 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r8, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x10000ed, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x101}]}, &(0x7f0000000200)=0x10) r9 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) connect$can_bcm(r9, &(0x7f0000000040), 0x10) connect$pptp(r9, &(0x7f0000000040)={0x18, 0x2, {0x3, @rand_addr=0x64010102}}, 0x1e) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket-setsockopt$packet_tx_ring-connect$can_bcm detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r2, 0x58, &(0x7f0000000040)}, 0x10) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r7 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r8, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x10000ed, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x101}]}, &(0x7f0000000200)=0x10) r9 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) connect$can_bcm(r9, &(0x7f0000000040), 0x10) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket-setsockopt$packet_tx_ring detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r2, 0x58, &(0x7f0000000040)}, 0x10) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r7 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r8, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x10000ed, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x101}]}, &(0x7f0000000200)=0x10) r9 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r2, 0x58, &(0x7f0000000040)}, 0x10) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r7 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r8, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x10000ed, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x101}]}, &(0x7f0000000200)=0x10) socket(0x1e, 0x4, 0x0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3 detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r2, 0x58, &(0x7f0000000040)}, 0x10) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r7 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r8, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x10000ed, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x101}]}, &(0x7f0000000200)=0x10) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r6 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r7, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-bpf$PROG_LOAD detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r6 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r7, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-syz_init_net_socket$bt_l2cap-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r6 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-ioctl$TUNGETDEVNETNS-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r6 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) socket(0x2000000000000021, 0x2, 0x10000000000002) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004640)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xb2}]}]}, 0x28}}, 0x40840) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_generic-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-syz_genetlink_get_family_id$nl80211-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-bpf$PROG_LOAD_XDP-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-bpf$BPF_GET_MAP_INFO-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r1, 0x58, &(0x7f0000000040)}, 0x10) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-bpf$BPF_BTF_LOAD-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_udp-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000140)=0x10) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-shutdown-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) shutdown(r0, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-syz_emit_ethernet-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x26, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2a1ae873a8edb02199e000000000000000046310000000000000081bb85266734c8acbb498c513425000000000000000000"], 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet_icmp_raw-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x40080c0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x40080c0) program did not crash reproducing took 4h28m11.938986121s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x6e/0x190 net/ethtool/ioctl.c:443 Read of size 8 at addr ffff8880320202e8 by task kworker/1:4/5890 CPU: 1 UID: 0 PID: 5890 Comm: kworker/1:4 Not tainted 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 Workqueue: events smc_ib_port_event_work Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xb4/0x290 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 __ethtool_get_link_ksettings+0x6e/0x190 net/ethtool/ioctl.c:443 ib_get_eth_speed+0x15e/0x7b0 drivers/infiniband/core/verbs.c:1996 rxe_query_port+0x93/0x3b0 drivers/infiniband/sw/rxe/rxe_verbs.c:62 __ib_query_port drivers/infiniband/core/device.c:2109 [inline] ib_query_port+0x16d/0x830 drivers/infiniband/core/device.c:2141 smc_ib_remember_port_attr net/smc/smc_ib.c:364 [inline] smc_ib_port_event_work+0x15a/0x940 net/smc/smc_ib.c:388 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 5925: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4341 [inline] __kvmalloc_node_noprof+0x314/0x5e0 mm/slub.c:5026 alloc_netdev_mqs+0xa6/0x11e0 net/core/dev.c:11616 rtnl_create_link+0x31f/0xd10 net/core/rtnetlink.c:3641 rtnl_newlink_create+0x258/0xaf0 net/core/rtnetlink.c:3823 __rtnl_newlink net/core/rtnetlink.c:3950 [inline] rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4065 rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6955 netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x758/0x8d0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 __sys_sendto+0x3bd/0x520 net/socket.c:2180 __do_sys_sendto net/socket.c:2187 [inline] __se_sys_sendto net/socket.c:2183 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2183 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1085: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2398 [inline] slab_free mm/slub.c:4656 [inline] kfree+0x193/0x440 mm/slub.c:4855 device_release+0x99/0x1c0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x228/0x480 lib/kobject.c:737 netdev_run_todo+0xd2e/0xea0 net/core/dev.c:11317 default_device_exit_batch+0x81e/0x890 net/core/dev.c:12539 ops_exit_list net/core/net_namespace.c:177 [inline] cleanup_net+0x7a9/0xbd0 net/core/net_namespace.c:654 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888032020000 which belongs to the cache kmalloc-cg-4k of size 4096 The buggy address is located 744 bytes inside of freed 4096-byte region [ffff888032020000, ffff888032021000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32020 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff8880306b41c1 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801a04b500 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000040004 00000000f5000000 ffff8880306b41c1 head: 00fff00000000040 ffff88801a04b500 dead000000000122 0000000000000000 head: 0000000000000000 0000000000040004 00000000f5000000 ffff8880306b41c1 head: 00fff00000000003 ffffea0000c80801 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5925, tgid 5925 (syz-executor), ts 92693750365, free_ts 92687327758 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1d8/0x230 mm/page_alloc.c:1718 prep_new_page mm/page_alloc.c:1726 [inline] get_page_from_freelist+0x21ce/0x22b0 mm/page_alloc.c:3688 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4970 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2301 alloc_slab_page mm/slub.c:2468 [inline] allocate_slab+0x8a/0x3b0 mm/slub.c:2632 new_slab mm/slub.c:2686 [inline] ___slab_alloc+0xbfc/0x1480 mm/slub.c:3872 __slab_alloc mm/slub.c:3962 [inline] __slab_alloc_node mm/slub.c:4037 [inline] slab_alloc_node mm/slub.c:4198 [inline] __do_kmalloc_node mm/slub.c:4340 [inline] __kvmalloc_node_noprof+0x411/0x5e0 mm/slub.c:5026 alloc_netdev_mqs+0xa6/0x11e0 net/core/dev.c:11616 rtnl_create_link+0x31f/0xd10 net/core/rtnetlink.c:3641 rtnl_newlink_create+0x258/0xaf0 net/core/rtnetlink.c:3823 __rtnl_newlink net/core/rtnetlink.c:3950 [inline] rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4065 rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6955 netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x758/0x8d0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 page last free pid 36 tgid 36 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1262 [inline] __free_frozen_pages+0xb0e/0xcd0 mm/page_alloc.c:2725 discard_slab mm/slub.c:2730 [inline] __put_partials+0x161/0x1c0 mm/slub.c:3199 put_cpu_partial+0x17c/0x250 mm/slub.c:3274 __slab_free+0x2f7/0x400 mm/slub.c:4526 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4161 [inline] slab_alloc_node mm/slub.c:4210 [inline] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 mm/slub.c:4262 __alloc_skb+0x112/0x2d0 net/core/skbuff.c:658 alloc_skb include/linux/skbuff.h:1340 [inline] nlmsg_new include/net/netlink.h:1019 [inline] genlmsg_new include/net/genetlink.h:611 [inline] hwsim_mcast_del_radio drivers/net/wireless/virtual/mac80211_hwsim.c:5631 [inline] mac80211_hwsim_del_radio+0xad/0x460 drivers/net/wireless/virtual/mac80211_hwsim.c:5663 hwsim_exit_net+0x584/0x640 drivers/net/wireless/virtual/mac80211_hwsim.c:6545 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x717/0xbd0 net/core/net_namespace.c:654 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 Memory state around the buggy address: ffff888032020180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888032020200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888032020280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888032020300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888032020380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x6e/0x190 net/ethtool/ioctl.c:443 Read of size 8 at addr ffff8880320202e8 by task kworker/1:4/5890 CPU: 1 UID: 0 PID: 5890 Comm: kworker/1:4 Not tainted 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 Workqueue: events smc_ib_port_event_work Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xb4/0x290 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 __ethtool_get_link_ksettings+0x6e/0x190 net/ethtool/ioctl.c:443 ib_get_eth_speed+0x15e/0x7b0 drivers/infiniband/core/verbs.c:1996 rxe_query_port+0x93/0x3b0 drivers/infiniband/sw/rxe/rxe_verbs.c:62 __ib_query_port drivers/infiniband/core/device.c:2109 [inline] ib_query_port+0x16d/0x830 drivers/infiniband/core/device.c:2141 smc_ib_remember_port_attr net/smc/smc_ib.c:364 [inline] smc_ib_port_event_work+0x15a/0x940 net/smc/smc_ib.c:388 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 5925: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4341 [inline] __kvmalloc_node_noprof+0x314/0x5e0 mm/slub.c:5026 alloc_netdev_mqs+0xa6/0x11e0 net/core/dev.c:11616 rtnl_create_link+0x31f/0xd10 net/core/rtnetlink.c:3641 rtnl_newlink_create+0x258/0xaf0 net/core/rtnetlink.c:3823 __rtnl_newlink net/core/rtnetlink.c:3950 [inline] rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4065 rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6955 netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x758/0x8d0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 __sys_sendto+0x3bd/0x520 net/socket.c:2180 __do_sys_sendto net/socket.c:2187 [inline] __se_sys_sendto net/socket.c:2183 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2183 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1085: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2398 [inline] slab_free mm/slub.c:4656 [inline] kfree+0x193/0x440 mm/slub.c:4855 device_release+0x99/0x1c0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x228/0x480 lib/kobject.c:737 netdev_run_todo+0xd2e/0xea0 net/core/dev.c:11317 default_device_exit_batch+0x81e/0x890 net/core/dev.c:12539 ops_exit_list net/core/net_namespace.c:177 [inline] cleanup_net+0x7a9/0xbd0 net/core/net_namespace.c:654 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888032020000 which belongs to the cache kmalloc-cg-4k of size 4096 The buggy address is located 744 bytes inside of freed 4096-byte region [ffff888032020000, ffff888032021000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32020 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff8880306b41c1 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801a04b500 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000040004 00000000f5000000 ffff8880306b41c1 head: 00fff00000000040 ffff88801a04b500 dead000000000122 0000000000000000 head: 0000000000000000 0000000000040004 00000000f5000000 ffff8880306b41c1 head: 00fff00000000003 ffffea0000c80801 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5925, tgid 5925 (syz-executor), ts 92693750365, free_ts 92687327758 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1d8/0x230 mm/page_alloc.c:1718 prep_new_page mm/page_alloc.c:1726 [inline] get_page_from_freelist+0x21ce/0x22b0 mm/page_alloc.c:3688 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4970 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2301 alloc_slab_page mm/slub.c:2468 [inline] allocate_slab+0x8a/0x3b0 mm/slub.c:2632 new_slab mm/slub.c:2686 [inline] ___slab_alloc+0xbfc/0x1480 mm/slub.c:3872 __slab_alloc mm/slub.c:3962 [inline] __slab_alloc_node mm/slub.c:4037 [inline] slab_alloc_node mm/slub.c:4198 [inline] __do_kmalloc_node mm/slub.c:4340 [inline] __kvmalloc_node_noprof+0x411/0x5e0 mm/slub.c:5026 alloc_netdev_mqs+0xa6/0x11e0 net/core/dev.c:11616 rtnl_create_link+0x31f/0xd10 net/core/rtnetlink.c:3641 rtnl_newlink_create+0x258/0xaf0 net/core/rtnetlink.c:3823 __rtnl_newlink net/core/rtnetlink.c:3950 [inline] rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4065 rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6955 netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x758/0x8d0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 page last free pid 36 tgid 36 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1262 [inline] __free_frozen_pages+0xb0e/0xcd0 mm/page_alloc.c:2725 discard_slab mm/slub.c:2730 [inline] __put_partials+0x161/0x1c0 mm/slub.c:3199 put_cpu_partial+0x17c/0x250 mm/slub.c:3274 __slab_free+0x2f7/0x400 mm/slub.c:4526 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4161 [inline] slab_alloc_node mm/slub.c:4210 [inline] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 mm/slub.c:4262 __alloc_skb+0x112/0x2d0 net/core/skbuff.c:658 alloc_skb include/linux/skbuff.h:1340 [inline] nlmsg_new include/net/netlink.h:1019 [inline] genlmsg_new include/net/genetlink.h:611 [inline] hwsim_mcast_del_radio drivers/net/wireless/virtual/mac80211_hwsim.c:5631 [inline] mac80211_hwsim_del_radio+0xad/0x460 drivers/net/wireless/virtual/mac80211_hwsim.c:5663 hwsim_exit_net+0x584/0x640 drivers/net/wireless/virtual/mac80211_hwsim.c:6545 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x717/0xbd0 net/core/net_namespace.c:654 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 Memory state around the buggy address: ffff888032020180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888032020200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888032020280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888032020300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888032020380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================